From patchwork Tue Apr 26 00:06:39 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rajat Jain X-Patchwork-Id: 12826369 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98F7EC433F5 for ; Tue, 26 Apr 2022 00:06:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239146AbiDZAJv (ORCPT ); Mon, 25 Apr 2022 20:09:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58538 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229658AbiDZAJu (ORCPT ); Mon, 25 Apr 2022 20:09:50 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4F73120111 for ; Mon, 25 Apr 2022 17:06:44 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id h14-20020a25e20e000000b006484e4a1da2so4429745ybe.9 for ; Mon, 25 Apr 2022 17:06:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=EQ6VT6w46Hd44XRTan9TInx0ubvgoNtxDCqLgonw/Fw=; b=HS1HO9FzmdSJFLMep5JjzcdD/vAauAAiJdJtzVrco1UZk50LeqYCzwhWCfRJZ34zuo qofqkRZyy6+RFdFh2w+QDW8VSe7d6xxNp46ta/i+iF8YOjRw3+5tLbnRtaro28Cio8o4 OiNAeSDzHohgt4vbhCl/9Wvc9F6y3USITzJ10+JX+o97t3jdebP1nHALnKme07MYlKGU mxH/cmQgkqRAOh5TyDU0LaZ+kzTDPONTBv2KsgkeszUMtpbaBxIlgTjQx1ZHJGgr9rAO X8d6uZP7cZOeMc6TODikbj71Y+Li4qUszasbi90W6haTph6MsBXtG6XPJ0xdp8YxPd40 2tBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=EQ6VT6w46Hd44XRTan9TInx0ubvgoNtxDCqLgonw/Fw=; b=fwwGtEdQ8voBrAw5vLprmnxoqakI7B0ec3K+cqeUcPt0BwpiT7zGfd0HzYAHbfASRx nFrSQxVpZV+ujPVPsYevB70QbujVkvwwyUkzkTqzrkXRg7hnpp6BKyEBKyPvRBAPe4wX 0KcTQhvVGSxSR4ISv7t7ky6oWgzPvGGlDoQTrG5mb7y1PVHJ1ixjK5wdgX8+vKjpj8TD QUsiHdmBXkZ+7t71eikJqFbToJQsEyg5pUoko0db+BpEp+IqUvqImIVSJizVTvAjxjRE vKTkFlG+YYp771EJa77hK1RenRJFk3r4kAngYaHXdjsRepsY6NPkXe/Q/1TArvSyXY8w vrew== X-Gm-Message-State: AOAM532X3fkMrP71LzfEsxWtxhWflgLZzkuMDt5kxJaTq68CE4KAWC6B d8ai+A/vEPlb6KjXVPAHCBR3z+ut4njv X-Google-Smtp-Source: ABdhPJwNNzWNR0miZ2gObmHApAL+Qq+RPW++GHIubAxH7gus9hz33wGevQAaQAJC9bdTGWNEfprWQMSD7v1q X-Received: from rajat2.mtv.corp.google.com ([2620:15c:202:201:9590:6ed7:be38:9068]) (user=rajatja job=sendgmr) by 2002:a25:f30f:0:b0:648:6d75:614 with SMTP id c15-20020a25f30f000000b006486d750614mr6652624ybs.558.1650931604103; Mon, 25 Apr 2022 17:06:44 -0700 (PDT) Date: Mon, 25 Apr 2022 17:06:39 -0700 Message-Id: <20220426000640.3581446-1-rajatja@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.36.0.rc2.479.g8af0fa9b8e-goog Subject: [PATCH v6 1/2] PCI/ACPI: Support Microsoft's "DmaProperty" From: Rajat Jain To: "Rafael J. Wysocki" , Len Brown , linux-pci@vger.kernel.org, Mika Westerberg , Greg Kroah-Hartman , Bjorn Helgaas , Bjorn Helgaas , ACPI Devel Maling List , Linux Kernel Mailing List , Rajat Jain , Dmitry Torokhov , Jesse Barnes , Jean-Philippe Brucker , Pavel Machek , "Oliver O'Halloran" , Joerg Roedel , Will Deacon , David Woodhouse , Lu Baolu , iommu@lists.linux-foundation.org Cc: Rajat Jain , "Rafael J . Wysocki" Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org The "DmaProperty" is supported and currently documented and used by Microsoft [link 1 below], to flag internal PCIe root ports that need DMA protection [link 2 below]. We have discussed with them and reached a common understanding that they shall change their MSDN documentation to say that the same property can be used to protect any PCI device, and not just internal PCIe root ports (since there is no point introducing yet another property for arbitrary PCI devices). This helps with security from internal devices that offer an attack surface for DMA attacks (e.g. internal network devices). Support DmaProperty to mark DMA from a PCI device as untrusted. Link: [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-internal-pcie-ports-accessible-to-users-and-requiring-dma-protection Link: [2] https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt Signed-off-by: Rajat Jain Reviewed-by: Mika Westerberg Acked-by: Rafael J. Wysocki --- v6: * Take care of Bjorn's comments: - Update the commit log - Rename to pci_dev_has_dma_property() - Use acpi_dev_get_property() v5: * Reorder the patches in the series v4: * Add the GUID. * Update the comment and commitlog. v3: * Use Microsoft's documented property "DmaProperty" * Resctrict to ACPI only drivers/acpi/property.c | 3 +++ drivers/pci/pci-acpi.c | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c index 12bbfe833609..bafe35c301ac 100644 --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -48,6 +48,9 @@ static const guid_t prp_guids[] = { /* Storage device needs D3 GUID: 5025030f-842f-4ab4-a561-99a5189762d0 */ GUID_INIT(0x5025030f, 0x842f, 0x4ab4, 0xa5, 0x61, 0x99, 0xa5, 0x18, 0x97, 0x62, 0xd0), + /* DmaProperty for PCI devices GUID: 70d24161-6dd5-4c9e-8070-705531292865 */ + GUID_INIT(0x70d24161, 0x6dd5, 0x4c9e, + 0x80, 0x70, 0x70, 0x55, 0x31, 0x29, 0x28, 0x65), }; /* ACPI _DSD data subnodes GUID: dbb8e3e6-5886-4ba6-8795-1319f52a966b */ diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c index 3ae435beaf0a..d7c6ba48486f 100644 --- a/drivers/pci/pci-acpi.c +++ b/drivers/pci/pci-acpi.c @@ -1369,12 +1369,33 @@ static void pci_acpi_set_external_facing(struct pci_dev *dev) dev->external_facing = 1; } +static int pci_dev_has_dma_property(struct pci_dev *dev) +{ + struct acpi_device *adev; + const union acpi_object *obj; + + adev = ACPI_COMPANION(&dev->dev); + if (!adev) + return 0; + + /* + * Property also used by Microsoft Windows for same purpose, + * (to implement DMA protection from a device, using the IOMMU). + */ + if (!acpi_dev_get_property(adev, "DmaProperty", ACPI_TYPE_INTEGER, + &obj) && obj->integer.value == 1) + return 1; + + return 0; +} + void pci_acpi_setup(struct device *dev, struct acpi_device *adev) { struct pci_dev *pci_dev = to_pci_dev(dev); pci_acpi_optimize_delay(pci_dev, adev->handle); pci_acpi_set_external_facing(pci_dev); + pci_dev->untrusted |= pci_dev_has_dma_property(pci_dev); pci_acpi_add_edr_notifier(pci_dev); pci_acpi_add_pm_notifier(adev, pci_dev); From patchwork Tue Apr 26 00:06:40 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rajat Jain X-Patchwork-Id: 12826370 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A53CC433EF for ; Tue, 26 Apr 2022 00:06:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239243AbiDZAJ7 (ORCPT ); Mon, 25 Apr 2022 20:09:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233780AbiDZAJx (ORCPT ); Mon, 25 Apr 2022 20:09:53 -0400 Received: from mail-yw1-x114a.google.com (mail-yw1-x114a.google.com [IPv6:2607:f8b0:4864:20::114a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3747F1132F1 for ; Mon, 25 Apr 2022 17:06:47 -0700 (PDT) Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-2f7ee6bc6ddso33685367b3.1 for ; Mon, 25 Apr 2022 17:06:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=cwrp6c+6yQjWeAanWYwByt5L1qXZBmxvZVLudkp+yA4=; b=CkWTK3FrWc7tiCvZVSVqy6H/mwmZlC8sMUfaNDSuR6ISQOldgWdGVYbR1X4sNYj2mz 2Y3KuX4BO6mLGtKlfEdITWx39bq14Si3HJe+jKzCi20hxRbLLk49SMJ8H2HMgsWoigJA qNZ1JSl8F2bidHDj3HqNM+tlZVOryeCag4Qq9IjvORre9b5ZJVoiAg2BzzMhsiC3xoHU ERK+3fCGyA242r9DuSIcFZMkorIH7Kgn1Xw8VILHCSs3NEPFjTAYlbC7pn3g5NCR+RIt Ies+chN6RzkmTpzuvOlHu2ubyDLd0PTGNDECDBN82f1nngyfp2VeVo/M2jyTIY88qSYF w9hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=cwrp6c+6yQjWeAanWYwByt5L1qXZBmxvZVLudkp+yA4=; b=rkUnHS/cZtLQPtPDsLmb6WKo9PKEz3S4fayyKd1qs2T/wAqA1NTclaSrRlv4I+KVij IthwenYnqwifL7t8sxhSUr7VuFyO0cmBj9wSq4RQmiiEDDMvs2WmX0sL5tRcFpum11w/ GzspDGmrpBvqgkQ+ARi9E+zysnnpV6RiWAsbnhJQZ5QZIML2isaA/5NotH5gFGTTRcmq FrRXL2YSm9f9WunzTeK7jOvK+mXoeyQ93MK7W3nqJzaUKb0Ix7vKte439oN3NKBSQ1zm VMRLe4uFr5hjKiDlApPL1iZRlVGTGAF/Z+QB0KlgjzJ0VhB19Lmym6/Mhq8NriOWDSGl