linux-kernel - Re: [PATCH V2] x86/tboot: add an option to disable iommu force on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170505084004.GM5077@suse.de>
Date:   Fri, 5 May 2017 10:40:04 +0200
From:   Joerg Roedel <jroedel@...e.de>
To:     Ingo Molnar <mingo@...nel.org>
Cc:     Shaohua Li <shli@...com>, linux-kernel@...r.kernel.org,
        gang.wei@...el.com, hpa@...ux.intel.com, kernel-team@...com,
        ning.sun@...el.com, srihan@...com, alex.eydelberg@...el.com
Subject: Re: [PATCH V2] x86/tboot: add an option to disable iommu force on

Hi Ingo,

On Fri, May 05, 2017 at 08:59:20AM +0200, Ingo Molnar wrote:
> * Joerg Roedel <jroedel@...e.de> wrote:

> > The problem solved here is that someone wants tboot for security
> > reasons, but doesn't want the performance penalty of having the IOMMU
> > enabled and can live with the risk of an DMA attack.
> 
> Yes, that makes sense - but in this case it would be far more user friendly to 
> make it a sysctl, not a boot option. This is also much more manageable for 
> distributions and also allows it to be more easily turned into a security policy 
> feature.
> 
> New boot options should be for debugging hacks in essence - any serious hardware 
> configuration should be done via more user-friendly methods.

I agree in general that a sysctl would be more user-friendly. But the
problem is that enabling/disabling the IOMMU is a boot-time option that
can't be changed at runtime.

That is because this decission defines how the bus addresses are mapped
to physical addresses through the dma-api. When the iommu is disabled,
it is just a 1-1 mapping, but when it is enabled a physical address
could end up on any address in the bus address space.

Once drivers are loaded that allocate those addresses we can't change
the mappings anymore as disabling the iommu would do.

Regards,

	Joerg