lkml.org 
[lkml]   [2021]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v3 09/18] PCI: portdrv: Suppress kernel DMA ownership auto-claiming
    Date
    IOMMU grouping on PCI necessitates that if we lack isolation on a bridge
    then all of the downstream devices will be part of the same IOMMU group
    as the bridge. The existing vfio framework allows the portdrv driver to
    be bound to the bridge while its downstream devices are assigned to user
    space. The pci_dma_configure() marks the iommu_group as containing only
    devices with kernel drivers that manage DMA. Avoid this default behavior
    for the portdrv driver in order for compatibility with the current vfio
    policy.

    The commit 5f096b14d421b ("vfio: Whitelist PCI bridges") extended above
    policy to all kernel drivers of bridge class. This is not always safe.
    For example, The shpchp_core driver relies on the PCI MMIO access for the
    controller functionality. With its downstream devices assigned to the
    userspace, the MMIO might be changed through user initiated P2P accesses
    without any notification. This might break the kernel driver integrity
    and lead to some unpredictable consequences.

    For any bridge driver, in order to avoiding default kernel DMA ownership
    claiming, we should consider:

    1) Does the bridge driver use DMA? Calling pci_set_master() or
    a dma_map_* API is a sure indicate the driver is doing DMA

    2) If the bridge driver uses MMIO, is it tolerant to hostile
    userspace also touching the same MMIO registers via P2P DMA
    attacks?

    Conservatively if the driver maps an MMIO region at all, we can say that
    it fails the test.

    Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
    Suggested-by: Kevin Tian <kevin.tian@intel.com>
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    ---
    drivers/pci/pcie/portdrv_pci.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
    index 35eca6277a96..c66a83f2c987 100644
    --- a/drivers/pci/pcie/portdrv_pci.c
    +++ b/drivers/pci/pcie/portdrv_pci.c
    @@ -202,6 +202,8 @@ static struct pci_driver pcie_portdriver = {

    .err_handler = &pcie_portdrv_err_handler,

    + .suppress_auto_claim_dma_owner = true,
    +
    .driver.pm = PCIE_PORTDRV_PM_OPS,
    };

    --
    2.25.1
    \
     
     \ /
      Last update: 2021-12-06 03:01    [W:4.293 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site