From: Bjorn Helgaas <helgaas@kernel.org> To: Rajat Jain <rajatja@google.com> Cc: David Woodhouse <dwmw2@infradead.org>, Lu Baolu <baolu.lu@linux.intel.com>, Joerg Roedel <joro@8bytes.org>, Bjorn Helgaas <bhelgaas@google.com>, "Rafael J. Wysocki" <rjw@rjwysocki.net>, Len Brown <lenb@kernel.org>, iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, linux-acpi@vger.kernel.org, Raj Ashok <ashok.raj@intel.com>, lalithambika.krishnakumar@intel.com, Mika Westerberg <mika.westerberg@linux.intel.com>, Jean-Philippe Brucker <jean-philippe@linaro.org>, Prashant Malani <pmalani@google.com>, Benson Leung <bleung@google.com>, Todd Broch <tbroch@google.com>, Alex Levin <levinale@google.com>, Mattias Nissler <mnissler@google.com>, Rajat Jain <rajatxjain@gmail.com>, Bernie Keany <bernie.keany@intel.com>, Aaron Durbin <adurbin@google.com>, Diego Rivas <diegorivas@google.com>, Duncan Laurie <dlaurie@google.com>, Furquan Shaikh <furquan@google.com>, Jesse Barnes <jsbarnes@google.com>, Christian Kellner <christian@kellner.me>, Alex Williamson <alex.williamson@redhat.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, oohall@gmail.com, Saravana Kannan <saravanak@google.com>, Suzuki K Poulose <suzuki.poulose@arm.com>, Arnd Bergmann <arnd@arndb.de>, Heikki Krogerus <heikki.krogerus@linux.intel.com> Subject: Re: [PATCH v2 3/7] PCI/ACS: Enable PCI_ACS_TB for untrusted/external-facing devices Date: Mon, 6 Jul 2020 12:07:36 -0500 Message-ID: <20200706170736.GA125844@bjorn-Precision-5520> (raw) In-Reply-To: <20200630044943.3425049-4-rajatja@google.com> On Mon, Jun 29, 2020 at 09:49:39PM -0700, Rajat Jain wrote: > When enabling ACS, enable translation blocking for external facing ports > and untrusted devices. > > Signed-off-by: Rajat Jain <rajatja@google.com> > --- > v2: Commit log change > > drivers/pci/pci.c | 4 ++++ > drivers/pci/quirks.c | 11 +++++++++++ > 2 files changed, 15 insertions(+) > > diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c > index d2ff987585855..79853b52658a2 100644 > --- a/drivers/pci/pci.c > +++ b/drivers/pci/pci.c > @@ -3330,6 +3330,10 @@ static void pci_std_enable_acs(struct pci_dev *dev) > /* Upstream Forwarding */ > ctrl |= (cap & PCI_ACS_UF); > > + if (dev->external_facing || dev->untrusted) > + /* Translation Blocking */ > + ctrl |= (cap & PCI_ACS_TB); > + > pci_write_config_word(dev, pos + PCI_ACS_CTRL, ctrl); > } > > diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c > index b341628e47527..6294adeac4049 100644 > --- a/drivers/pci/quirks.c > +++ b/drivers/pci/quirks.c > @@ -4934,6 +4934,13 @@ static void pci_quirk_enable_intel_rp_mpc_acs(struct pci_dev *dev) > } > } > > +/* > + * Currently this quirk does the equivalent of > + * PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_SV Nit: Reorder these as in c8de8ed2dcaa ("PCI: Make ACS quirk implementations more uniform") so they match other similar lists in the code. But more to the point: we have a bunch of other quirks for devices that do not have an ACS capability but *do* provide some ACS-like features. Most of them support PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF because that's what we usually want. But I bet some of them also actually provide the equivalent of PCI_ACS_TB. REQ_ACS_FLAGS doesn't include PCI_ACS_TB. Is there anything we need to do on the pci_acs_enabled() side to check for PCI_ACS_TB, and consequently, to update any of the quirks for devices that provide it? > + * > + * Currently missing, it also needs to do equivalent of PCI_ACS_TB, > + * if dev->external_facing || dev->untrusted > + */ > static int pci_quirk_enable_intel_pch_acs(struct pci_dev *dev) > { > if (!pci_quirk_intel_pch_acs_match(dev)) > @@ -4973,6 +4980,10 @@ static int pci_quirk_enable_intel_spt_pch_acs(struct pci_dev *dev) > ctrl |= (cap & PCI_ACS_CR); > ctrl |= (cap & PCI_ACS_UF); > > + if (dev->external_facing || dev->untrusted) > + /* Translation Blocking */ > + ctrl |= (cap & PCI_ACS_TB); > + > pci_write_config_dword(dev, pos + INTEL_SPT_ACS_CTRL, ctrl); > > pci_info(dev, "Intel SPT PCH root port ACS workaround enabled\n"); > -- > 2.27.0.212.ge8ba1cc988-goog >
