linux-kernel - Re: [PATCH v2] iommu/amd: Set translation valid bit only when IO page tables are in used

Open Source and information security mailing list archives

Message-ID: <794e13dd-8eae-481d-711d-b5462fdbfb18@arm.com>
Date:   Fri, 20 May 2022 09:54:51 +0100
From:   Robin Murphy <robin.murphy@....com>
To:     Joerg Roedel <joro@...tes.org>,
        Suravee Suthikulpanit <suravee.suthikulpanit@....com>
Cc:     iommu@...ts.linux-foundation.org, jon.grimm@....com,
        linux-kernel@...r.kernel.org, vasant.hegde@....com
Subject: Re: [PATCH v2] iommu/amd: Set translation valid bit only when IO page
 tables are in used

On 2022-05-20 09:09, Joerg Roedel wrote:
> Hi Suravee,
> 
> On Mon, May 16, 2022 at 07:27:51PM +0700, Suravee Suthikulpanit wrote:
>> Due to the new restriction (please see the IOMMU spec Rev 3.06-PUB - Apr 2021
>> https://www.amd.com/system/files/TechDocs/48882_IOMMU.pdf) where the use of
>> DTE[Mode]=0 is not supported on systems that are SNP-enabled (i.e. EFR[SNPSup]=1),
>> the IOMMU HW looks at the DTE[TV] bit to determine if it needs to handle the v1 page table.
>> When the HW encounters DTE entry with TV=1, V=1, Mode=0, it would generate
>> ILLEGAL_DEV_TABLE_ENTRY event.
> 
> Ah, that is the part I was missing, thanks.
> 
>> - I am still trying to see what is the best way to force Linux to not allow
>> Mode=0 (i.e. iommu=pt mode). Any thoughts?
> 
> I think this needs a general approach. First start in the AMD IOMMU
> driver:
> 
> 	1) Do not set DTE.TV=1 bit iff SNP-Support is enabled
> 	2) Fail to allocate passthrough domains when SNP support is
> 	   enabled.
> 
> Then test how the IOMMU core layer handles that. In fact the IOMMU layer
> needs to adjust its decisions so that:
> 
> 	1) It uses translated-mode by default
> 	2) passthrough domains are disallowed and can not be chosen, not
> 	   on the kernel command line and not at runtime.
> 
> Ideally this needs some kind of arch-callback to set the appropriate
> defaults.

The .def_domain type op already allows drivers to do exactly this sort 
of override. You could also conditionally reject 
IOMMU_DOMAIN_PASSTHROUGH in .domain_alloc for good measure, provided 
that (for now at least*) SNP is a global thing rather than per-instance.

Cheers,
Robin.

*Instance-aware .domain_alloc probably about 2 releases away at the 
current pace of landing the tree-wide prep ;)

>> - Also, it seems that the current iommu v2 page table use case, where GVA->GPA=SPA
>> will no longer be supported on system w/ SNPSup=1. Any thoughts?
> 
> Support for that is not upstream yet, it should be easy to disallow this
> configuration and just use the v1 page-tables when SNP is active. This
> can be handled entirely inside the AMD IOMMU driver.
> 
> Regards,
> 
> 	Joerg
> _______________________________________________
> iommu mailing list
> iommu@...ts.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/iommu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives