| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Feb 2021 09:52:32 -0700
From: Alex Williamson <alex.williamson@...hat.com>
To: alex.williamson@...hat.com
Cc: cohuck@...hat.com, kvm@...r.kernel.org,
linux-kernel@...r.kernel.org, jgg@...dia.com, peterx@...hat.com
Subject: [RFC PATCH 10/10] vfio/type1: Register device notifier
Introduce a new default strict MMIO mapping mode where the vma for
a VM_PFNMAP mapping must be backed by a vfio device. This allows
holding a reference to the device and registering a notifier for the
device, which additionally keeps the device in an IOMMU context for
the extent of the DMA mapping. On notification of device release,
automatically drop the DMA mappings for it.
Signed-off-by: Alex Williamson <alex.williamson@...hat.com>
---
drivers/vfio/vfio_iommu_type1.c | 124 +++++++++++++++++++++++++++++++++++++++
1 file changed, 123 insertions(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index b34ee4b96a4a..2a16257bd5b6 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -61,6 +61,11 @@ module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);
MODULE_PARM_DESC(dma_entry_limit,
"Maximum number of user DMA mappings per container (65535).");
+static bool strict_mmio_maps = true;
+module_param_named(strict_mmio_maps, strict_mmio_maps, bool, 0644);
+MODULE_PARM_DESC(strict_mmio_maps,
+ "Restrict to safe DMA mappings of device memory (true).");
+
struct vfio_iommu {
struct list_head domain_list;
struct list_head iova_list;
@@ -88,6 +93,14 @@ struct vfio_domain {
bool fgsp; /* Fine-grained super pages */
};
+/* Req separate object for async removal from notifier vs dropping vfio_dma */
+struct pfnmap_obj {
+ struct notifier_block nb;
+ struct work_struct work;
+ struct vfio_iommu *iommu;
+ struct vfio_device *device;
+};
+
struct vfio_dma {
struct rb_node node;
dma_addr_t iova; /* Device address */
@@ -100,6 +113,7 @@ struct vfio_dma {
struct task_struct *task;
struct rb_root pfn_list; /* Ex-user pinned pfn list */
unsigned long *bitmap;
+ struct pfnmap_obj *pfnmap;
};
struct vfio_group {
@@ -517,6 +531,68 @@ static int unmap_dma_pfn_list(struct vfio_iommu *iommu, struct vfio_dma *dma,
return 0;
}
+static void unregister_device_bg(struct work_struct *work)
+{
+ struct pfnmap_obj *pfnmap = container_of(work, struct pfnmap_obj, work);
+
+ vfio_device_unregister_notifier(pfnmap->device, &pfnmap->nb);
+ vfio_device_put(pfnmap->device);
+ kfree(pfnmap);
+}
+
+/*
+ * pfnmap object can exist beyond the dma mapping referencing it, but it holds
+ * a container reference assuring the iommu exists. Find the dma, if exists.
+ */
+struct vfio_dma *pfnmap_find_dma(struct pfnmap_obj *pfnmap)
+{
+ struct rb_node *n;
+
+ for (n = rb_first(&pfnmap->iommu->dma_list); n; n = rb_next(n)) {
+ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node);
+
+ if (dma->pfnmap == pfnmap)
+ return dma;
+ }
+
+ return NULL;
+}
+
+static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma);
+
+static int vfio_device_nb_cb(struct notifier_block *nb,
+ unsigned long action, void *unused)
+{
+ struct pfnmap_obj *pfnmap = container_of(nb, struct pfnmap_obj, nb);
+
+ switch (action) {
+ case VFIO_DEVICE_RELEASE:
+ {
+ struct vfio_dma *dma, *dma_last = NULL;
+ int retries = 0;
+again:
+ mutex_lock(&pfnmap->iommu->lock);
+ dma = pfnmap_find_dma(pfnmap);
+ if (dma) {
+ if (unmap_dma_pfn_list(pfnmap->iommu, dma,
+ &dma_last, &retries))
+ goto again;
+
+ dma->pfnmap = NULL;
+ vfio_remove_dma(pfnmap->iommu, dma);
+ }
+ mutex_unlock(&pfnmap->iommu->lock);
+
+ /* Cannot unregister notifier from callback chain */
+ INIT_WORK(&pfnmap->work, unregister_device_bg);
+ schedule_work(&pfnmap->work);
+ break;
+ }
+ }
+
+ return NOTIFY_OK;
+}
+
static int vaddr_get_pfn(struct vfio_iommu *iommu, struct vfio_dma *dma,
struct mm_struct *mm, unsigned long vaddr,
unsigned long *pfn)
@@ -549,8 +625,48 @@ static int vaddr_get_pfn(struct vfio_iommu *iommu, struct vfio_dma *dma,
if (ret == -EAGAIN)
goto retry;
- if (!ret && !is_invalid_reserved_pfn(*pfn))
+ if (!ret && !is_invalid_reserved_pfn(*pfn)) {
ret = -EFAULT;
+ goto done;
+ }
+
+ if (!dma->pfnmap) {
+ struct pfnmap_obj *pfnmap;
+ struct vfio_device *device;
+
+ pfnmap = kzalloc(sizeof(*pfnmap), GFP_KERNEL);
+ if (!pfnmap) {
+ ret = -ENOMEM;
+ goto done;
+ }
+
+ pfnmap->iommu = iommu;
+ pfnmap->nb.notifier_call = vfio_device_nb_cb;
+
+ device = vfio_device_get_from_vma(vma);
+ if (IS_ERR(device)) {
+ kfree(pfnmap);
+ if (strict_mmio_maps)
+ ret = PTR_ERR(device);
+
+ goto done;
+ }
+
+ pfnmap->device = device;
+ ret = vfio_device_register_notifier(device,
+ &pfnmap->nb);
+ if (ret) {
+ vfio_device_put(device);
+ kfree(pfnmap);
+ if (!strict_mmio_maps)
+ ret = 0;
+
+ goto done;
+ }
+
+ dma->pfnmap = pfnmap;
+ }
+
}
done:
mmap_read_unlock(mm);
@@ -1097,6 +1213,12 @@ static long vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma,
static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
{
WARN_ON(!RB_EMPTY_ROOT(&dma->pfn_list));
+ if (dma->pfnmap) {
+ vfio_device_unregister_notifier(dma->pfnmap->device,
+ &dma->pfnmap->nb);
+ vfio_device_put(dma->pfnmap->device);
+ kfree(dma->pfnmap);
+ }
vfio_unmap_unpin(iommu, dma, true);
vfio_unlink_dma(iommu, dma);
put_task_struct(dma->task);
Powered by blists - more mailing lists