Linux-PCI Archive on lore.kernel.org
 help / color / Atom feed
From: Bjorn Helgaas <helgaas@kernel.org>
To: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Cc: alex.williamson@redhat.com, herbert@gondor.apana.org.au,
	cohuck@redhat.com, nhorman@redhat.com, vdronov@redhat.com,
	bhelgaas@google.com, mark.a.chambers@intel.com,
	gordon.mcfadden@intel.com, ahsan.atta@intel.com,
	qat-linux@intel.com, kvm@vger.kernel.org,
	linux-crypto@vger.kernel.org, linux-pci@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/5] vfio/pci: add device blocklist
Date: Wed, 1 Jul 2020 16:24:37 -0500
Message-ID: <20200701212437.GA3660694@bjorn-Precision-5520> (raw)
In-Reply-To: <20200701110302.75199-3-giovanni.cabiddu@intel.com>

On Wed, Jul 01, 2020 at 12:02:59PM +0100, Giovanni Cabiddu wrote:
> Add blocklist of devices that by default are not probed by vfio-pci.

> Devices in this list may be susceptible to untrusted application, even
> if the IOMMU is enabled. 

I can't quite parse this sentence.  I think it means something about
these devices being able to bypass an IOMMU or otherwise cause
problems via DMA.  It would be nice to know exactly what problem this
is avoiding.

I assume *all* applications are untrusted, right?  The wording above
makes it sound like there may be a class of trusted applications in
addition to the untrusted ones.  But I don't see anything like that in
the patch.

> To be accessed via vfio-pci, the user has to
> explicitly disable the blocklist.
> 
> The blocklist can be disabled via the module parameter disable_blocklist.
> 
> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> ---
>  drivers/vfio/pci/vfio_pci.c | 33 +++++++++++++++++++++++++++++++++
>  1 file changed, 33 insertions(+)
> 
> diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> index 7c0779018b1b..ea5904ca6cbf 100644
> --- a/drivers/vfio/pci/vfio_pci.c
> +++ b/drivers/vfio/pci/vfio_pci.c
> @@ -60,6 +60,10 @@ module_param(enable_sriov, bool, 0644);
>  MODULE_PARM_DESC(enable_sriov, "Enable support for SR-IOV configuration.  Enabling SR-IOV on a PF typically requires support of the userspace PF driver, enabling VFs without such support may result in non-functional VFs or PF.");
>  #endif
>  
> +static bool disable_blocklist;
> +module_param(disable_blocklist, bool, 0444);
> +MODULE_PARM_DESC(disable_blocklist, "Disable device blocklist. If set, i.e. blocklist disabled, then blocklisted devices are allowed to be probed by vfio-pci.");
> +
>  static inline bool vfio_vga_disabled(void)
>  {
>  #ifdef CONFIG_VFIO_PCI_VGA
> @@ -69,6 +73,29 @@ static inline bool vfio_vga_disabled(void)
>  #endif
>  }
>  
> +static bool vfio_pci_dev_in_blocklist(struct pci_dev *pdev)
> +{
> +	return false;
> +}
> +
> +static bool vfio_pci_is_blocklisted(struct pci_dev *pdev)
> +{
> +	if (!vfio_pci_dev_in_blocklist(pdev))
> +		return false;
> +
> +	if (disable_blocklist) {
> +		pci_warn(pdev,
> +			 "device blocklist disabled - allowing device %04x:%04x.\n",
> +			 pdev->vendor, pdev->device);
> +		return false;
> +	}
> +
> +	pci_warn(pdev, "%04x:%04x is blocklisted - probe will fail.\n",
> +		 pdev->vendor, pdev->device);
> +
> +	return true;
> +}
> +
>  /*
>   * Our VGA arbiter participation is limited since we don't know anything
>   * about the device itself.  However, if the device is the only VGA device
> @@ -1847,6 +1874,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	struct iommu_group *group;
>  	int ret;
>  
> +	if (vfio_pci_is_blocklisted(pdev))
> +		return -EINVAL;
> +
>  	if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
>  		return -EINVAL;
>  
> @@ -2336,6 +2366,9 @@ static int __init vfio_pci_init(void)
>  
>  	vfio_pci_fill_ids();
>  
> +	if (disable_blocklist)
> +		pr_warn("device blocklist disabled.\n");
> +
>  	return 0;
>  
>  out_driver:
> -- 
> 2.26.2
> 

  reply index

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-01 11:02 [PATCH 0/5] vfio/pci: add blocklist and disable qat Giovanni Cabiddu
2020-07-01 11:02 ` [PATCH 1/5] PCI: add Intel QuickAssist device IDs Giovanni Cabiddu
2020-07-01 21:16   ` Bjorn Helgaas
2020-07-01 11:02 ` [PATCH 2/5] vfio/pci: add device blocklist Giovanni Cabiddu
2020-07-01 21:24   ` Bjorn Helgaas [this message]
2020-07-01 11:03 ` [PATCH 3/5] vfio/pci: add qat devices to blocklist Giovanni Cabiddu
2020-07-01 21:28   ` Bjorn Helgaas
2020-07-10 15:08     ` Giovanni Cabiddu
2020-07-10 15:37       ` Bjorn Helgaas
2020-07-10 15:44         ` Bjorn Helgaas
2020-07-10 16:10           ` Alex Williamson
2020-07-10 16:22             ` Giovanni Cabiddu
2020-07-01 11:03 ` [PATCH 4/5] crypto: qat - replace device ids defines Giovanni Cabiddu
2020-07-01 11:03 ` [PATCH 5/5] crypto: qat - use PCI_VDEVICE Giovanni Cabiddu
2020-07-01 12:42 ` [PATCH 0/5] vfio/pci: add blocklist and disable qat Christoph Hellwig
2020-07-10 15:48   ` Christoph Hellwig
2020-07-10 16:13     ` Giovanni Cabiddu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200701212437.GA3660694@bjorn-Precision-5520 \
    --to=helgaas@kernel.org \
    --cc=ahsan.atta@intel.com \
    --cc=alex.williamson@redhat.com \
    --cc=bhelgaas@google.com \
    --cc=cohuck@redhat.com \
    --cc=giovanni.cabiddu@intel.com \
    --cc=gordon.mcfadden@intel.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=kvm@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pci@vger.kernel.org \
    --cc=mark.a.chambers@intel.com \
    --cc=nhorman@redhat.com \
    --cc=qat-linux@intel.com \
    --cc=vdronov@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-PCI Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-pci/0 linux-pci/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-pci linux-pci/ https://lore.kernel.org/linux-pci \
		linux-pci@vger.kernel.org
	public-inbox-index linux-pci

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-pci


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git