From patchwork Fri Mar 25 18:46:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rajat Jain X-Patchwork-Id: 1609545 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20210112 header.b=pPUMCEvf; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=linux-pci-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by bilbo.ozlabs.org (Postfix) with ESMTP id 4KQC89185rz9s3q for ; Sat, 26 Mar 2022 06:39:05 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230457AbiCYTkc (ORCPT ); Fri, 25 Mar 2022 15:40:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233350AbiCYTjw (ORCPT ); Fri, 25 Mar 2022 15:39:52 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5509E1546A5 for ; Fri, 25 Mar 2022 12:12:20 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id h8-20020a25e208000000b00628c0565607so6807581ybe.0 for ; Fri, 25 Mar 2022 12:12:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=woMjFLNUegNjbJ51x62lvW6UbmQA+Ba7zyUjvkY6YYA=; b=pPUMCEvf8BZ62Y/c+W1qNInLop6JGyWd784jOQMkj1CbDHqg6py/a0QUTHIl90KdK9 w8p+a0V9OwXTGRp2ndKsQIWc5a+N8W0cnnGZFdPvIxrlF1S6agDjEDnrq+kop7VArS9W RbYNWRUOGzcuxrBV4L2CC5m9He2upt/Ljn2rs9gmG3kXrsXyBQMYXRw3Gbsg1t4Arnqw Vz5BauwAV3zM0pm0GHPutIyIuVDPFsGPQzM4SkLsQISvm66TNi9ybfRXySbc8zm/ozK8 dVwdJktR7GmW3rsxUBUyM3bSBrBGyKaXWu9kydtN+Kk/btVZUC8+M9kY4J9l0j+/DcQR l9Qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=woMjFLNUegNjbJ51x62lvW6UbmQA+Ba7zyUjvkY6YYA=; b=bsprFepp01fowvXqGyBOZ+ex0KySQ6VhygmA7xjY+e3oGG1KbkkEvT/khL0pNz/KBP bWgeJcwmISBYsbavBlQsmyRDihmMHKpIdup0pHbqIUGm3R6axnEpIFIGEmGDW3aM9lsq 70MKaIC1AizvhBFuvptIGulJePmETfZYDZdos8IYu+Z+q889Co+Cr7ZXycYj+vK5AHMo 3GphxBooUUV0wxJsumtsFm674gzUgIH8Hky/4LUhuJeR4NFIKp5LQujHin8OhfGA7aDN yduTzf4luvLHCKvbCQDdjctJbYiaHCTnoGTRAcaP5j789D1n4naBdLFMEC81rXc3Wfis 8aPw== X-Gm-Message-State: AOAM531Wi/Iauj5ldwyxLEcY0thKjcudQGc/MOptFq22EggGTqFTtmVM g5W6Fqu6zM9rx/qu1YrYyps8WpvWQfY0 X-Google-Smtp-Source: ABdhPJyRS7LP7fvCaSt0TldDrztqH9QfayLTVY7BMeLHgtTzqTb9UkZpPGUKvtovyGUbBIdo731RsDJISrP1 X-Received: from rajat2.mtv.corp.google.com ([2620:15c:202:201:4cfc:6eaf:38d8:46d6]) (user=rajatja job=sendgmr) by 2002:a81:94d:0:b0:2e5:b91a:195b with SMTP id 74-20020a81094d000000b002e5b91a195bmr12106133ywj.44.1648233973993; Fri, 25 Mar 2022 11:46:13 -0700 (PDT) Date: Fri, 25 Mar 2022 11:46:08 -0700 Message-Id: <20220325184609.4059963-1-rajatja@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.35.1.1021.g381101b075-goog Subject: [PATCH v5 1/2] PCI: ACPI: Support Microsoft's "DmaProperty" From: Rajat Jain To: "Rafael J. Wysocki" , Len Brown , linux-pci@vger.kernel.org, Mika Westerberg , Greg Kroah-Hartman , Bjorn Helgaas , Bjorn Helgaas , ACPI Devel Maling List , Linux Kernel Mailing List , Rajat Jain , Dmitry Torokhov , Jesse Barnes , Jean-Philippe Brucker , Pavel Machek , "Oliver O'Halloran" , Joerg Roedel , Will Deacon , David Woodhouse , Lu Baolu , iommu@lists.linux-foundation.org Cc: Rajat Jain X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org The "DmaProperty" is supported and documented by Microsoft here: https://docs.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports They use this property for DMA protection: https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt Support the "DmaProperty" with the same semantics. This is useful for internal PCI devices that do not hang off a PCIe rootport, but offer an attack surface for DMA attacks (e.g. internal network devices). Signed-off-by: Rajat Jain Reviewed-by: Mika Westerberg Acked-by: Rafael J. Wysocki --- v5: * Reorder the patches in the series v4: * Add the GUID. * Update the comment and commitlog. v3: * Use Microsoft's documented property "DmaProperty" * Resctrict to ACPI only drivers/acpi/property.c | 3 +++ drivers/pci/pci-acpi.c | 16 ++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c index d0986bda2964..20603cacc28d 100644 --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -48,6 +48,9 @@ static const guid_t prp_guids[] = { /* Storage device needs D3 GUID: 5025030f-842f-4ab4-a561-99a5189762d0 */ GUID_INIT(0x5025030f, 0x842f, 0x4ab4, 0xa5, 0x61, 0x99, 0xa5, 0x18, 0x97, 0x62, 0xd0), + /* DmaProperty for PCI devices GUID: 70d24161-6dd5-4c9e-8070-705531292865 */ + GUID_INIT(0x70d24161, 0x6dd5, 0x4c9e, + 0x80, 0x70, 0x70, 0x55, 0x31, 0x29, 0x28, 0x65), }; /* ACPI _DSD data subnodes GUID: dbb8e3e6-5886-4ba6-8795-1319f52a966b */ diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c index 1f15ab7eabf8..378e05096c52 100644 --- a/drivers/pci/pci-acpi.c +++ b/drivers/pci/pci-acpi.c @@ -1350,12 +1350,28 @@ static void pci_acpi_set_external_facing(struct pci_dev *dev) dev->external_facing = 1; } +static void pci_acpi_check_for_dma_protection(struct pci_dev *dev) +{ + u8 val; + + /* + * Property also used by Microsoft Windows for same purpose, + * (to implement DMA protection from a device, using the IOMMU). + */ + if (device_property_read_u8(&dev->dev, "DmaProperty", &val)) + return; + + if (val) + dev->untrusted = 1; +} + void pci_acpi_setup(struct device *dev, struct acpi_device *adev) { struct pci_dev *pci_dev = to_pci_dev(dev); pci_acpi_optimize_delay(pci_dev, adev->handle); pci_acpi_set_external_facing(pci_dev); + pci_acpi_check_for_dma_protection(pci_dev); pci_acpi_add_edr_notifier(pci_dev); pci_acpi_add_pm_notifier(adev, pci_dev); From patchwork Fri Mar 25 18:46:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rajat Jain X-Patchwork-Id: 1609529 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20210112 header.b=jf7zMlle; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=linux-pci-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by bilbo.ozlabs.org (Postfix) with ESMTP id 4KQBpy6Hhbz9s3q for ; Sat, 26 Mar 2022 06:24:10 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229448AbiCYTZn (ORCPT ); Fri, 25 Mar 2022 15:25:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56136 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229447AbiCYTZm (ORCPT ); Fri, 25 Mar 2022 15:25:42 -0400 Received: from mail-vs1-f74.google.com (mail-vs1-f74.google.com [209.85.217.74]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EAE1C3E394C for ; Fri, 25 Mar 2022 11:57:56 -0700 (PDT) Received: by mail-vs1-f74.google.com with SMTP id m63-20020a677142000000b002fd633f4b85so1892075vsc.9 for ; Fri, 25 Mar 2022 11:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=Ls9it47eZWinX53APMUqdqAduomURMCMA1XbEoHFGsQ=; b=jf7zMllek1mo+Nas3aa4rEhx43ZQ1waGsvpYfvNgwEiwCCAWoS9SZnLaJXQkmWB2M+ 6ADBWCg++Y/FrbEy+5C39/gGLqcx4snlS9RYWJ/YGs3g5cvd3LI37DJwtxQaZrgvfsIK DvPSTDXUlEcNrYFmc342Iei4ddki3i5mmID22YQNV1R2nOMGPMCxIwsMy8+VCjmW1WoK 11vn7pIxU1GZdIUQWGjR0RiLjnaMUHdJLeEZDc7rkurcAaVlTDWLpuwtdaO89njTL0TV nAzkGxoPuCWzeOpRkJsR2dSBMbJCs3QsocLwAqkbEAcMh1p1+uXBZocYUtA08DLgKHTg Y5xw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=Ls9it47eZWinX53APMUqdqAduomURMCMA1XbEoHFGsQ=; b=Z2XTgGhzxaomoQ2WyNznePWxWGTu5MIS1o8n2SnNaLUB2/V/q/B/anFVMHpyiYoU8l VK7Y5URaJ+qEwH+ojFNecxzKfKXfrkBKRBZ+inQdd40g8YtzcCh0iBHigq9muCgMXxyu vBzSGMRiAkQntUHoPxuuLSp8Qf3fI0aOZFMd+wpT60jJq3ShI7T93QIYMtXiEumRzcsa I5vrqwrwkyMqZeGh71jjtHUMiz8+QJc7J+pSl6P/zqaomVPqUWJhMC7HyHYtfeCb6kJL lYcq5PURlwOjZ9nIVwUIXnbzVscJt1ON7Pi1Xmn/KYWh7F4GDnCqi40CNpTLYqMi9MNd 4D+g== X-Gm-Message-State: AOAM533CfUiy1sMFZRVcy1T4eQQHA5YCwDGidZFw4AsQD8vvDgrbnuhX +DNYaHWyLbh+bA53BH42ReF44h+o1yeN X-Google-Smtp-Source: ABdhPJz4caM2/r37eNH0kp8MNsyvhq+I0iaYEcSsuTjltPrYwKcYHAUtmqHXJObuMsBQf4dmQ6rBvqb9FmsD X-Received: from rajat2.mtv.corp.google.com ([2620:15c:202:201:4cfc:6eaf:38d8:46d6]) (user=rajatja job=sendgmr) by 2002:a81:36cf:0:b0:2e5:2597:a026 with SMTP id d198-20020a8136cf000000b002e52597a026mr12243252ywa.301.1648233976396; Fri, 25 Mar 2022 11:46:16 -0700 (PDT) Date: Fri, 25 Mar 2022 11:46:09 -0700 In-Reply-To: <20220325184609.4059963-1-rajatja@google.com> Message-Id: <20220325184609.4059963-2-rajatja@google.com> Mime-Version: 1.0 References: <20220325184609.4059963-1-rajatja@google.com> X-Mailer: git-send-email 2.35.1.1021.g381101b075-goog Subject: [PATCH v5 2/2] PCI: Rename pci_dev->untrusted to pci_dev->untrusted_dma From: Rajat Jain To: "Rafael J. Wysocki" , Len Brown , linux-pci@vger.kernel.org, Mika Westerberg , Greg Kroah-Hartman , Bjorn Helgaas , Bjorn Helgaas , ACPI Devel Maling List , Linux Kernel Mailing List , Rajat Jain , Dmitry Torokhov , Jesse Barnes , Jean-Philippe Brucker , Pavel Machek , "Oliver O'Halloran" , Joerg Roedel , Will Deacon , David Woodhouse , Lu Baolu , iommu@lists.linux-foundation.org Cc: Rajat Jain X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org Rename the field to make it more clear, that the device can execute DMA attacks on the system, and thus the system may need protection from such attacks from this device. No functional change intended. Signed-off-by: Rajat Jain Reviewed-by: Mika Westerberg Acked-by: Rafael J. Wysocki --- v5: Use "untrusted_dma" as property name, based on feedback. Reorder the patches in the series. v4: Initial version, created based on comments on other patch drivers/iommu/dma-iommu.c | 6 +++--- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/pci/ats.c | 2 +- drivers/pci/pci-acpi.c | 2 +- drivers/pci/pci.c | 2 +- drivers/pci/probe.c | 8 ++++---- drivers/pci/quirks.c | 2 +- include/linux/pci.h | 5 +++-- 9 files changed, 16 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index d85d54f2b549..7cbe300fe907 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -497,14 +497,14 @@ static int iova_reserve_iommu_regions(struct device *dev, return ret; } -static bool dev_is_untrusted(struct device *dev) +static bool dev_has_untrusted_dma(struct device *dev) { - return dev_is_pci(dev) && to_pci_dev(dev)->untrusted; + return dev_is_pci(dev) && to_pci_dev(dev)->untrusted_dma; } static bool dev_use_swiotlb(struct device *dev) { - return IS_ENABLED(CONFIG_SWIOTLB) && dev_is_untrusted(dev); + return IS_ENABLED(CONFIG_SWIOTLB) && dev_has_untrusted_dma(dev); } /** diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 92fea3fbbb11..9246b7c9ab46 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -5570,7 +5570,7 @@ intel_iommu_enable_nesting(struct iommu_domain *domain) */ static bool risky_device(struct pci_dev *pdev) { - if (pdev->untrusted) { + if (pdev->untrusted_dma) { pci_info(pdev, "Skipping IOMMU quirk for dev [%04X:%04X] on untrusted PCI link\n", pdev->vendor, pdev->device); diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 8b86406b7162..79fb66af2e68 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -1522,7 +1522,7 @@ static int iommu_get_def_domain_type(struct device *dev) { const struct iommu_ops *ops = dev->bus->iommu_ops; - if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted) + if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted_dma) return IOMMU_DOMAIN_DMA; if (ops->def_domain_type) diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c