From: Lu Baolu <baolu.lu@linux.intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Joerg Roedel <joro@8bytes.org>,
Alex Williamson <alex.williamson@redhat.com>,
Bjorn Helgaas <bhelgaas@google.com>,
Jason Gunthorpe <jgg@nvidia.com>,
Kevin Tian <kevin.tian@intel.com>,
Ashok Raj <ashok.raj@intel.com>
Cc: Will Deacon <will@kernel.org>,
rafael@kernel.org, Diana Craciun <diana.craciun@oss.nxp.com>,
Cornelia Huck <cohuck@redhat.com>,
Eric Auger <eric.auger@redhat.com>, Liu Yi L <yi.l.liu@intel.com>,
Jacob jun Pan <jacob.jun.pan@intel.com>,
Chaitanya Kulkarni <kch@nvidia.com>,
iommu@lists.linux-foundation.org, linux-pci@vger.kernel.org,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Lu Baolu <baolu.lu@linux.intel.com>
Subject: [PATCH 00/11] Fix BUG_ON in vfio_iommu_group_notifier()
Date: Mon, 15 Nov 2021 10:05:41 +0800 [thread overview]
Message-ID: <20211115020552.2378167-1-baolu.lu@linux.intel.com> (raw)
Hi folks,
The iommu group is the minimal isolation boundary for DMA. Devices in
a group can access each other's MMIO registers via peer to peer DMA
and also need share the same I/O address space.
Once the I/O address space is assigned to user control it is no longer
available to the dma_map* API, which effectively makes the DMA API
non-working.
Second, userspace can use DMA initiated by a device that it controls
to access the MMIO spaces of other devices in the group. This allows
userspace to indirectly attack any kernel owned device and it's driver.
Therefore groups must either be entirely under kernel control or
userspace control, never a mixture. Unfortunately some systems have
problems with the granularity of groups and there are a couple of
important exceptions:
- pci_stub allows the admin to block driver binding on a device and
make it permanently shared with userspace. Since PCI stub does not
do DMA it is safe, however the admin must understand that using
pci_stub allows userspace to attack whatever device it was bound
it.
- PCI bridges are sometimes included in groups. Typically PCI bridges
do not use DMA, and generally do not have MMIO regions.
Generally any device that does not have any MMIO registers is a
possible candidate for an exception.
Currently vfio adopts a workaround to detect violations of the above
restrictions by monitoring the driver core BOUND event, and hardwiring
the above exceptions. Since there is no way for vfio to reject driver
binding at this point, BUG_ON() is triggered if a violation is
captured (kernel driver BOUND event on a group which already has some
devices assigned to userspace). Aside from the bad user experience
this opens a way for root userspace to crash the kernel, even in high
integrity configurations, by manipulating the module binding and
triggering the BUG_ON.
This series solves this problem by making the user/kernel ownership a
core concept at the IOMMU layer. The driver core enforces kernel
ownership while drivers are bound and violations now result in a error
codes during probe, not BUG_ON failures.
Patch partitions:
[PATCH 1-2]: Detect DMA ownership conflicts during driver binding;
[PATCH 3-6]: Add security context management for assigned devices;
[PATCH 7-11]: Various cleanups.
Ideas contributed by:
Jason Gunthorpe <jgg@nvidia.com>
Kevin Tian <kevin.tian@intel.com>
Ashok Raj <ashok.raj@intel.com>
Lu Baolu <baolu.lu@linux.intel.com>
Review contributors:
Jason Gunthorpe <jgg@nvidia.com>
Kevin Tian <kevin.tian@intel.com>
Ashok Raj <ashok.raj@intel.com>
Liu Yi L <yi.l.liu@intel.com>
Jacob jun Pan <jacob.jun.pan@intel.com>
Chaitanya Kulkarni <kch@nvidia.com>
This also is part one of three initial series for IOMMUFD:
* Move IOMMU Group security into the iommu layer
- Generic IOMMUFD implementation
- VFIO ability to consume IOMMUFD
This is based on v5.16-rc1 and available on github:
https://github.com/LuBaolu/intel-iommu/commits/iommu-dma-ownership-v1
Best regards,
baolu
Jason Gunthorpe (1):
vfio: Delete the unbound_list
Lu Baolu (10):
iommu: Add device dma ownership set/release interfaces
driver core: Set DMA ownership during driver bind/unbind
PCI: pci_stub: Suppress kernel DMA ownership auto-claiming
