| Message ID | 20210615132711.553451-1-tientzu@chromium.org |
|---|---|
| Headers | show |
| Series | Restricted DMA | expand |
On Tue, Jun 15, 2021 at 09:27:00PM +0800, Claire Chang wrote: > Add a new function, swiotlb_init_io_tlb_mem, for the io_tlb_mem struct > initialization to make the code reusable. Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:01PM +0800, Claire Chang wrote: > Split the debugfs creation to make the code reusable for supporting > different bounce buffer pools. > > Signed-off-by: Claire Chang <tientzu@chromium.org> Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
Looks good,
Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:03PM +0800, Claire Chang wrote: > Update is_swiotlb_buffer to add a struct device argument. This will be > useful later to allow for different pools. > > Signed-off-by: Claire Chang <tientzu@chromium.org> Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:04PM +0800, Claire Chang wrote: > Update is_swiotlb_active to add a struct device argument. This will be > useful later to allow for different pools. > > Signed-off-by: Claire Chang <tientzu@chromium.org> Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:05PM +0800, Claire Chang wrote: > Propagate the swiotlb_force setting into io_tlb_default_mem->force and > use it to determine whether to bounce the data or not. This will be > useful later to allow for different pools. > > Signed-off-by: Claire Chang <tientzu@chromium.org> Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:06PM +0800, Claire Chang wrote: > Rename find_slots to swiotlb_find_slots and move the maintenance of > alloc_size to it for better code reusability later. > > Signed-off-by: Claire Chang <tientzu@chromium.org> Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
Looks good,
Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:08PM +0800, Claire Chang wrote: > Add the initialization function to create restricted DMA pools from > matching reserved-memory nodes. > > Regardless of swiotlb setting, the restricted DMA pool is preferred if > available. > > The restricted DMA pools provide a basic level of protection against the > DMA overwriting buffer contents at unexpected times. However, to protect > against general data leakage and system memory corruption, the system > needs to provide a way to lock down the memory access, e.g., MPU. > > Signed-off-by: Claire Chang <tientzu@chromium.org> Looks good, Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:09PM +0800, Claire Chang wrote: > Add the functions, swiotlb_{alloc,free} to support the memory allocation > from restricted DMA pool. > > The restricted DMA pool is preferred if available. > > Note that since coherent allocation needs remapping, one must set up > another device coherent pool by shared-dma-pool and use > dma_alloc_from_dev_coherent instead for atomic coherent allocation. Note: when applied this should go before the next patch to make sure bisection works fine. > #ifdef CONFIG_DMA_RESTRICTED_POOL > +struct page *swiotlb_alloc(struct device *dev, size_t size) > +{ > + struct io_tlb_mem *mem = dev->dma_io_tlb_mem; > + phys_addr_t tlb_addr; > + int index; > + > + /* > + * Skip io_tlb_default_mem since swiotlb_alloc doesn't support atomic > + * coherent allocation. Otherwise might break existing devices. > + * One must set up another device coherent pool by shared-dma-pool and > + * use dma_alloc_from_dev_coherent instead for atomic coherent > + * allocation to avoid mempry remapping. s/mempry/memory/g Otherwise looks good: Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Jun 15, 2021 at 09:27:02PM +0800, Claire Chang wrote: > Always have the pointer to the swiotlb pool used in struct device. This > could help simplify the code for other pools. Applying: swiotlb: Set dev->dma_io_tlb_mem to the swiotlb pool used error: patch failed: kernel/dma/swiotlb.c:339 error: kernel/dma/swiotlb.c: patch does not apply .. Would you be OK rebasing this against devel/for-linus-5.14 please? (And please send out with the Reviewed-by from Christopher) Thank you! > > Signed-off-by: Claire Chang <tientzu@chromium.org> > --- > drivers/base/core.c | 4 ++++ > include/linux/device.h | 4 ++++ > kernel/dma/swiotlb.c | 8 ++++---- > 3 files changed, 12 insertions(+), 4 deletions(-) > > diff --git a/drivers/base/core.c b/drivers/base/core.c > index b8a8c96dca58..eeb2d49d3aa3 