On Wed, May 12, 2021 at 02:44:26PM +0800, Lu Baolu wrote: > When first-level page tables are used for IOVA translation, we use user > privilege by setting U/S bit in the page table entry. This is to make it > consistent with the second level translation, where the U/S enforcement > is not available. Clear the SRE (Supervisor Request Enable) field in the > pasid table entry of RID2PASID so that requests requesting the supervisor > privilege are blocked and treated as DMA remapping faults. > > Suggested-by: Jacob Pan <jacob.jun....@linux.intel.com> > Fixes: b802d070a52a1 ("iommu/vt-d: Use iova over first level") > Signed-off-by: Lu Baolu <baolu...@linux.intel.com> > --- > drivers/iommu/intel/iommu.c | 7 +++++-- > drivers/iommu/intel/pasid.c | 3 ++- > 2 files changed, 7 insertions(+), 3 deletions(-) > > diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c > index 708f430af1c4..f1742da42478 100644 > --- a/drivers/iommu/intel/iommu.c > +++ b/drivers/iommu/intel/iommu.c > @@ -2525,9 +2525,9 @@ static int domain_setup_first_level(struct intel_iommu > *iommu, > struct device *dev, > u32 pasid) > { > - int flags = PASID_FLAG_SUPERVISOR_MODE; > struct dma_pte *pgd = domain->pgd; > int agaw, level; > + int flags = 0; > > /* > * Skip top levels of page tables for iommu which has > @@ -2543,7 +2543,10 @@ static int domain_setup_first_level(struct intel_iommu > *iommu, > if (level != 4 && level != 5) > return -EINVAL; > > - flags |= (level == 5) ? PASID_FLAG_FL5LP : 0; > + if (pasid != PASID_RID2PASID) > + flags |= PASID_FLAG_SUPERVISOR_MODE; > + if (level == 5) > + flags |= PASID_FLAG_FL5LP;
Given that we are still not bought into the supervisor PASID, should we make this an explicit request before turning on SUPERVISOR mode always? Since pasid_set_sre() has no return, we have no way to fail it. > > if (domain->domain.type == IOMMU_DOMAIN_UNMANAGED) > flags |= PASID_FLAG_PAGE_SNOOP; > diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c > index 72646bafc52f..72dc84821dad 100644 > --- a/drivers/iommu/intel/pasid.c > +++ b/drivers/iommu/intel/pasid.c > @@ -699,7 +699,8 @@ int intel_pasid_setup_second_level(struct intel_iommu > *iommu, > * Since it is a second level only translation setup, we should > * set SRE bit as well (addresses are expected to be GPAs). > */ > - pasid_set_sre(pte); > + if (pasid != PASID_RID2PASID) > + pasid_set_sre(pte); > pasid_set_present(pte); > pasid_flush_caches(iommu, pte, pasid, did); > > -- > 2.25.1 > -- Cheers, Ashok [Forgiveness is the attribute of the STRONG - Gandhi] _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu