From: Eric Auger <eric.auger@redhat.com>
To: Lu Baolu <baolu.lu@linux.intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Joerg Roedel <joro@8bytes.org>,
Alex Williamson <alex.williamson@redhat.com>,
Bjorn Helgaas <bhelgaas@google.com>,
Jason Gunthorpe <jgg@nvidia.com>,
Christoph Hellwig <hch@infradead.org>,
Kevin Tian <kevin.tian@intel.com>,
Ashok Raj <ashok.raj@intel.com>
Cc: Will Deacon <will@kernel.org>,
Robin Murphy <robin.murphy@arm.com>,
Dan Williams <dan.j.williams@intel.com>,
rafael@kernel.org, Diana Craciun <diana.craciun@oss.nxp.com>,
Cornelia Huck <cohuck@redhat.com>, Liu Yi L <yi.l.liu@intel.com>,
Jacob jun Pan <jacob.jun.pan@intel.com>,
Chaitanya Kulkarni <kch@nvidia.com>,
Stuart Yoder <stuyoder@gmail.com>,
Laurentiu Tudor <laurentiu.tudor@nxp.com>,
Thierry Reding <thierry.reding@gmail.com>,
David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch>,
Jonathan Hunter <jonathanh@nvidia.com>,
Li Yang <leoyang.li@nxp.com>, Dmitry Osipenko <digetx@gmail.com>,
iommu@lists.linux-foundation.org, linux-pci@vger.kernel.org,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v8 00/11] Fix BUG_ON in vfio_iommu_group_notifier()
Date: Thu, 10 Mar 2022 10:46:51 +0100 [thread overview]
Message-ID: <fb386c59-2359-0230-6340-3f8c8710b0f1@redhat.com> (raw)
In-Reply-To: <20220308054421.847385-1-baolu.lu@linux.intel.com>
Hi Lu,
On 3/8/22 6:44 AM, Lu Baolu wrote:
> Hi folks,
>
> The iommu group is the minimal isolation boundary for DMA. Devices in
> a group can access each other's MMIO registers via peer to peer DMA
> and also need share the same I/O address space.
>
> Once the I/O address space is assigned to user control it is no longer
> available to the dma_map* API, which effectively makes the DMA API
> non-working.
>
> Second, userspace can use DMA initiated by a device that it controls
> to access the MMIO spaces of other devices in the group. This allows
> userspace to indirectly attack any kernel owned device and it's driver.
>
> Therefore groups must either be entirely under kernel control or
> userspace control, never a mixture. Unfortunately some systems have
> problems with the granularity of groups and there are a couple of
> important exceptions:
>
> - pci_stub allows the admin to block driver binding on a device and
> make it permanently shared with userspace. Since PCI stub does not
> do DMA it is safe, however the admin must understand that using
> pci_stub allows userspace to attack whatever device it was bound
> it.
>
> - PCI bridges are sometimes included in groups. Typically PCI bridges
> do not use DMA, and generally do not have MMIO regions.
>
> Generally any device that does not have any MMIO registers is a
> possible candidate for an exception.
>
> Currently vfio adopts a workaround to detect violations of the above
> restrictions by monitoring the driver core BOUND event, and hardwiring
> the above exceptions. Since there is no way for vfio to reject driver
> binding at this point, BUG_ON() is triggered if a violation is
> captured (kernel driver BOUND event on a group which already has some
> devices assigned to userspace). Aside from the bad user experience
> this opens a way for root userspace to crash the kernel, even in high
> integrity configurations, by manipulating the module binding and
> triggering the BUG_ON.
>
> This series solves this problem by making the user/kernel ownership a
> core concept at the IOMMU layer. The driver core enforces kernel
> ownership while drivers are bound and violations now result in a error
> codes during probe, not BUG_ON failures.
>
> Patch partitions:
> [PATCH 1-4]: Detect DMA ownership conflicts during driver binding;
> [PATCH 5-7]: Add security context management for assigned devices;
> [PATCH 8-11]: Various cleanups.
>
> This is also part one of three initial series for IOMMUFD:
> * Move IOMMU Group security into the iommu layer
> - Generic IOMMUFD implementation
> - VFIO ability to consume IOMMUFD
>
> Change log:
> v1: initial post
> - https://lore.kernel.org/linux-iommu/20211115020552.2378167-1-baolu.lu@linux.intel.com/
>
> v2:
> - https://lore.kernel.org/linux-iommu/20211128025051.355578-1-baolu.lu@linux.intel.com/
>
> - Move kernel dma ownership auto-claiming from driver core to bus
> callback. [Greg/Christoph/Robin/Jason]
> https://lore.kernel.org/linux-iommu/20211115020552.2378167-1-baolu.lu@linux.intel.com/T/#m153706912b770682cb12e3c28f57e171aa1f9d0c
>
> - Code and interface refactoring for iommu_set/release_dma_owner()
> interfaces. [Jason]
> https://lore.kernel.org/linux-iommu/20211115020552.2378167-1-baolu.lu@linux.intel.com/T/#mea70ed8e4e3665aedf32a5a0a7db095bf680325e
>
> - [NEW]Add new iommu_attach/detach_device_shared() interfaces for
> multiple devices group. [Robin/Jason]
> https://lore.kernel.org/linux-iommu/20211115020552.2378167-1-baolu.lu@linux.intel.com/T/#mea70ed8e4e3665aedf32a5a0a7db095bf680325e
>
> - [NEW]Use iommu_attach/detach_device_shared() in drm/tegra drivers.
