lkml.org 
[lkml]   [2019]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.0 056/262] iommu/vt-d: Disable ATS support on untrusted devices
    Date
    From: Lu Baolu <baolu.lu@linux.intel.com>

    [ Upstream commit d8b8591054575f33237556c32762d54e30774d28 ]

    Commit fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted
    devices") disables ATS support on the devices which have been marked
    as untrusted. Unfortunately this is not enough to fix the DMA attack
    vulnerabiltiies because IOMMU driver allows translated requests as
    long as a device advertises the ATS capability. Hence a malicious
    peripheral device could use this to bypass IOMMU.

    This disables the ATS support on untrusted devices by clearing the
    internal per-device ATS mark. As the result, IOMMU driver will block
    any translated requests from any device marked as untrusted.

    Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
    Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
    Suggested-by: Kevin Tian <kevin.tian@intel.com>
    Suggested-by: Ashok Raj <ashok.raj@intel.com>
    Fixes: fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted devices")
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/iommu/intel-iommu.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    index 78188bf7e90d..dbd6824dfffa 100644
    --- a/drivers/iommu/intel-iommu.c
    +++ b/drivers/iommu/intel-iommu.c
    @@ -2485,7 +2485,8 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu,
    if (dev && dev_is_pci(dev)) {
    struct pci_dev *pdev = to_pci_dev(info->dev);

    - if (!pci_ats_disabled() &&
    + if (!pdev->untrusted &&
    + !pci_ats_disabled() &&
    ecap_dev_iotlb_support(iommu->ecap) &&
    pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ATS) &&
    dmar_find_matched_atsr_unit(pdev))
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-03-27 20:33    [W:2.768 / U:1.532 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site