PCI: portdrv: Suppress kernel DMA ownership auto-claiming
iommu: Add security context management for assigned devices
iommu: Expose group variants of dma ownership interfaces
vfio: Use DMA_OWNER_USER to declaim passthrough devices
vfio: Remove use of vfio_group_viable()
vfio: Remove iommu group notifier
iommu: Remove iommu group changes notifier
include/linux/device/driver.h | 7 +-
include/linux/iommu.h | 75 ++++---
drivers/base/dd.c | 12 ++
drivers/iommu/iommu.c | 274 ++++++++++++++++++--------
drivers/pci/pci-stub.c | 3 +
drivers/pci/pcie/portdrv_pci.c | 2 +
drivers/vfio/fsl-mc/vfio_fsl_mc.c | 1 +
drivers/vfio/pci/vfio_pci.c | 3 +
drivers/vfio/platform/vfio_amba.c | 1 +
drivers/vfio/platform/vfio_platform.c | 1 +
drivers/vfio/vfio.c | 247 ++---------------------
11 files changed, 294 insertions(+), 332 deletions(-)
--
2.25.1
next reply other threads:[~2021-11-15 2:10 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-15 2:05 Lu Baolu [this message]
2021-11-15 2:05 ` [PATCH 01/11] iommu: Add device dma ownership set/release interfaces Lu Baolu
2021-11-15 13:14 ` Christoph Hellwig
2021-11-16 1:57 ` Lu Baolu
2021-11-16 13:46 ` Jason Gunthorpe
2021-11-17 5:22 ` Lu Baolu
2021-11-17 13:35 ` Jason Gunthorpe
2021-11-18 1:12 ` Lu Baolu
2021-11-18 14:10 ` Jason Gunthorpe
2021-11-18 2:39 ` Tian, Kevin
2021-11-18 13:33 ` Jason Gunthorpe
2021-11-19 5:44 ` Tian, Kevin
2021-11-19 11:14 ` Lu Baolu
2021-11-19 15:06 ` Jörg Rödel
2021-11-19 15:43 ` Jason Gunthorpe
2021-11-20 11:16 ` Lu Baolu
2021-11-19 12:56 ` Jason Gunthorpe
2021-11-15 20:38 ` Bjorn Helgaas
2021-11-16 1:52 ` Lu Baolu
2021-11-15 2:05 ` [PATCH 02/11] driver core: Set DMA ownership during driver bind/unbind Lu Baolu
2021-11-15 6:59 ` Greg Kroah-Hartman
2021-11-15 13:20 ` Christoph Hellwig
2021-11-15 13:38 ` Jason Gunthorpe
2021-11-15 13:19 ` Christoph Hellwig
2021-11-15 13:24 ` Jason Gunthorpe
2021-11-15 15:37 ` Robin Murphy
2021-11-15 15:56 ` Jason Gunthorpe
2021-11-15 18:15 ` Christoph Hellwig
2021-11-15 18:35 ` Robin Murphy
2021-11-15 19:39 ` Jason Gunthorpe
2021-11-15 2:05 ` [PATCH 03/11] PCI: pci_stub: Suppress kernel DMA ownership auto-claiming Lu Baolu
2021-11-15 13:21 ` Christoph Hellwig
2021-11-15 13:31 ` Jason Gunthorpe
2021-11-15 15:14 ` Robin Murphy
2021-11-15 16:17 ` Jason Gunthorpe
2021-11-15 17:54 ` Robin Murphy
2021-11-15 18:19 ` Christoph Hellwig
2021-11-15 18:44 ` Robin Murphy
2021-11-15 19:22 ` Jason Gunthorpe
2021-11-15 20:58 ` Robin Murphy
2021-11-15 21:19 ` Jason Gunthorpe
2021-11-15 20:48 ` Bjorn Helgaas
2021-11-15 22:17 ` Bjorn Helgaas
2021-11-16 6:05 ` Lu Baolu
2021-11-15 2:05 ` [PATCH 04/11] PCI: portdrv: " Lu Baolu
2021-11-15 20:44 ` Bjorn Helgaas
2021-11-16 7:24 ` Lu Baolu
2021-11-16 20:22 ` Bjorn Helgaas
2021-11-16 20:48 ` Jason Gunthorpe
2021-11-15 2:05 ` [PATCH 05/11] iommu: Add security context management for assigned devices Lu Baolu
2021-11-15 13:22 ` Christoph Hellwig
2021-11-16 7:25 ` Lu Baolu
2021-11-15 2:05 ` [PATCH 06/11] iommu: Expose group variants of dma ownership interfaces Lu Baolu
2021-11-15 13:27 ` Christoph Hellwig
2021-11-16 9:42 ` Lu Baolu
2021-11-15 2:05 ` [PATCH 07/11] vfio: Use DMA_OWNER_USER to declaim passthrough devices Lu Baolu
2021-11-15 2:05 ` [PATCH 08/11] vfio: Remove use of vfio_group_viable() Lu Baolu
2021-11-15 2:05 ` [PATCH 09/11] vfio: Delete the unbound_list Lu Baolu
2021-11-15 2:05 ` [PATCH 10/11] vfio: Remove iommu group notifier Lu Baolu
2021-11-15 2:05 ` [PATCH 11/11] iommu: Remove iommu group changes notifier Lu Baolu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211115020552.2378167-1-baolu.lu@linux.intel.com \
--to=baolu.lu@linux.intel.com \
--cc=alex.williamson@redhat.com \
--cc=ashok.raj@intel.com \
--cc=bhelgaas@google.com \
--cc=cohuck@redhat.com \
--cc=diana.craciun@oss.nxp.com \
--cc=eric.auger@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=iommu@lists.linux-foundation.org \
--cc=jacob.jun.pan@intel.com \
--cc=jgg@nvidia.com \
--cc=joro@8bytes.org \
--cc=kch@nvidia.com \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=will@kernel.org \
--cc=yi.l.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).