Dqsw== X-Gm-Message-State: AOAM533tckc7cZ5wmrm5SJLuOFnsKfrEc3NSw1XQAR6v+rh37tXQOIN/ yWjx7+2zrwQV9mF/C1beE4wI9uEf25bj X-Google-Smtp-Source: ABdhPJyFE+J9te+rMsUNH2mbMwZ+bBPuUAixlAHALiAHUjzOMrupX/5Js7LMsK5uQMClp7LDWcmxL3otROjH X-Received: from rajat2.mtv.corp.google.com ([2620:15c:202:201:9590:6ed7:be38:9068]) (user=rajatja job=sendgmr) by 2002:a25:508e:0:b0:648:3cc1:76b5 with SMTP id e136-20020a25508e000000b006483cc176b5mr11271557ybb.286.1650931606469; Mon, 25 Apr 2022 17:06:46 -0700 (PDT) Date: Mon, 25 Apr 2022 17:06:40 -0700 In-Reply-To: <20220426000640.3581446-1-rajatja@google.com> Message-Id: <20220426000640.3581446-2-rajatja@google.com> Mime-Version: 1.0 References: <20220426000640.3581446-1-rajatja@google.com> X-Mailer: git-send-email 2.36.0.rc2.479.g8af0fa9b8e-goog Subject: [PATCH v6 2/2] PCI: Rename pci_dev->untrusted to pci_dev->untrusted_dma From: Rajat Jain To: "Rafael J. Wysocki" , Len Brown , linux-pci@vger.kernel.org, Mika Westerberg , Greg Kroah-Hartman , Bjorn Helgaas , Bjorn Helgaas , ACPI Devel Maling List , Linux Kernel Mailing List , Rajat Jain , Dmitry Torokhov , Jesse Barnes , Jean-Philippe Brucker , Pavel Machek , "Oliver O'Halloran" , Joerg Roedel , Will Deacon , David Woodhouse , Lu Baolu , iommu@lists.linux-foundation.org Cc: Rajat Jain , "Rafael J . Wysocki" Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org Rename the field to make it more clear, that the device can execute DMA attacks on the system, and thus the system may need protection from such attacks from this device. No functional change intended. Signed-off-by: Rajat Jain Reviewed-by: Mika Westerberg Acked-by: Rafael J. Wysocki Reviewed-by: Lu Baolu --- v6: No change in this patch, rebased on top of changes in other patch. v5: Use "untrusted_dma" as property name, based on feedback. Reorder the patches in the series. v4: Initial version, created based on comments on other patch drivers/iommu/dma-iommu.c | 6 +++--- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/pci/ats.c | 2 +- drivers/pci/pci-acpi.c | 2 +- drivers/pci/pci.c | 2 +- drivers/pci/probe.c | 8 ++++---- drivers/pci/quirks.c | 2 +- include/linux/pci.h | 5 +++-- 9 files changed, 16 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 09f6e1c0f9c0..aeee4be7614d 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -497,14 +497,14 @@ static int iova_reserve_iommu_regions(struct device *dev, return ret; } -static bool dev_is_untrusted(struct device *dev) +static bool dev_has_untrusted_dma(struct device *dev) { - return dev_is_pci(dev) && to_pci_dev(dev)->untrusted; + return dev_is_pci(dev) && to_pci_dev(dev)->untrusted_dma; } static bool dev_use_swiotlb(struct device *dev) { - return IS_ENABLED(CONFIG_SWIOTLB) && dev_is_untrusted(dev); + return IS_ENABLED(CONFIG_SWIOTLB) && dev_has_untrusted_dma(dev); } /** diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index df5c62ecf942..b88f47391140 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4843,7 +4843,7 @@ static bool intel_iommu_is_attach_deferred(struct device *dev) */ static bool risky_device(struct pci_dev *pdev) { - if (pdev->untrusted) { + if (pdev->untrusted_dma) { pci_info(pdev, "Skipping IOMMU quirk for dev [%04X:%04X] on untrusted PCI link\n", pdev->vendor, pdev->device); diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index f2c45b85b9fc..d8d3133e2947 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -1525,7 +1525,7 @@ static int iommu_get_def_domain_type(struct device *dev) { const struct iommu_ops *ops = dev_iommu_ops(dev); - if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted) + if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted_dma) return IOMMU_DOMAIN_DMA; if (ops->def_domain_type) diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c