evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

iommu/io-pgtable-arm: avoid speculative walks through TTBR1

Browse source 
Although we set TCR.T1SZ to 0, the input address range covered by TTBR1
is actually calculated using T0SZ in this case on the ARM SMMU. This
could theoretically lead to speculative table walks through physical
address zero, leading to all sorts of fun and games if we have MMIO
regions down there.

This patch avoids the issue by setting EPD1 to disable walks through
the unused TTBR1 register.

Change-Id: I766a0e19714b7f4e6659331ae0772efc28b95224
Signed-off-by: Will Deacon <will.deacon@arm.com>
[pdaly@codeaurora.org Use upstream version]
This commit is contained in:
Will Deacon 2015-03-18 10:22:18 +00:00 • committed by David Keitel
parent 81eb6eff75
commit 02041d4238
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/iommu/io-pgtable-arm.c
View file

@ -119,6 +119,8 @@
#define ARM_32_LPAE_TCR_EAE (1 << 31) #define ARM_32_LPAE_TCR_EAE (1 << 31)
#define ARM_64_LPAE_S2_TCR_RES1 (1 << 31) #define ARM_64_LPAE_S2_TCR_RES1 (1 << 31)
#define ARM_LPAE_TCR_EPD1 (1 << 23)
#define ARM_LPAE_TCR_TG0_4K (0 << 14) #define ARM_LPAE_TCR_TG0_4K (0 << 14)
#define ARM_LPAE_TCR_TG0_64K (1 << 14) #define ARM_LPAE_TCR_TG0_64K (1 << 14)
#define ARM_LPAE_TCR_TG0_16K (2 << 14) #define ARM_LPAE_TCR_TG0_16K (2 << 14)
@ -891,7 +893,9 @@ arm_64_lpae_alloc_pgtable_s1(struct io_pgtable_cfg *cfg, void *cookie)
} }
reg |= (64ULL - cfg->ias) << ARM_LPAE_TCR_T0SZ_SHIFT; reg |= (64ULL - cfg->ias) << ARM_LPAE_TCR_T0SZ_SHIFT;
reg |= ARM_LPAE_TCR_EPD1_FAULT << ARM_LPAE_TCR_EPD1_SHIFT;
/* Disable speculative walks through TTBR1 */
reg |= ARM_LPAE_TCR_EPD1;
cfg->arm_lpae_s1_cfg.tcr = reg; cfg->arm_lpae_s1_cfg.tcr = reg;
/* MAIRs */ /* MAIRs */