linux-kernel - Re: [PATCH 3/3] iommu: prevent VMD child devices from being remapping targets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e1ead7c8-0891-f1b2-e5b0-d601d1af80e0@intel.com>
Date:   Wed, 9 Aug 2017 11:13:30 -0600
From:   Jon Derrick <jonathan.derrick@...el.com>
To:     Robin Murphy <robin.murphy@....com>, linux-pci@...r.kernel.org,
        iommu@...ts.linux-foundation.org
Cc:     linux-kernel@...r.kernel.org, Keith Busch <keith.busch@...el.com>,
        Bjorn Helgaas <helgaas@...nel.org>,
        David Fugate <david.fugate@...el.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Scott Bauer <scott.bauer@...el.com>
Subject: Re: [PATCH 3/3] iommu: prevent VMD child devices from being remapping
 targets

Hi Robin, thanks for the reply.

On 08/11/2017 12:25 PM, Robin Murphy wrote:
> On 07/08/17 20:57, Jon Derrick wrote:
>> VMD child devices must use the VMD endpoint's ID as the DMA source.
>> Because of this, there needs to be a way to link the parent VMD
>> endpoint's DMAR domain to the VMD child devices' DMAR domain such that
>> attaching and detaching child devices modify the endpoint's DMAR mapping
>> and prevents early detaching.
> > That sounds like either pci_device_group() needs modifying, or perhaps
> that intel-iommu needs its own extended iommu_ops::device_group
> implementation, to ensure that VMD child devices get put in the same
> group as their parent - if they share requester IDs they can't feasibly
> be attached to different domains anyway.
> 
> Robin.
Yes it seems like that to me too. I have a high-level understanding of
the changes required but not too much in the nitty-gritty details. It's
a bit more complicated anyways because VMD emerges a set of root ports,
and AFAICT, PCI ACS end at the root ports and iommu groups rely on ACS
to group devices. Either way it's not within the scope of VMD.