[PATCH v2] iommu/vt-d: Disable ATS support on untrusted devices

[Tyler Hicks]

On 2019-03-29 15:22:39, Aaron Ma wrote:
> From: Lu Baolu <baolu.lu at linux.intel.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/1820153
> 
> Commit fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted
> devices") disables ATS support on the devices which have been marked
> as untrusted. Unfortunately this is not enough to fix the DMA attack
> vulnerabiltiies because IOMMU driver allows translated requests as
> long as a device advertises the ATS capability. Hence a malicious
> peripheral device could use this to bypass IOMMU.
> 
> This disables the ATS support on untrusted devices by clearing the
> internal per-device ATS mark. As the result, IOMMU driver will block
> any translated requests from any device marked as untrusted.
> 
> Cc: Jacob Pan <jacob.jun.pan at linux.intel.com>
> Cc: Mika Westerberg <mika.westerberg at linux.intel.com>
> Suggested-by: Kevin Tian <kevin.tian at intel.com>
> Suggested-by: Ashok Raj <ashok.raj at intel.com>
> Fixes: fb58fdcd295b9 ("iommu/vt-d: Do not enable ATS for untrusted devices")
> Signed-off-by: Lu Baolu <baolu.lu at linux.intel.com>
> Signed-off-by: Joerg Roedel <jroedel at suse.de>
> (cherry picked from commit d8b8591054575f33237556c32762d54e30774d28)
> Signed-off-by: Aaron Ma <aaron.ma at canonical.com>

Acked-by: Tyler Hicks <tyhicks at canonical.com>

Thanks for sending this one along, too.

Tyler

> ---
>  drivers/iommu/intel-iommu.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
> index 1c72434af56d..5ade9ac6d3e8 100644
> --- a/drivers/iommu/intel-iommu.c
> +++ b/drivers/iommu/intel-iommu.c
> @@ -2518,7 +2518,8 @@ static struct dmar_domain *dmar_insert_one_dev_info(struct intel_iommu *iommu,
>  	if (dev && dev_is_pci(dev)) {
>  		struct pci_dev *pdev = to_pci_dev(info->dev);
>  
> -		if (!pci_ats_disabled() &&
> +		if (!pdev->untrusted &&
> +		    !pci_ats_disabled() &&
>  		    ecap_dev_iotlb_support(iommu->ecap) &&
>  		    pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ATS) &&
>  		    dmar_find_matched_atsr_unit(pdev))
> -- 
> 2.17.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team