linux-kernel - Re: [PATCH 1/1] iommu/vt-d: Fix RID2PASID setup failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 22 Jun 2022 11:22:31 +0800
From:   Baolu Lu <baolu.lu@...ux.intel.com>
To:     Ethan Zhao <haifeng.zhao@...ux.intel.com>,
        Joerg Roedel <joro@...tes.org>,
        Kevin Tian <kevin.tian@...el.com>,
        Ashok Raj <ashok.raj@...el.com>
Cc:     baolu.lu@...ux.intel.com, Chenyi Qiang <chenyi.qiang@...el.com>,
        Liu Yi L <yi.l.liu@...el.com>,
        Jacob jun Pan <jacob.jun.pan@...el.com>,
        iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH 1/1] iommu/vt-d: Fix RID2PASID setup failure

On 2022/6/22 10:56, Ethan Zhao wrote:
> 在 2022/6/20 16:17, Lu Baolu 写道:
>> The IOMMU driver shares the pasid table for PCI alias devices. When the
>> RID2PASID entry of the shared pasid table has been filled by the first
>> device, the subsequent devices will encounter the "DMAR: Setup RID2PASID
>> failed" failure as the pasid entry has already been marke as present. As
>> the result, the IOMMU probing process will be aborted.
>>
>> This fixes it by skipping RID2PASID setting if the pasid entry has been
>> populated. This works because the IOMMU core ensures that only the same
>> IOMMU domain can be attached to all PCI alias devices at the same time.
>> Therefore the subsequent devices just try to setup the RID2PASID entry
>> with the same domain, which is negligible.
>      We have two customers reported the issue "DMAR: Setup RID2PASID 
> failed",
> 
> Two ASPEED devices locate behind one PCIe-PCI bridge and iommu SM, PT 
> mode is enabled.  Most
> 
> Interesting thing is the second device is only used by BIOS, and BIOS 
> left it to OS without shutting down,
> 
> and it is useless for OS.

This sounds odd. Isn't this a bug?


> Is there practical case multi devices behind 
> PCIe-PCI bridge share the same
> 
> PASID entry without any security concern ? these two customer's case is 
> not.

The devices underneath the PCIe-PCI bridge are alias devices of the
bridge. PCI alias devices always sit in the same group (the minimal unit
that IOMMU guarantees isolation) and can only be attached with a same
domain (managed I/O address space). Hence, there's no security concern
if they further share the pasid table.

Best regards,
baolu