From: Rajat Jain via iommu <iommu@lists.linux-foundation.org>
To: David Woodhouse <dwmw2@infradead.org>,
Lu Baolu <baolu.lu@linux.intel.com>,
Joerg Roedel <joro@8bytes.org>,
Bjorn Helgaas <bhelgaas@google.com>,
"Rafael J. Wysocki" <rjw@rjwysocki.net>,
Len Brown <lenb@kernel.org>,
iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org,
linux-pci@vger.kernel.org, linux-acpi@vger.kernel.org,
Raj Ashok <ashok.raj@intel.com>,
lalithambika.krishnakumar@intel.com,
Mika Westerberg <mika.westerberg@linux.intel.com>,
Jean-Philippe Brucker <jean-philippe@linaro.org>,
Prashant Malani <pmalani@google.com>,
Benson Leung <bleung@google.com>, Todd Broch <tbroch@google.com>,
Alex Levin <levinale@google.com>,
Mattias Nissler <mnissler@google.com>,
Rajat Jain <rajatxjain@gmail.com>,
Bernie Keany <bernie.keany@intel.com>,
Aaron Durbin <adurbin@google.com>,
Diego Rivas <diegorivas@google.com>,
Duncan Laurie <dlaurie@google.com>,
Furquan Shaikh <furquan@google.com>,
Jesse Barnes <jsbarnes@google.com>,
Christian Kellner <christian@kellner.me>,
Alex Williamson <alex.williamson@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
oohall@gmail.com
Cc: Rajat Jain <rajatja@google.com>
Subject: [PATCH 2/2] pci: Add parameter to disable attaching untrusted devices
Date: Thu, 25 Jun 2020 17:27:10 -0700 [thread overview]
Message-ID: <20200626002710.110200-2-rajatja@google.com> (raw)
In-Reply-To: <20200626002710.110200-1-rajatja@google.com>
Introduce a PCI parameter that disables the automatic attachment of
untrusted devices to their drivers.
Signed-off-by: Rajat Jain <rajatja@google.com>
---
Context:
I set out to implement the approach outlined in
https://lkml.org/lkml/2020/6/9/1331
https://lkml.org/lkml/2020/6/15/1453
But to my surprise, I found that the new hotplugged PCI devices
were getting automatically attached to drivers even though
/sys/bus/pci/drivers_autoprobe was set to 0.
I realized that the device core's "drivers_autoprobe":
* only disables the *initial* probe of the device (i.e. from
device_add()). If a subsystem calls device_attach() explicitly
for its devices like PCI subsystem does, the drivers_autoprobe
setting does not matter. The core will attach device to the driver.
This looks like correct semantic behavior to me because PCI is
explicitly calling device_attach(), which is a way to explicitly
ask the core to find and attach a driver for a device.
* "drivers_autoprobe" cannot be controlled at boot time (to restrict
any drivers before userspace comes up).
The options I considered were:
1) Change device_attach() so that it takes into consideration the
drivers_autoprobe property. Not sure if this is semantically correct
thing to do though. If I do this, then the only way a driver can
be attached to the drivers would be via userspace
(/sys/bus/pci/drivers/bind) (Good for our use case though!).
2) Make the drivers_autoprobe property available to PCI to use
(currently it is private to device core). The PCI could use this
to determine whether or not to call device_attach(). This still
leaves the other problem (of not being able to set
drivers_autoprobe via command line open).
3) I found the pci_dev->match_driver, which seemed similar to what I
am trying to do, but can't be controlled from userspace. I considered
populating that field based on drivers_autoprobe (still need (2)).
But the problem is that there is the AMD IOMMU driver which is setting
this independently, so setting the match_driver based on
drivers_autoprobe may not be a good idea. May be we can populate it
for untrusted devicesi, based on the parameter that I'm introducing?
