• Russell King's avatar
    iommu/tegra-smmu: Fix unmap() method · b98e34f0
    Russell King authored
    The Tegra SMMU unmap path has several problems:
    1. as_pte_put() can perform a write-after-free
    2. tegra_smmu_unmap() can perform cache maintanence on a page we have
       just freed.
    3. when a page table is unmapped, there is no CPU cache maintanence of
       the write clearing the page directory entry, nor is there any
       maintanence of the IOMMU to ensure that it sees the page table has
       gone.
    
    Fix this by getting rid of as_pte_put(), and instead coding the PTE
    unmap separately from the PDE unmap, placing the PDE unmap after the
    PTE unmap has been completed.
    Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
    b98e34f0
tegra-smmu.c 19.8 KB