100644 > --- a/drivers/base/core.c > +++ b/drivers/base/core.c > @@ -27,6 +27,7 @@ > #include <linux/netdevice.h> > #include <linux/sched/signal.h> > #include <linux/sched/mm.h> > +#include <linux/swiotlb.h> > #include <linux/sysfs.h> > #include <linux/dma-map-ops.h> /* for dma_default_coherent */ > > @@ -2846,6 +2847,9 @@ void device_initialize(struct device *dev) > defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL) > dev->dma_coherent = dma_default_coherent; > #endif > +#ifdef CONFIG_SWIOTLB > + dev->dma_io_tlb_mem = io_tlb_default_mem; > +#endif > } > EXPORT_SYMBOL_GPL(device_initialize); > > diff --git a/include/linux/device.h b/include/linux/device.h > index 4443e12238a0..2e9a378c9100 100644 > --- a/include/linux/device.h > +++ b/include/linux/device.h > @@ -432,6 +432,7 @@ struct dev_links_info { > * @dma_pools: Dma pools (if dma'ble device). > * @dma_mem: Internal for coherent mem override. > * @cma_area: Contiguous memory area for dma allocations > + * @dma_io_tlb_mem: Pointer to the swiotlb pool used. Not for driver use. > * @archdata: For arch-specific additions. > * @of_node: Associated device tree node. > * @fwnode: Associated device node supplied by platform firmware. > @@ -540,6 +541,9 @@ struct device { > #ifdef CONFIG_DMA_CMA > struct cma *cma_area; /* contiguous memory area for dma > allocations */ > +#endif > +#ifdef CONFIG_SWIOTLB > + struct io_tlb_mem *dma_io_tlb_mem; > #endif > /* arch specific additions */ > struct dev_archdata archdata; > diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c > index 97c6ad50fdc2..949a6bb21343 100644 > --- a/kernel/dma/swiotlb.c > +++ b/kernel/dma/swiotlb.c > @@ -339,7 +339,7 @@ void __init swiotlb_exit(void) > static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t size, > enum dma_data_direction dir) > { > - struct io_tlb_mem *mem = io_tlb_default_mem; > + struct io_tlb_mem *mem = dev->dma_io_tlb_mem; > int index = (tlb_addr - mem->start) >> IO_TLB_SHIFT; > phys_addr_t orig_addr = mem->slots[index].orig_addr; > size_t alloc_size = mem->slots[index].alloc_size; > @@ -421,7 +421,7 @@ static unsigned int wrap_index(struct io_tlb_mem *mem, unsigned int index) > static int find_slots(struct device *dev, phys_addr_t orig_addr, > size_t alloc_size) > { > - struct io_tlb_mem *mem = io_tlb_default_mem; > + struct io_tlb_mem *mem = dev->dma_io_tlb_mem; > unsigned long boundary_mask = dma_get_seg_boundary(dev); > dma_addr_t tbl_dma_addr = > phys_to_dma_unencrypted(dev, mem->start) & boundary_mask; > @@ -498,7 +498,7 @@ phys_addr_t swiotlb_tbl_map_single(struct device *dev, phys_addr_t orig_addr, > size_t mapping_size, size_t alloc_size, > enum dma_data_direction dir, unsigned long attrs) > { > - struct io_tlb_mem *mem = io_tlb_default_mem; > + struct io_tlb_mem *mem = dev->dma_io_tlb_mem; > unsigned int offset = swiotlb_align_offset(dev, orig_addr); > unsigned int i; > int index; > @@ -549,7 +549,7 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr, > size_t mapping_size, enum dma_data_direction dir, > unsigned long attrs) > { > - struct io_tlb_mem *mem = io_tlb_default_mem; > + struct io_tlb_mem *mem = hwdev->dma_io_tlb_mem; > unsigned long flags; > unsigned int offset = swiotlb_align_offset(hwdev, tlb_addr); > int index = (tlb_addr - offset - mem->start) >> IO_TLB_SHIFT; > -- > 2.32.0.272.g935e593368-goog >
v11 https://lore.kernel.org/patchwork/cover/1447216/ On Tue, Jun 15, 2021 at 9:27 PM Claire Chang <tientzu@chromium.org> wrote: > > This series implements mitigations for lack of DMA access control on > systems without an IOMMU, which could result in the DMA accessing the > system memory at unexpected times and/or unexpected addresses, possibly > leading to data leakage or corruption. > > For example, we plan to use the PCI-e bus for Wi-Fi and that PCI-e bus is > not behind an IOMMU. As PCI-e, by design, gives the device full access to > system memory, a vulnerability in the Wi-Fi firmware could easily escalate > to a full system exploit (remote wifi exploits: [1a], [1b] that shows a > full chain of exploits; [2], [3]). > > To mitigate the security concerns, we introduce restricted DMA. Restricted > DMA utilizes the existing swiotlb to bounce streaming DMA in and out of a > specially allocated region and does memory allocation from the same region. > The feature on its own provides a basic level of