linux-kernel - RE: [PATCH v4 21/23] iommu/tegra241-cmdqv: Do not statically map LVCMDQs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BN9PR11MB5276FF1D733E5F086C6A26968C90A@BN9PR11MB5276.namprd11.prod.outlook.com>
Date: Thu, 15 May 2025 08:20:44 +0000
From: "Tian, Kevin" <kevin.tian@...el.com>
To: Nicolin Chen <nicolinc@...dia.com>, "jgg@...dia.com" <jgg@...dia.com>,
	"corbet@....net" <corbet@....net>, "will@...nel.org" <will@...nel.org>
CC: "bagasdotme@...il.com" <bagasdotme@...il.com>, "robin.murphy@....com"
	<robin.murphy@....com>, "joro@...tes.org" <joro@...tes.org>,
	"thierry.reding@...il.com" <thierry.reding@...il.com>, "vdumpa@...dia.com"
	<vdumpa@...dia.com>, "jonathanh@...dia.com" <jonathanh@...dia.com>,
	"shuah@...nel.org" <shuah@...nel.org>, "jsnitsel@...hat.com"
	<jsnitsel@...hat.com>, "nathan@...nel.org" <nathan@...nel.org>,
	"peterz@...radead.org" <peterz@...radead.org>, "Liu, Yi L"
	<yi.l.liu@...el.com>, "mshavit@...gle.com" <mshavit@...gle.com>,
	"praan@...gle.com" <praan@...gle.com>, "zhangzekun11@...wei.com"
	<zhangzekun11@...wei.com>, "iommu@...ts.linux.dev" <iommu@...ts.linux.dev>,
	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-tegra@...r.kernel.org"
	<linux-tegra@...r.kernel.org>, "linux-kselftest@...r.kernel.org"
	<linux-kselftest@...r.kernel.org>, "patches@...ts.linux.dev"
	<patches@...ts.linux.dev>, "mochs@...dia.com" <mochs@...dia.com>,
	"alok.a.tiwari@...cle.com" <alok.a.tiwari@...cle.com>, "vasant.hegde@....com"
	<vasant.hegde@....com>
Subject: RE: [PATCH v4 21/23] iommu/tegra241-cmdqv: Do not statically map
 LVCMDQs

> From: Nicolin Chen <nicolinc@...dia.com>
> Sent: Friday, May 9, 2025 11:03 AM
> 
> To simplify the mappings from global VCMDQs to VINTFs' LVCMDQs, the
> design
> chose to do static allocations and mappings in the global reset function.
> 
> However, with the user-owned VINTF support, it exposes a security concern:
> if user space VM only wants one LVCMDQ for a VINTF, statically mapping two
> or more LVCMDQs creates a hidden VCMDQ that user space could DoS attack
> by
> writing random stuff to overwhelm the kernel with unhandleable IRQs.
> 
> Thus, to support the user-owned VINTF feature, a LVCMDQ mapping has to
> be
> done dynamically.
> 
> HW allows pre-assigning global VCMDQs in the CMDQ_ALLOC registers,
> without
> finalizing the mappings by keeping CMDQV_CMDQ_ALLOCATED=0. So, add a
> pair
> of map/unmap helper that simply sets/clears that bit.
> 
> Delay the LVCMDQ mappings to tegra241_vintf_hw_init(), and the
> unmappings
> to tegra241_vintf_hw_deinit().

I don't know the specifics of tegra241-cmdqv. But the current description
is a bit misleading. for native tegra241_vintf_hw_init() is called from reset
so the mapping is still enabled in that path. for user-owned then 
tegra241_vcmdq_map_lvcmdq() is called from tegra241_vintf_alloc_lvcmdq_user()
instead of tegra241_vintf_hw_init().

so nothing is actually delayed in this patch.