On 5/3/2018 9:35 AM, Joerg Roedel wrote: > On Sun, Apr 29, 2018 at 09:16:48PM +0300, Gil Kupfer wrote: >> This patch adds noats option to the pci boot parameter. >> When noats is selected, all ATS related functions fail immediately and >> the IOMMU is configured to not use device-iotlb. >> >> Any function that checks for ATS capabilities directly against the >> devices should also check this flag. (Currently, such functions exist >> only in IOMMU drivers, and they are covered by this patch.) >> >> The motivation behind this patch is the existence of malicious devices. >> Lots of research has been done about how to utilitize the IOMMU as a >> protection from such devices. When ATS is supported, any I/O device can >> access any physical access by faking device-IOTLB entries. >> Adding the ability to ignore these entries lets sysadmins enhance system >> security. >> >> Signed-off-by: Gil Kupfer <gil...@cs.technion.ac.il> > > This has also been on my list, thanks for doing that. > > Acked-by: Joerg Roedel <jroe...@suse.de> >
I also like the idea in general. Minor nit.. Shouldn't this be an iommu parameter rather than a PCI kernel command line parameter? We now have an iommu.passthrough argument that prevents page translation. Doesn't this fit into the same category especially when it is the IOMMU drivers that call ATS functions for enablement not the PCI drivers. -- Sinan Kaya Qualcomm Datacenter Technologies, Inc. as an affiliate of Qualcomm Technologies, Inc. Qualcomm Technologies, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project.