>
> - Refactoring and description refinement.
>
> v3:
> - https://lore.kernel.org/linux-iommu/20211206015903.88687-1-baolu.lu@linux.intel.com/
>
> - Rename bus_type::dma_unconfigure to bus_type::dma_cleanup. [Greg]
> https://lore.kernel.org/linux-iommu/c3230ace-c878-39db-1663-2b752ff5384e@linux.intel.com/T/#m6711e041e47cb0cbe3964fad0a3466f5ae4b3b9b
>
> - Avoid _platform_dma_configure for platform_bus_type::dma_configure.
> [Greg]
> https://lore.kernel.org/linux-iommu/c3230ace-c878-39db-1663-2b752ff5384e@linux.intel.com/T/#m43fc46286611aa56a5c0eeaad99d539e5519f3f6
>
> - Patch "0012-iommu-Add-iommu_at-de-tach_device_shared-for-mult.patch"
> and "0018-drm-tegra-Use-the-iommu-dma_owner-mechanism.patch" have
> been tested by Dmitry Osipenko <digetx@gmail.com>.
>
> v4:
> - https://lore.kernel.org/linux-iommu/20211217063708.1740334-1-baolu.lu@linux.intel.com/
> - Remove unnecessary tegra->domain chech in the tegra patch. (Jason)
> - Remove DMA_OWNER_NONE. (Joerg)
> - Change refcount to unsigned int. (Christoph)
> - Move mutex lock into group set_dma_owner functions. (Christoph)
> - Add kernel doc for iommu_attach/detach_domain_shared(). (Christoph)
> - Move dma auto-claim into driver core. (Jason/Christoph)
>
> v5:
> - https://lore.kernel.org/linux-iommu/20220104015644.2294354-1-baolu.lu@linux.intel.com/
> - Move kernel dma ownership auto-claiming from driver core to bus
> callback. (Greg)
> - Refactor the iommu interfaces to make them more specific.
> (Jason/Robin)
> - Simplify the dma ownership implementation by removing the owner
> type. (Jason)
> - Commit message refactoring for PCI drivers. (Bjorn)
> - Move iommu_attach/detach_device() improvement patches into another
> series as there are a lot of code refactoring and cleanup staffs
> in various device drivers.
>
> v6:
> - https://lore.kernel.org/linux-iommu/20220218005521.172832-1-baolu.lu@linux.intel.com/
> - Refine comments and commit mesages.
> - Rename iommu_group_set_dma_owner() to iommu_group_claim_dma_owner().
> - Rename iommu_device_use/unuse_kernel_dma() to
> iommu_device_use/unuse_default_domain().
> - Remove unnecessary EXPORT_SYMBOL_GPL.
> - Change flag name from no_kernel_api_dma to driver_managed_dma.
> - Merge 4 "Add driver dma ownership management" patches into single
> one.
>
> v7:
> - We discussed about adding some fields in driver structure and
> intercepting it in the bus notifier for driver unbinding. We agreed
> that the driver structure should not be used out of the driver core.
> - As iommu_group_claim/release_dma_owner() are only used by the VFIO,
> there're no use cases for multiple calls for a single group.
> - Add some commit messages in "vfio: Set DMA ownership for
> VFIO" to describe the intentional enhancement of unsafe bridge
> drivers.
> - Comments refinement.
>
> v8:
> - Move iommu_use_default_domain() to the end of .dma_configure
> callback to avoid firmware-data-ordering thing.
> Link: https://lore.kernel.org/linux-iommu/e2698dbe-18e2-1a82-8a12-fe45bc9be534@arm.com/
Feel free to add my T-b
Tested-by: Eric Auger <eric.auger@redhat.com>
Thanks
Eric
> - Add Acked-by from PCI and VFIO maintainers.
