linux-kernel - RE: [PATCH 2/7] iommu/vt-d: Add blocking domain support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Nov 2022 02:11:20 +0000
From:   "Tian, Kevin" <kevin.tian@...el.com>
To:     Lu Baolu <baolu.lu@...ux.intel.com>,
        "iommu@...ts.linux.dev" <iommu@...ts.linux.dev>
CC:     Joerg Roedel <joro@...tes.org>, Will Deacon <will@...nel.org>,
        "Robin Murphy" <robin.murphy@....com>,
        "Liu, Yi L" <yi.l.liu@...el.com>,
        "Pan, Jacob jun" <jacob.jun.pan@...el.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 2/7] iommu/vt-d: Add blocking domain support

> From: Lu Baolu <baolu.lu@...ux.intel.com>
> Sent: Thursday, November 3, 2022 1:53 PM
> 
> +/*
> + * Clear the page table pointer in context or pasid table entries so that
> + * all DMA requests without PASID from the device are blocked. If the page
> + * table has been set, clean up the data structures.
> + */
> +static void device_block_translation(struct device *dev)

given this helper will be used both by existing paths and the new block
domain, it makes more sense to have it work with existing paths first
i.e. merging with patch3 and then add block domain after.

> +{
> +	struct device_domain_info *info = dev_iommu_priv_get(dev);
> +	struct intel_iommu *iommu = info->iommu;
> +	unsigned long flags;
> +
> +	if (!dev_is_real_dma_subdevice(dev)) {
> +		if (sm_supported(iommu))
> +			intel_pasid_tear_down_entry(iommu, dev,
> +						    PASID_RID2PASID, false);

Since commit 4140d77a aliases devices don't share pasid table,
which implies that pci_for_each_dma_alias() is required as did
in domain_context_clear().

> +		else
> +			domain_context_clear(info);
> +	}
> +
> +	if (!info->domain)
> +		return;
> +
> +	spin_lock_irqsave(&info->domain->lock, flags);
> +	list_del(&info->link);
> +	spin_unlock_irqrestore(&info->domain->lock, flags);
> +
> +	domain_detach_iommu(info->domain, iommu);
> +	info->domain = NULL;
> +}
> +