protection against the DMA > overwriting buffer contents at unexpected times. However, to protect > against general data leakage and system memory corruption, the system needs > to provide a way to restrict the DMA to a predefined memory region (this is > usually done at firmware level, e.g. MPU in ATF on some ARM platforms [4]). > > [1a] https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html > [1b] https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html > [2] https://blade.tencent.com/en/advisories/qualpwn/ > [3] https://www.bleepingcomputer.com/news/security/vulnerabilities-found-in-highly-popular-firmware-for-wifi-chips/ > [4] https://github.com/ARM-software/arm-trusted-firmware/blob/master/plat/mediatek/mt8183/drivers/emi_mpu/emi_mpu.c#L132 > > v10: > Address the comments in v9 to > - fix the dev->dma_io_tlb_mem assignment > - propagate swiotlb_force setting into io_tlb_default_mem->force > - move set_memory_decrypted out of swiotlb_init_io_tlb_mem > - move debugfs_dir declaration into the main CONFIG_DEBUG_FS block > - add swiotlb_ prefix to find_slots and release_slots > - merge the 3 alloc/free related patches > - move the CONFIG_DMA_RESTRICTED_POOL later > > v9: > Address the comments in v7 to > - set swiotlb active pool to dev->dma_io_tlb_mem > - get rid of get_io_tlb_mem > - dig out the device struct for is_swiotlb_active > - move debugfs_create_dir out of swiotlb_create_debugfs > - do set_memory_decrypted conditionally in swiotlb_init_io_tlb_mem > - use IS_ENABLED in kernel/dma/direct.c > - fix redefinition of 'of_dma_set_restricted_buffer' > https://lore.kernel.org/patchwork/cover/1445081/ > > v8: > - Fix reserved-memory.txt and add the reg property in example. > - Fix sizeof for of_property_count_elems_of_size in > drivers/of/address.c#of_dma_set_restricted_buffer. > - Apply Will's suggestion to try the OF node having DMA configuration in > drivers/of/address.c#of_dma_set_restricted_buffer. > - Fix typo in the comment of drivers/of/address.c#of_dma_set_restricted_buffer. > - Add error message for PageHighMem in > kernel/dma/swiotlb.c#rmem_swiotlb_device_init and move it to > rmem_swiotlb_setup. > - Fix the message string in rmem_swiotlb_setup. > https://lore.kernel.org/patchwork/cover/1437112/ > > v7: > Fix debugfs, PageHighMem and comment style in rmem_swiotlb_device_init > https://lore.kernel.org/patchwork/cover/1431031/ > > v6: > Address the comments in v5 > https://lore.kernel.org/patchwork/cover/1423201/ > > v5: > Rebase on latest linux-next > https://lore.kernel.org/patchwork/cover/1416899/ > > v4: > - Fix spinlock bad magic > - Use rmem->name for debugfs entry > - Address the comments in v3 > https://lore.kernel.org/patchwork/cover/1378113/ > > v3: > Using only one reserved memory region for both streaming DMA and memory > allocation. > https://lore.kernel.org/patchwork/cover/1360992/ > > v2: > Building on top of swiotlb. > https://lore.kernel.org/patchwork/cover/1280705/ > > v1: > Using dma_map_ops. > https://lore.kernel.org/patchwork/cover/1271660/ > > > Claire Chang (12): > swiotlb: Refactor swiotlb init functions > swiotlb: Refactor swiotlb_create_debugfs > swiotlb: Set dev->dma_io_tlb_mem to the swiotlb pool used > swiotlb: Update is_swiotlb_buffer to add a struct device argument > swiotlb: Update is_swiotlb_active to add a struct device argument > swiotlb: Use is_dev_swiotlb_force for swiotlb data bouncing > swiotlb: Move alloc_size to swiotlb_find_slots > swiotlb: Refactor swiotlb_tbl_unmap_single > swiotlb: Add restricted DMA pool initialization > swiotlb: Add restricted DMA alloc/free support > dt-bindings: of: Add restricted DMA pool > of: Add plumbing for restricted DMA pool > > .../reserved-memory/reserved-memory.txt | 36 ++- > drivers/base/core.c | 4 + > drivers/gpu/drm/i915/gem/i915_gem_internal.c | 2 +- > drivers/gpu/drm/nouveau/nouveau_ttm.c | 2 +- > drivers/iommu/dma-iommu.c | 12 +- > drivers/of/address.c | 33 +++ > drivers/of/device.c | 3 + > drivers/of/of_private.h | 6 + > drivers/pci/xen-pcifront.c | 2 +- > drivers/xen/swiotlb-xen.c | 2 +- > include/linux/device.h | 4 + > include/linux/swiotlb.h | 40 ++- > kernel/dma/Kconfig | 14 + > kernel/dma/direct.c | 60 +++-- > kernel/dma/direct.h | 8 +- > kernel/dma/swiotlb.c | 255 +++++++++++++----- > 16 files changed, 380 insertions(+), 103 deletions(-) > > -- > 2.32.0.272.g935e593368-goog >