linux-kernel - Re: [PATCH 2/5] iommu/vt-d: Remove WO permissions on second-level paging entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 8 Mar 2021 09:58:26 +0800
From:   Lu Baolu <baolu.lu@...ux.intel.com>
To:     Joerg Roedel <joro@...tes.org>
Cc:     baolu.lu@...ux.intel.com, Will Deacon <will@...nel.org>,
        ashok.raj@...el.com, kevin.tian@...el.com, jacob.jun.pan@...el.com,
        yi.l.liu@...el.com, sanjay.k.kumar@...el.com,
        iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/5] iommu/vt-d: Remove WO permissions on second-level
 paging entries

Hi Joerg,

On 3/4/21 8:26 PM, Joerg Roedel wrote:
> On Thu, Feb 25, 2021 at 02:26:51PM +0800, Lu Baolu wrote:
>> When the first level page table is used for IOVA translation, it only
>> supports Read-Only and Read-Write permissions. The Write-Only permission
>> is not supported as the PRESENT bit (implying Read permission) should
>> always set. When using second level, we still give separate permissions
>> that allows WriteOnly which seems inconsistent and awkward. There is no
>> use case we can think off, hence remove that configuration to make it
>> consistent.
> 
> No use-case for WriteOnly mappings? How about DMA_FROM_DEVICE mappings?
> 

The statement of no use case is not correct. Sorry about it.

As we have moved to use first level for IOVA translation, the first
level page table entry only provides RO and RW permissions. So if any
device driver specifies DMA_FROM_DEVICE attribution, it will get RW
permission in the page table. This patch aims to make the permissions
of second level and first level consistent. No impact on the use of
DMA_FROM_DEVICE attribution.

Best regards,
baolu