ACK/Cmnt: [PATCH 0/5] [Cosmic] iommu: add kernel dma protection

[Stefan Bader]

On 15.03.19 06:07, Aaron Ma wrote:
> BugLink: https://bugs.launchpad.net/bugs/1820153
> 
> [Impact]
> OS can use IOMMU to defend against DMA attacks from a PCI device like thunderbolt one.
> Intel adds DMA_CTRL_PLATFORM_OPT_IN_FLAG flag in DMAR ACPI table.
> Use this flag to enable IOMMU and use _DSD to identify untrusted PCI devices.
> 
> [Fix]
> Enable IOMMU when BIOS supports DMA opt in flag and ExternalFacingPort in _DSD.
> Disable ATS on the untrusted PCI device.
> 
> [Test]
> Tested on 2 Intel platforms that supports DMA opt in flag with a thunderbolt dock station.
> iommu enabled as expected with this fix.
> 
> [Regression Potential]
> Upstream fix, Verified on supported platforms, no affection on not supported platforms.
> Backported changes are fairly minimal.
> 
> These patches are included in 5.0 kernel, disco is good.
> 
> Lu Baolu (1):
>   iommu/vt-d: Force IOMMU on for platform opt in hint
> 
> Mika Westerberg (4):
>   ACPI / property: Allow multiple property compatible _DSD entries
>   PCI / ACPI: Identify untrusted PCI devices
>   iommu/vt-d: Do not enable ATS for untrusted devices
>   thunderbolt: Export IOMMU based DMA protection support to userspace
> 
>  .../ABI/testing/sysfs-bus-thunderbolt         |   9 ++
>  Documentation/admin-guide/thunderbolt.rst     |  20 ++++
>  drivers/acpi/property.c                       | 105 +++++++++++++-----
>  drivers/acpi/x86/apple.c                      |   2 +-
>  drivers/gpio/gpiolib-acpi.c                   |   2 +-
>  drivers/iommu/dmar.c                          |  25 +++++
>  drivers/iommu/intel-iommu.c                   |  56 +++++++++-
>  drivers/pci/pci-acpi.c                        |  19 ++++
>  drivers/pci/probe.c                           |  15 +++
>  drivers/thunderbolt/domain.c                  |  17 +++
>  include/acpi/acpi_bus.h                       |   8 +-
>  include/linux/acpi.h                          |   9 ++
>  include/linux/dmar.h                          |   8 ++
>  include/linux/pci.h                           |   8 ++
>  14 files changed, 271 insertions(+), 32 deletions(-)
> 
For SRU this set looks rather intrusive without a clear statement about the
reasons why one would want it backported. Usually a SRU change should fix a bug.
This change looks like adding a feature, though I might accept certain reasons
why this might be wanted.
For Cosmic, I would accept this as is, for Bionic (which looks to be targeted,
too, looking at the bug report) I would want to see a bit more reasons and also
some positive testing reported on platforms which have no support for this (to
explicitly check there are no side effects).

Acked-by: Stefan Bader <stefan.bader at canonical.com>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20190328/d6c46d11/attachment.sig>