linux-kernel - RE: [PATCH V4] PCI: Extend ACS configurability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BL1PR11MB52718B54937B888AD9E394D78CD62@BL1PR11MB5271.namprd11.prod.outlook.com>
Date: Wed, 26 Jun 2024 07:40:31 +0000
From: "Tian, Kevin" <kevin.tian@...el.com>
To: Vidya Sagar <vidyas@...dia.com>, "corbet@....net" <corbet@....net>,
	"bhelgaas@...gle.com" <bhelgaas@...gle.com>, "galshalom@...dia.com"
	<galshalom@...dia.com>, "leonro@...dia.com" <leonro@...dia.com>,
	"jgg@...dia.com" <jgg@...dia.com>, "treding@...dia.com" <treding@...dia.com>,
	"jonathanh@...dia.com" <jonathanh@...dia.com>
CC: "mmoshrefjava@...dia.com" <mmoshrefjava@...dia.com>, "shahafs@...dia.com"
	<shahafs@...dia.com>, "vsethi@...dia.com" <vsethi@...dia.com>,
	"sdonthineni@...dia.com" <sdonthineni@...dia.com>, "jan@...dia.com"
	<jan@...dia.com>, "Dave, Tushar" <tdave@...dia.com>,
	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	"linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kthota@...dia.com" <kthota@...dia.com>, "mmaddireddy@...dia.com"
	<mmaddireddy@...dia.com>, "sagar.tv@...il.com" <sagar.tv@...il.com>
Subject: RE: [PATCH V4] PCI: Extend ACS configurability

> From: Vidya Sagar <vidyas@...dia.com>
> Sent: Tuesday, June 25, 2024 11:32 PM
> 
> PCIe ACS settings control the level of isolation and the possible P2P
> paths between devices. With greater isolation the kernel will create
> smaller iommu_groups and with less isolation there is more HW that
> can achieve P2P transfers. From a virtualization perspective all
> devices in the same iommu_group must be assigned to the same VM as
> they lack security isolation.
> 

It'll be helpful to also call out the impact of losing other features (e.g. PASID)
with less isolation:

pci_enable_pasid()
{
	...
	if (!pci_acs_path_enabled(pdev, NULL, PCI_ACS_RR | PCI_ACS_UF))
		return -EINVAL;
	...
}