next prev parent reply index Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-30 4:49 [PATCH v2 0/7] Tighten PCI security, expose dev location in sysfs Rajat Jain 2020-06-30 4:49 ` [PATCH v2 1/7] PCI: Keep the ACS capability offset in device Rajat Jain 2020-07-06 15:58 ` Bjorn Helgaas 2020-07-06 22:16 ` Rajat Jain 2020-07-06 23:18 ` Bjorn Helgaas 2020-06-30 4:49 ` [PATCH v2 2/7] PCI: Set "untrusted" flag for truly external devices only Rajat Jain 2020-06-30 7:38 ` Lu Baolu 2020-06-30 7:55 ` Greg Kroah-Hartman 2020-07-06 16:41 ` Bjorn Helgaas 2020-07-06 18:48 ` Greg Kroah-Hartman 2020-07-06 16:38 ` Bjorn Helgaas 2020-07-06 22:31 ` Rajat Jain 2020-07-06 23:30 ` Bjorn Helgaas 2020-07-06 23:40 ` Rajat Jain 2020-06-30 4:49 ` [PATCH v2 3/7] PCI/ACS: Enable PCI_ACS_TB for untrusted/external-facing devices Rajat Jain 2020-07-06 16:45 ` Bjorn Helgaas 2020-07-06 23:12 ` Rajat Jain 2020-07-06 17:07 ` Bjorn Helgaas [this message] 2020-07-06 23:19 ` Rajat Jain 2020-06-30 4:49 ` [PATCH v2 4/7] PCI: Add device even if driver attach failed Rajat Jain 2020-06-30 8:02 ` Greg Kroah-Hartman 2020-07-06 23:35 ` Rajat Jain 2020-06-30 4:49 ` [PATCH v2 5/7] driver core: Add device location to "struct device" and expose it in sysfs Rajat Jain 2020-06-30 8:01 ` Greg Kroah-Hartman 2020-06-30 10:49 ` Heikki Krogerus 2020-06-30 12:52 ` Greg Kroah-Hartman 2020-06-30 13:00 ` Rafael J. Wysocki 2020-06-30 15:38 ` Greg Kroah-Hartman 2020-06-30 16:08 ` Rafael J. Wysocki 2020-06-30 17:00 ` Greg Kroah-Hartman 2020-07-01 18:06 ` Rajat Jain 2020-07-02 5:23 ` Oliver O'Halloran 2020-07-02 7:32 ` Greg Kroah-Hartman 2020-07-02 8:40 ` Oliver O'Halloran 2020-07-02 8:52 ` Greg Kroah-Hartman 2020-07-02 8:53 ` Greg Kroah-Hartman 2020-07-07 6:03 ` Rajat Jain 2020-06-30 17:43 ` Saravana Kannan 2020-06-30 4:49 ` [PATCH v2 6/7] PCI: Move pci_dev->untrusted logic to use device location instead Rajat Jain 2020-06-30 7:39 ` Lu Baolu 2020-06-30 4:49 ` [PATCH v2 7/7] PCI: Add parameter to disable attaching external devices Rajat Jain 2020-07-04 11:44 ` [PATCH v2 0/7] Tighten PCI security, expose dev location in sysfs Pavel Machek 2020-07-06 22:18 ` Rajat Jain
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200706170736.GA125844@bjorn-Precision-5520 \ --to=helgaas@kernel.org \ --cc=adurbin@google.com \ --cc=alex.williamson@redhat.com \ --cc=arnd@arndb.de \ --cc=ashok.raj@intel.com \ --cc=baolu.lu@linux.intel.com \ --cc=bernie.keany@intel.com \ --cc=bhelgaas@google.com \ --cc=bleung@google.com \ --cc=christian@kellner.me \ --cc=diegorivas@google.com \ --cc=dlaurie@google.com \ --cc=dwmw2@infradead.org \ --cc=furquan@google.com \ --cc=gregkh@linuxfoundation.org \ --cc=heikki.krogerus@linux.intel.com \ --cc=iommu@lists.linux-foundation.org \ --cc=jean-philippe@linaro.org \ --cc=joro@8bytes.org \ --cc=jsbarnes@google.com \ --cc=lalithambika.krishnakumar@intel.com \ --cc=lenb@kernel.org \ --cc=levinale@google.com \ --cc=linux-acpi@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-pci@vger.kernel.org \ --cc=mika.westerberg@linux.intel.com \ --cc=mnissler@google.com \ --cc=oohall@gmail.com \ --cc=pmalani@google.com \ --cc=rajatja@google.com \ --cc=rajatxjain@gmail.com \ --cc=rjw@rjwysocki.net \ --cc=saravanak@google.com \ --cc=suzuki.poulose@arm.com \ --cc=tbroch@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Linux-PCI Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/linux-pci/0 linux-pci/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 linux-pci linux-pci/ https://lore.kernel.org/linux-pci \ linux-pci@vger.kernel.org public-inbox-index linux-pci Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-pci AGPL code for this site: git clone https://public-inbox.org/public-inbox.git