Comment 3 for bug 1845820

Revision history for this message
dann frazier (dannf) wrote :

I bisected this down to the following commit, which suggests we need a fix for ThunderX IOMMU config, but can consider disabling ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT until then. To confirm, I verified that 5.3 boots fine with arm-smmu.disable_bypass=n on the cmdline.

commit 954a03be033c7cef80ddc232e7cbdb17df735663
Author: Douglas Anderson <REDACTED>
Date: Fri Mar 1 11:20:17 2019 -0800

    iommu/arm-smmu: Break insecure users by disabling bypass by default

    If you're bisecting why your peripherals stopped working, it's
    probably this CL. Specifically if you see this in your dmesg:
      Unexpected global fault, this could be serious
    ...then it's almost certainly this CL.

    Running your IOMMU-enabled peripherals with the IOMMU in bypass mode
    is insecure and effectively disables the protection they provide.
    There are few reasons to allow unmatched stream bypass, and even fewer
    good ones.

    This patch starts the transition over to make it much harder to run
    your system insecurely. Expected steps:

    1. By default disable bypass (so anyone insecure will notice) but make
       it easy for someone to re-enable bypass with just a KConfig change.
       That's this patch.

    2. After people have had a little time to come to grips with the fact
       that they need to set their IOMMUs properly and have had time to
       dig into how to do this, the KConfig will be eliminated and bypass
       will simply be disabled. Folks who are truly upset and still
       haven't fixed their system can either figure out how to add
       'arm-smmu.disable_bypass=n' to their command line or revert the
       patch in their own private kernel. Of course these folks will be
       less secure.