>
> This is based on next branch of linux-iommu tree:
> https://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
> and also available on github:
> https://github.com/LuBaolu/intel-iommu/commits/iommu-dma-ownership-v8
>
> Best regards,
> baolu
>
> Jason Gunthorpe (1):
> vfio: Delete the unbound_list
>
> Lu Baolu (10):
> iommu: Add DMA ownership management interfaces
> driver core: Add dma_cleanup callback in bus_type
> amba: Stop sharing platform_dma_configure()
> bus: platform,amba,fsl-mc,PCI: Add device DMA ownership management
> PCI: pci_stub: Set driver_managed_dma
> PCI: portdrv: Set driver_managed_dma
> vfio: Set DMA ownership for VFIO devices
> vfio: Remove use of vfio_group_viable()
> vfio: Remove iommu group notifier
> iommu: Remove iommu group changes notifier
>
> include/linux/amba/bus.h | 8 +
> include/linux/device/bus.h | 3 +
> include/linux/fsl/mc.h | 8 +
> include/linux/iommu.h | 54 +++---
> include/linux/pci.h | 8 +
> include/linux/platform_device.h | 10 +-
> drivers/amba/bus.c | 37 +++-
> drivers/base/dd.c | 5 +
> drivers/base/platform.c | 21 ++-
> drivers/bus/fsl-mc/fsl-mc-bus.c | 24 ++-
> drivers/iommu/iommu.c | 228 ++++++++++++++++--------
> drivers/pci/pci-driver.c | 18 ++
> drivers/pci/pci-stub.c | 1 +
> drivers/pci/pcie/portdrv_pci.c | 2 +
> drivers/vfio/fsl-mc/vfio_fsl_mc.c | 1 +
> drivers/vfio/pci/vfio_pci.c | 1 +
> drivers/vfio/platform/vfio_amba.c | 1 +
> drivers/vfio/platform/vfio_platform.c | 1 +
> drivers/vfio/vfio.c | 245 ++------------------------
> 19 files changed, 338 insertions(+), 338 deletions(-)
>
next prev parent reply other threads:[~2022-03-10 9:47 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-08 5:44 [PATCH v8 00/11] Fix BUG_ON in vfio_iommu_group_notifier() Lu Baolu
2022-03-08 5:44 ` [PATCH v8 01/11] iommu: Add DMA ownership management interfaces Lu Baolu
2022-03-08 13:37 ` Robin Murphy
2022-03-08 5:44 ` [PATCH v8 02/11] driver core: Add dma_cleanup callback in bus_type Lu Baolu
2022-03-08 5:44 ` [PATCH v8 03/11] amba: Stop sharing platform_dma_configure() Lu Baolu
2022-03-08 5:44 ` [PATCH v8 04/11] bus: platform,amba,fsl-mc,PCI: Add device DMA ownership management Lu Baolu
2022-03-08 13:39 ` Robin Murphy
2022-03-08 5:44 ` [PATCH v8 05/11] PCI: pci_stub: Set driver_managed_dma Lu Baolu
2022-03-08 5:44 ` [PATCH v8 06/11] PCI: portdrv: " Lu Baolu
2022-03-08 5:44 ` [PATCH v8 07/11] vfio: Set DMA ownership for VFIO devices Lu Baolu
2022-03-08 5:44 ` [PATCH v8 08/11] vfio: Remove use of vfio_group_viable() Lu Baolu
2022-03-08 5:44 ` [PATCH v8 09/11] vfio: Delete the unbound_list Lu Baolu
2022-03-08 5:44 ` [PATCH v8 10/11] vfio: Remove iommu group notifier Lu Baolu
2022-03-08 5:44 ` [PATCH v8 11/11] iommu: Remove iommu group changes notifier Lu Baolu
2022-03-10 9:46 ` Eric Auger [this message]
2022-03-15 0:21 ` [PATCH v8 00/11] Fix BUG_ON in vfio_iommu_group_notifier() Jason Gunthorpe
2022-04-08 7:57 ` Joerg Roedel
2022-04-08 12:22 ` Lu Baolu
2022-04-08 12:23 ` Jason Gunthorpe
2022-04-08 14:00 ` Joerg Roedel
2022-04-08 14:17 ` Jason Gunthorpe
2022-04-08 15:37 ` Joerg Roedel
2022-04-08 15:59 ` Bjorn Helgaas
2022-04-08 16:07 ` Alex Williamson
2022-04-08 20:24 ` Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fb386c59-2359-0230-6340-3f8c8710b0f1@redhat.com \
--to=eric.auger@redhat.com \
--cc=airlied@linux.ie \
--cc=alex.williamson@redhat.com \
--cc=ashok.raj@intel.com \
--cc=baolu.lu@linux.intel.com \
--cc=bhelgaas@google.com \
--cc=cohuck@redhat.com \
--cc=dan.j.williams@intel.com \
--cc=daniel@ffwll.ch \
--cc=diana.craciun@oss.nxp.com \
--cc=digetx@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=hch@infradead.org \
--cc=iommu@lists.linux-foundation.org \
--cc=jacob.jun.pan@intel.com \
--cc=jgg@nvidia.com \
--cc=jonathanh@nvidia.com \
--cc=joro@8bytes.org \
--cc=kch@nvidia.com \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=laurentiu.tudor@nxp.com \
--cc=leoyang.li@nxp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=robin.murphy@arm.com \
--cc=stuyoder@gmail.com \
--cc=thierry.reding@gmail.com \
--cc=will@kernel.org \
--cc=yi.l.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).