index c967ad6e2626..477c16ba9341 100644 --- a/drivers/pci/ats.c +++ b/drivers/pci/ats.c @@ -42,7 +42,7 @@ bool pci_ats_supported(struct pci_dev *dev) if (!dev->ats_cap) return false; - return (dev->untrusted == 0); + return (dev->untrusted_dma == 0); } EXPORT_SYMBOL_GPL(pci_ats_supported); diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c index d7c6ba48486f..7c2784e7e954 100644 --- a/drivers/pci/pci-acpi.c +++ b/drivers/pci/pci-acpi.c @@ -1395,7 +1395,7 @@ void pci_acpi_setup(struct device *dev, struct acpi_device *adev) pci_acpi_optimize_delay(pci_dev, adev->handle); pci_acpi_set_external_facing(pci_dev); - pci_dev->untrusted |= pci_dev_has_dma_property(pci_dev); + pci_dev->untrusted_dma |= pci_dev_has_dma_property(pci_dev); pci_acpi_add_edr_notifier(pci_dev); pci_acpi_add_pm_notifier(adev, pci_dev); diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 9ecce435fb3f..1fb0eb8646c8 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -958,7 +958,7 @@ static void pci_std_enable_acs(struct pci_dev *dev) ctrl |= (cap & PCI_ACS_UF); /* Enable Translation Blocking for external devices and noats */ - if (pci_ats_disabled() || dev->external_facing || dev->untrusted) + if (pci_ats_disabled() || dev->external_facing || dev->untrusted_dma) ctrl |= (cap & PCI_ACS_TB); pci_write_config_word(dev, pos + PCI_ACS_CTRL, ctrl); diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index 17a969942d37..d2a9b26fcede 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1587,7 +1587,7 @@ static void set_pcie_thunderbolt(struct pci_dev *dev) dev->is_thunderbolt = 1; } -static void set_pcie_untrusted(struct pci_dev *dev) +static void pci_set_untrusted_dma(struct pci_dev *dev) { struct pci_dev *parent; @@ -1596,8 +1596,8 @@ static void set_pcie_untrusted(struct pci_dev *dev) * untrusted as well. */ parent = pci_upstream_bridge(dev); - if (parent && (parent->untrusted || parent->external_facing)) - dev->untrusted = true; + if (parent && (parent->untrusted_dma || parent->external_facing)) + dev->untrusted_dma = true; } static void pci_set_removable(struct pci_dev *dev) @@ -1862,7 +1862,7 @@ int pci_setup_device(struct pci_dev *dev) /* Need to have dev->cfg_size ready */ set_pcie_thunderbolt(dev); - set_pcie_untrusted(dev); + pci_set_untrusted_dma(dev); /* "Unknown power state" */ dev->current_state = PCI_UNKNOWN; diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 41aeaa235132..583d35968413 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -5135,7 +5135,7 @@ static int pci_quirk_enable_intel_spt_pch_acs(struct pci_dev *dev) ctrl |= (cap & PCI_ACS_CR); ctrl |= (cap & PCI_ACS_UF); - if (pci_ats_disabled() || dev->external_facing || dev->untrusted) + if (pci_ats_disabled() || dev->external_facing || dev->untrusted_dma) ctrl |= (cap & PCI_ACS_TB); pci_write_config_dword(dev, pos + INTEL_SPT_ACS_CTRL, ctrl); diff --git a/include/linux/pci.h b/include/linux/pci.h index 60adf42460ab..2453a794bdb2 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -444,13 +444,14 @@ struct pci_dev { unsigned int shpc_managed:1; /* SHPC owned by shpchp */ unsigned int is_thunderbolt:1; /* Thunderbolt controller */ /* - * Devices marked being untrusted are the ones that can potentially + * Devices marked with untrusted_dma are the ones that can potentially * execute DMA attacks and similar. They are typically connected * through external ports such as Thunderbolt but not limited to * that. When an IOMMU is enabled they should be getting full * mappings to make sure they cannot access arbitrary memory. */ - unsigned int untrusted:1; + unsigned int untrusted_dma:1; + /* * Info from the platform, e.g., ACPI or device tree, may mark a * device as "external-facing". An external-facing device is