index c967ad6e2626..477c16ba9341 100644 --- a/drivers/pci/ats.c +++ b/drivers/pci/ats.c @@ -42,7 +42,7 @@ bool pci_ats_supported(struct pci_dev *dev) if (!dev->ats_cap) return false; - return (dev->untrusted == 0); + return (dev->untrusted_dma == 0); } EXPORT_SYMBOL_GPL(pci_ats_supported); diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c index 378e05096c52..1d5a284c3661 100644 --- a/drivers/pci/pci-acpi.c +++ b/drivers/pci/pci-acpi.c @@ -1362,7 +1362,7 @@ static void pci_acpi_check_for_dma_protection(struct pci_dev *dev) return; if (val) - dev->untrusted = 1; + dev->untrusted_dma = 1; } void pci_acpi_setup(struct device *dev, struct acpi_device *adev) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 9ecce435fb3f..1fb0eb8646c8 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -958,7 +958,7 @@ static void pci_std_enable_acs(struct pci_dev *dev) ctrl |= (cap & PCI_ACS_UF); /* Enable Translation Blocking for external devices and noats */ - if (pci_ats_disabled() || dev->external_facing || dev->untrusted) + if (pci_ats_disabled() || dev->external_facing || dev->untrusted_dma) ctrl |= (cap & PCI_ACS_TB); pci_write_config_word(dev, pos + PCI_ACS_CTRL, ctrl); diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index 17a969942d37..d2a9b26fcede 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1587,7 +1587,7 @@ static void set_pcie_thunderbolt(struct pci_dev *dev) dev->is_thunderbolt = 1; } -static void set_pcie_untrusted(struct pci_dev *dev) +static void pci_set_untrusted_dma(struct pci_dev *dev) { struct pci_dev *parent; @@ -1596,8 +1596,8 @@ static void set_pcie_untrusted(struct pci_dev *dev) * untrusted as well. */ parent = pci_upstream_bridge(dev); - if (parent && (parent->untrusted || parent->external_facing)) - dev->untrusted = true; + if (parent && (parent->untrusted_dma || parent->external_facing)) + dev->untrusted_dma = true; } static void pci_set_removable(struct pci_dev *dev) @@ -1862,7 +1862,7 @@ int pci_setup_device(struct pci_dev *dev) /* Need to have dev->cfg_size ready */ set_pcie_thunderbolt(dev); - set_pcie_untrusted(dev); + pci_set_untrusted_dma(dev); /* "Unknown power state" */ dev->current_state = PCI_UNKNOWN; diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 5f46fed01e6c..7ca3c2cdfb20 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -5134,7 +5134,7 @@ static int pci_quirk_enable_intel_spt_pch_acs(struct pci_dev *dev) ctrl |= (cap & PCI_ACS_CR); ctrl |= (cap & PCI_ACS_UF); - if (pci_ats_disabled() || dev->external_facing || dev->untrusted) + if (pci_ats_disabled() || dev->external_facing || dev->untrusted_dma) ctrl |= (cap & PCI_ACS_TB); pci_write_config_dword(dev, pos + INTEL_SPT_ACS_CTRL, ctrl); diff --git a/include/linux/pci.h b/include/linux/pci.h index 678fecdf6b81..b7c5fede0b93 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -444,13 +444,14 @@ struct pci_dev { unsigned int shpc_managed:1; /* SHPC owned by shpchp */ unsigned int is_thunderbolt:1; /* Thunderbolt controller */ /* - * Devices marked being untrusted are the ones that can potentially + * Devices marked with untrusted_dma are the ones that can potentially * execute DMA attacks and similar. They are typically connected * through external ports such as Thunderbolt but not limited to * that. When an IOMMU is enabled they should be getting full * mappings to make sure they cannot access arbitrary memory. */ - unsigned int untrusted:1; + unsigned int untrusted_dma:1; + /* * Info from the platform, e.g., ACPI or device tree, may mark a * device as "external-facing". An external-facing device is