From: Lu Baolu <baolu.lu@linux.intel.com> To: David Woodhouse <dwmw2@infradead.org>, Joerg Roedel <joro@8bytes.org>, Bjorn Helgaas <bhelgaas@google.com>, Christoph Hellwig <hch@lst.de> Cc: ashok.raj@intel.com, jacob.jun.pan@intel.com, alan.cox@intel.com, kevin.tian@intel.com, mika.westerberg@linux.intel.com, Ingo Molnar <mingo@redhat.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, pengfei.xu@intel.com, Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>, Marek Szyprowski <m.szyprowski@samsung.com>, Robin Murphy <robin.murphy@arm.com>, Jonathan Corbet <corbet@lwn.net>, Boris Ostrovsky <boris.ostrovsky@oracle.com>, Juergen Gross <jgross@suse.com>, Stefano Stabellini <sstabellini@kernel.org>, Steven Rostedt <rostedt@goodmis.org>, iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Lu Baolu <baolu.lu@linux.intel.com> Subject: [PATCH v6 4/8] swiotlb: Zero out bounce buffer for untrusted device Date: Tue, 30 Jul 2019 12:52:25 +0800 [thread overview] Message-ID: <20190730045229.3826-5-baolu.lu@linux.intel.com> (raw) In-Reply-To: <20190730045229.3826-1-baolu.lu@linux.intel.com> This is necessary to avoid exposing valid kernel data to any malicious device. Suggested-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> --- kernel/dma/swiotlb.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index 89066efa3840..04bea5a87462 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -35,6 +35,7 @@ #include <linux/scatterlist.h> #include <linux/mem_encrypt.h> #include <linux/set_memory.h> +#include <linux/pci.h> #ifdef CONFIG_DEBUG_FS #include <linux/debugfs.h> #endif @@ -458,6 +459,8 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev, unsigned long offset_slots; unsigned long max_slots; unsigned long tmp_io_tlb_used; + void *zero_addr; + size_t zero_size; if (no_iotlb_memory) panic("Can not allocate SWIOTLB buffer earlier and can't now provide you with the DMA bounce buffer"); @@ -565,9 +568,20 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev, */ for (i = 0; i < nslots; i++) io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT); + + zero_addr = phys_to_virt(tlb_addr); + zero_size = alloc_size; + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && - (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) + (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) { swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); + zero_addr += mapping_size; + zero_size -= mapping_size; + } + + /* Zero out the bounce buffer if the consumer is untrusted. */ + if (dev_is_untrusted(hwdev) && zero_size) + memset(zero_addr, 0, zero_size); return tlb_addr; } -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Lu Baolu <baolu.lu@linux.intel.com> To: David Woodhouse <dwmw2@infradead.org>, Joerg Roedel <joro@8bytes.org>, Bjorn Helgaas <bhelgaas@google.com>, Christoph Hellwig <hch@lst.de> Cc: Juergen Gross <jgross@suse.com>, kevin.tian@intel.com, Stefano Stabellini <sstabellini@kernel.org>, ashok.raj@intel.com, Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>, alan.cox@intel.com, Jonathan Corbet <corbet@lwn.net>, Robin Murphy <robin.murphy@arm.com>, Steven Rostedt <rostedt@goodmis.org>, linux-kernel@vger.kernel.org, iommu@lists.linux-foundation.org, pengfei.xu@intel.com, Ingo Molnar <mingo@redhat.com>, jacob.jun.pan@intel.com, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Boris Ostrovsky <boris.ostrovsky@oracle.com>, mika.westerberg@linux.intel.com Subject: [PATCH v6 4/8] swiotlb: Zero out bounce buffer for untrusted device Date: Tue, 30 Jul 2019 12:52:25 +0800 [thread overview] Message-ID: <20190730045229.3826-5-baolu.lu@linux.intel.com> (raw) In-Reply-To: <20190730045229.3826-1-baolu.lu@linux.intel.com> This is necessary to avoid exposing valid kernel data to any malicious device. Suggested-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> --- kernel/dma/swiotlb.