4) This patch was my option 4 that helps fix both the problems for me.
drivers/pci/bus.c | 11 ++++++++---
drivers/pci/pci.c | 9 +++++++++
drivers/pci/pci.h | 1 +
3 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 3cef835b375fd..336aeeb4c4ebf 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -321,9 +321,14 @@ void pci_bus_add_device(struct pci_dev *dev)
pci_bridge_d3_update(dev);
dev->match_driver = true;
- retval = device_attach(&dev->dev);
- if (retval < 0 && retval != -EPROBE_DEFER)
- pci_warn(dev, "device attach failed (%d)\n", retval);
+
+ if (dev->untrusted && pci_dont_attach_untrusted_devs) {
+ pci_info(dev, "not attaching untrusted device\n");
+ } else {
+ retval = device_attach(&dev->dev);
+ if (retval < 0 && retval != -EPROBE_DEFER)
+ pci_warn(dev, "device attach failed (%d)\n", retval);
+ }
pci_dev_assign_added(dev, true);
}
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index ce096272f52b1..dec1f9ef27d71 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -127,6 +127,13 @@ static bool pcie_ats_disabled;
/* If set, the PCI config space of each device is printed during boot. */
bool pci_early_dump;
+/*
+ * If set, the devices with "untrusted" flag shall not be attached automatically
+ * Userspace will need to attach them manually:
+ * echo <pci device> > /sys/bus/pci/drivers/<driver>/bind
+ */
+bool pci_dont_attach_untrusted_devs;
+
bool pci_ats_disabled(void)
{
return pcie_ats_disabled;
@@ -6522,6 +6529,8 @@ static int __init pci_setup(char *str)
pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
} else if (!strncmp(str, "disable_acs_redir=", 18)) {
disable_acs_redir_param = str + 18;
+ } else if (!strcmp(str, "dont_attach_untrusted_devs")) {
+ pci_dont_attach_untrusted_devs = true;
} else {
pr_err("PCI: Unknown option `%s'\n", str);
}
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 6d3f758671064..30ffad047d926 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -13,6 +13,7 @@
extern const unsigned char pcie_link_speed[];
extern bool pci_early_dump;
+extern bool pci_dont_attach_untrusted_devs;
bool pcie_cap_has_lnkctl(const struct pci_dev *dev);
bool pcie_cap_has_rtctl(const struct pci_dev *dev);
--
2.27.0.212.ge8ba1cc988-goog
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
next prev parent reply other threads:[~2020-06-26 0:49 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-26 0:27 [PATCH 1/2] pci: Add pci device even if the driver failed to attach Rajat Jain via iommu
2020-06-26 0:27 ` Rajat Jain via iommu [this message]
2020-06-26 4:46 ` [PATCH 2/2] pci: Add parameter to disable attaching untrusted devices Greg Kroah-Hartman
2020-06-26 7:52 ` Oliver O'Halloran
2020-06-26 14:17 ` Greg Kroah-Hartman
2020-06-26 18:53 ` Rajat Jain via iommu
2020-06-27 5:02 ` Greg Kroah-Hartman
2020-06-26 14:14 ` [PATCH 1/2] pci: Add pci device even if the driver failed to attach Greg Kroah-Hartman
2020-06-26 15:39 ` Bjorn Helgaas
2020-06-26 19:01 ` Rajat Jain via iommu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200626002710.110200-2-rajatja@google.com \
--to=iommu@lists.linux-foundation.org \
--cc=adurbin@google.com \
--cc=alex.williamson@redhat.com \
--cc=ashok.raj@intel.com \
--cc=baolu.lu@linux.intel.com \
--cc=bernie.keany@intel.com \
--cc=bhelgaas@google.com \
--cc=bleung@google.com \
--cc=christian@kellner.me \
--cc=diegorivas@google.com \
--cc=dlaurie@google.com \
--cc=dwmw2@infradead.org \
--cc=furquan@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jean-philippe@linaro.org \
--cc=joro@8bytes.org \
--cc=jsbarnes@google.com \
--cc=lalithambika.krishnakumar@intel.com \
--cc=lenb@kernel.org \
--cc=levinale@google.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=mika.westerberg@linux.intel.com \
--cc=mnissler@google.com \
--cc=oohall@gmail.com \
--cc=pmalani@google.com \
--cc=rajatja@google.com \
--cc=rajatxjain@gmail.com \
--cc=rjw@rjwysocki.net \
--cc=tbroch@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).