| Message ID | 1553845052-22422-2-git-send-email-aaron.ma@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | iommu: add kernel dma protection | expand |
On 2019-03-29 15:37:32, Aaron Ma wrote: > From: Lu Baolu <baolu.lu@linux.intel.com> > > BugLink: https://bugs.launchpad.net/bugs/1820153 > > Commit fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted > devices") disables ATS support on the devices which have been marked > as untrusted. Unfortunately this is not enough to fix the DMA attack > vulnerabiltiies because IOMMU driver allows translated requests as > long as a device advertises the ATS capability. Hence a malicious > peripheral device could use this to bypass IOMMU. > > This disables the ATS support on untrusted devices by clearing the > internal per-device ATS mark. As the result, IOMMU driver will block > any translated requests from any device marked as untrusted. > > Cc: Jacob Pan <jacob.jun.pan@linux.intel.com> > Cc: Mika Westerberg <mika.westerberg@linux.intel.com> > Suggested-by: Kevin Tian <kevin.tian@intel.com> > Suggested-by: Ashok Raj <ashok.raj@intel.com> > Fixes: fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted devices") > Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> > Signed-off-by: Joerg Roedel <jroedel@suse.de> > (cherry picked from commit d8b8591054575f33237556c32762d54e30774d28) > Signed-off-by: Aaron Ma <aaron.ma@canonical.com> Acked-by: Tyler Hicks <tyhicks@canonical.com> Tyler > --- > drivers/iommu/intel-iommu.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c > index 26cc7a82cf0f..75615673b7d2 100644 > --- a/drivers/iommu/intel-iommu.c > +++ b/drivers/iommu/intel-iommu.c > @@ -2460,7 +2460,8 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu, > if (dev && dev_is_pci(dev)) { > struct pci_dev *pdev = to_pci_dev(info->dev); > > - if (!pci_ats_disabled() && > + if (!pdev->untrusted && > + !pci_ats_disabled() && > ecap_dev_iotlb_support(iommu->ecap) && > pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ATS) && > dmar_find_matched_atsr_unit(pdev)) > -- > 2.17.1 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team
Applied patch 8/8 to Bionic-oem. Patch 7/8 is already in bionic-oem, as commit 99d82d3781f82570a9f443c95f628ebf06da41b2 which was part of the upstream stable patchset from https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1814813 On 2019-03-29 15:37:32 , Aaron Ma wrote: > From: Lu Baolu <baolu.lu@linux.intel.com> > > BugLink: https://bugs.launchpad.net/bugs/1820153 > > Commit fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted > devices") disables ATS support on the devices which have been marked > as untrusted. Unfortunately this is not enough to fix the DMA attack > vulnerabiltiies because IOMMU driver allows translated requests as > long as a device advertises the ATS capability. Hence a malicious > peripheral device could use this to bypass IOMMU. > > This disables the ATS support on untrusted devices by clearing the > internal per-device ATS mark. As the result, IOMMU driver will block > any translated requests from any device marked as untrusted. > > Cc: Jacob Pan <jacob.jun.pan@linux.intel.com> > Cc: Mika Westerberg <mika.westerberg@linux.intel.com> > Suggested-by: Kevin Tian <kevin.tian@intel.com> > Suggested-by: Ashok Raj <ashok.raj@intel.com> > Fixes: fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted devices") > Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> > Signed-off-by: Joerg Roedel <jroedel@suse.de> > (cherry picked from commit d8b8591054575f33237556c32762d54e30774d28) > Signed-off-by: Aaron Ma <aaron.ma@canonical.com> > --- > drivers/iommu/intel-iommu.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c > index 26cc7a82cf0f..75615673b7d2 100644 > --- a/drivers/iommu/intel-iommu.c > +++ b/drivers/iommu/intel-iommu.c > @@ -2460,7 +2460,8 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu, > if (dev && dev_is_pci(dev)) { > struct pci_dev *pdev = to_pci_dev(info->dev); > > - if (!pci_ats_disabled() && > + if (!pdev->untrusted && > + !pci_ats_disabled() && > ecap_dev_iotlb_support(iommu->ecap) && > pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ATS) && > dmar_find_matched_atsr_unit(pdev)) > -- > 2.17.1 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c index 26cc7a82cf0f..75615673b7d2 100644 --- a/drivers/iommu/intel-iommu.c +++ b/drivers/iommu/intel-iommu.c @@ -2460,7 +2460,8 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu, if (dev && dev_is_pci(dev)) { struct pci_dev *pdev = to_pci_dev(info->dev); - if (!pci_ats_disabled() && + if (!pdev->untrusted && + !pci_ats_disabled() && ecap_dev_iotlb_support(iommu->ecap) && pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ATS) && dmar_find_matched_atsr_unit(pdev))