linux-kernel - Re: [PATCH 4/5] iommu/vt-d: Disallow SVA if devices don't support 64-bit address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Jul 2021 09:50:49 +0800
From:   Lu Baolu <baolu.lu@...ux.intel.com>
To:     Robin Murphy <robin.murphy@....com>,
        Joerg Roedel <joro@...tes.org>,
        Sanjay Kumar <sanjay.k.kumar@...el.com>,
        Kevin Tian <kevin.tian@...el.com>,
        Ashok Raj <ashok.raj@...el.com>,
        Jacob Pan <jacob.jun.pan@...ux.intel.com>,
        Dave Jiang <dave.jiang@...el.com>,
        Liu Yi L <yi.l.liu@...el.com>
Cc:     baolu.lu@...ux.intel.com, iommu@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 4/5] iommu/vt-d: Disallow SVA if devices don't support
 64-bit address

Hi Robin,

Thanks a lot for reviewing my patch!

On 7/20/21 5:27 PM, Robin Murphy wrote:
> On 2021-07-20 02:38, Lu Baolu wrote:
>> When the device and CPU share an address space (such as SVA), the device
>> must support the same addressing capability as the CPU. The CPU does not
>> consider the addressing ability of any device when managing the page 
>> table
>> of a process, so the device must have enough addressing ability to bind
>> the page table of the process.
>>
>> Signed-off-by: Lu Baolu <baolu.lu@...ux.intel.com>
>> ---
>>   drivers/iommu/intel/iommu.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
>> index f45c80ce2381..f3cca1dd384d 100644
>> --- a/drivers/iommu/intel/iommu.c
>> +++ b/drivers/iommu/intel/iommu.c
>> @@ -5372,6 +5372,9 @@ static int intel_iommu_enable_sva(struct device 
>> *dev)
>>       if (!(iommu->flags & VTD_FLAG_SVM_CAPABLE))
>>           return -ENODEV;
>> +    if (!dev->dma_mask || *dev->dma_mask != DMA_BIT_MASK(64))
> 
> Careful - VFIO doesn't set DMA masks (since it doesn't use the DMA API),

SVA doesn't work through the VFIO framework.

> so this appears to be relying on another driver having bound previously,

Yes. You are right.

> otherwise the mask would still be the default 32-bit one from 
> pci_setup_device(). I'm not sure that's an entirely robust assumption.

Currently SVA implementation always requires a native kernel driver. The
assumption is that the drivers should check and set 64-bit addressing
capability before calling iommu_sva_xxx() APIs.

>
> Robin.
> 
>> +        return -ENODEV;
>> +
>>       if (intel_iommu_enable_pasid(iommu, dev))
>>           return -ENODEV;
>>

Best regards,
baolu