linux-kernel - Re: [PATCH 1/1] iommu/vt-d: Add opt-in for ATS support on discrete devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Mar 2023 17:15:33 +0000
From:   Robin Murphy <robin.murphy@....com>
To:     Jason Gunthorpe <jgg@...dia.com>,
        Baolu Lu <baolu.lu@...ux.intel.com>
Cc:     iommu@...ts.linux.dev, Joerg Roedel <joro@...tes.org>,
        Will Deacon <will@...nel.org>,
        Kevin Tian <kevin.tian@...el.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] iommu/vt-d: Add opt-in for ATS support on discrete
 devices

On 2023-03-01 14:04, Jason Gunthorpe wrote:
> On Wed, Mar 01, 2023 at 12:22:23PM +0800, Baolu Lu wrote:
>> On 2/28/23 8:23 PM, Jason Gunthorpe wrote:
>>> On Tue, Feb 28, 2023 at 10:33:41AM +0800, Lu Baolu wrote:
>>>> In normal processing of PCIe ATS requests, the IOMMU performs address
>>>> translation and returns the device a physical memory address which
>>>> will be stored in that device's IOTLB. The device may subsequently
>>>> issue Translated DMA request containing physical memory address. The
>>>> IOMMU only checks that the device was allowed to issue such requests
>>>> and does not attempt to validate the physical address.
>>>>
>>>> The Intel IOMMU implementation only allows PCIe ATS on several SOC-
>>>> integrated devices which are opt-in’ed through the ACPI tables to
>>>> prevent any compromised device from accessing arbitrary physical
>>>> memory.
>>>>
>>>> Add a kernel option intel_iommu=relax_ats to allow users to have an
>>>> opt-in to allow turning on ATS at as wish, especially for CSP-owned
>>>> vertical devices. In any case, risky devices are not allowed to use
>>>> ATS.
>>> Why is this an intel specific option?
>>
>> I only see similar situation on ARM SMMUv3 platforms. The device ATS is
>> only allowed when the ATS bit is set in RC node of the ACPI/IORT table.
> 
> It should be common, all iommus using ATS need this logic.

The IORT flags are not this kind of policy, they are a necessary 
description of the hardware. The mix-and-match nature of licensable IP 
means that just because an SMMU supports the ATS-relevant features 
defined by the SMMU architecture, that doesn't say that whatever PCIe IP 
the customer has chosen to pair it with also supports ATS. Even when 
both ends nominally support it, it's still possible to integrate them 
together in ways where ATS wouldn't be functional.

In general, if a feature is marked as unsupported in IORT, the only way 
to "relax" that would be if you have a silicon fab handy. If any system 
vendor *was* to misuse IORT to impose arbitrary and unwelcome usage 
policy on their customers, then those customers should demand a firmware 
update (or at least use their own patched IORT, which is pretty trivial 
with the kernel's existing ACPI table override mechanism).

Thanks,
Robin.

>>> all it does is effectively
>>> disable untrusted?
>>
>> It's irrelevant to untrusted devices.
>>
>> Untrusted devices, with pci_dev->untrusted set, means device connects to
>> the system through some kind of untrusted external port, e.g.
>> thunderbolt ports. For those devices, ATS shouldn't be enabled for those
>> devices.
> 
> Yes
>   
>> Here we are talking about soc-integrated devices vs. discrete PCI
>> devices (connected to the system through internal PCI slot). The problem
>> is that the DMAR ACPI table only defines ATS attribute for Soc-
>> integrated devices, which causes ATS (and its ancillary features) on the
>> discrete PCI devices not to work.
> 
> So, IMHO, it is a bug to set what Linux calls as untrusted for
> discrete slots. We also definately don't want internal slots forced to
> non-identity mode either, for example.
> 
> This should be addressed at the PCI layer. Untrusted should always
> mean that the iommu layer should fully secure the device. It means
> identity translation should be blocked, it means the HW should reject
> translated requests, and ATS thus is not supported.
> 
> Every single iommu driver should implement this consistently across
> the whole subsystem.
> 
> If you don't want devices to be secured then that is a PCI/bios layer
> problem to get the correct data into the untrusted flag.
> 
> Not an iommu problem to ignore the flag.
> 
> Jason