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index 89066efa3840..04bea5a87462 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -35,6 +35,7 @@ #include <linux/scatterlist.h> #include <linux/mem_encrypt.h> #include <linux/set_memory.h> +#include <linux/pci.h> #ifdef CONFIG_DEBUG_FS #include <linux/debugfs.h> #endif @@ -458,6 +459,8 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev, unsigned long offset_slots; unsigned long max_slots; unsigned long tmp_io_tlb_used; + void *zero_addr; + size_t zero_size; if (no_iotlb_memory) panic("Can not allocate SWIOTLB buffer earlier and can't now provide you with the DMA bounce buffer"); @@ -565,9 +568,20 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev, */ for (i = 0; i < nslots; i++) io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT); + + zero_addr = phys_to_virt(tlb_addr); + zero_size = alloc_size; + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && - (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) + (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) { swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); + zero_addr += mapping_size; + zero_size -= mapping_size; + } + + /* Zero out the bounce buffer if the consumer is untrusted. */ + if (dev_is_untrusted(hwdev) && zero_size) + memset(zero_addr, 0, zero_size); return tlb_addr; } -- 2.17.1 _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
next prev parent reply other threads:[~2019-07-30 4:53 UTC|newest] Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-07-30 4:52 [PATCH v6 0/8] iommu: Bounce page for untrusted devices Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-07-30 4:52 ` [PATCH v6 1/8] iommu/vt-d: Don't switch off swiotlb if use direct dma Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-07-30 4:52 ` [PATCH v6 2/8] PCI: Add dev_is_untrusted helper Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-07-30 4:52 ` [PATCH v6 3/8] swiotlb: Split size parameter to map/unmap APIs Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-07-30 4:52 ` Lu Baolu [this message] 2019-07-30 4:52 ` [PATCH v6 4/8] swiotlb: Zero out bounce buffer for untrusted device Lu Baolu 2019-07-30 4:52 ` [PATCH v6 5/8] iommu: Add bounce page APIs Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-08-14 8:38 ` Joerg Roedel 2019-08-14 8:38 ` Joerg Roedel 2019-08-15 6:15 ` Lu Baolu 2019-08-15 6:15 ` Lu Baolu 2019-08-15 15:48 ` Joerg Roedel 2019-08-15 15:48 ` Joerg Roedel 2019-08-16 2:45 ` Lu Baolu 2019-08-16 2:45 ` Lu Baolu 2019-08-16 4:46 ` Christoph Hellwig 2019-08-16 4:46 ` Christoph Hellwig 2019-08-18 3:07 ` Lu Baolu 2019-08-18 3:07 ` Lu Baolu 2019-07-30 4:52 ` [PATCH v6 6/8] iommu/vt-d: Check whether device requires bounce buffer Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-07-30 4:52 ` [PATCH v6 7/8] iommu/vt-d: Add trace events for device dma map/unmap Lu Baolu 2019-07-30 4:52 ` Lu Baolu 2019-07-30 4:52 ` [PATCH v6 8/8] iommu/vt-d: Use bounce buffer for untrusted devices Lu Baolu 2019-07-30 4:52 ` Lu Baolu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190730045229.3826-5-baolu.lu@linux.intel.com \ --to=baolu.lu@linux.intel.com \ --cc=alan.cox@intel.com \ --cc=ashok.raj@intel.com \ --cc=bhelgaas@google.com \ --cc=boris.ostrovsky@oracle.com \ --cc=corbet@lwn.net \ --cc=dwmw2@infradead.org \ --cc=gregkh@linuxfoundation.org \ --cc=hch@lst.de \ --cc=iommu@lists.linux-foundation.org \ --cc=jacob.jun.pan@intel.com \ --cc=jgross@suse.com \ --cc=joro@8bytes.org \ --cc=kevin.tian@intel.com \ --cc=konrad.wilk@oracle.com \ --cc=linux-kernel@vger.kernel.org \ --cc=m.szyprowski@samsung.com \ --cc=mika.westerberg@linux.intel.com \ --cc=mingo@redhat.com \ --cc=pengfei.xu@intel.com \ --cc=robin.murphy@arm.com \ --cc=rostedt@goodmis.org \ --cc=sstabellini@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.