On 2021-11-15 13:31, Jason Gunthorpe via iommu wrote:
On Mon, Nov 15, 2021 at 05:21:26AM -0800, Christoph Hellwig wrote:
On Mon, Nov 15, 2021 at 10:05:44AM +0800, Lu Baolu wrote:
pci_stub allows the admin to block driver binding on a device and make
it permanently shared with userspace. Since pci_stub does not do DMA,
it is safe.
If an IOMMU is setup and dma-iommu or friends are not used nothing is
unsafe anyway, it just is that IOMMU won't work..
However the admin must understand that using pci_stub allows
userspace to attack whatever device it was bound to.
I don't understand this sentence at all.
If userspace has control of device A and can cause A to issue DMA to
arbitary DMA addresses then there are certain PCI topologies where A
can now issue peer to peer DMA and manipulate the MMMIO registers in
device B.
A kernel driver on device B is thus subjected to concurrent
manipulation of the device registers from userspace.
So, a 'safe' kernel driver is one that can tolerate this, and an
'unsafe' driver is one where userspace can break kernel integrity.
You mean in the case where the kernel driver is trying to use device B
in a purely PIO mode, such that userspace might potentially be able to
interfere with data being transferred in and out of the kernel? Perhaps
it's not so clear to put that under a notion of "DMA ownership", since
device B's DMA is irrelevant and it's really much more equivalent to
/dev/mem access or mmaping BARs to userspace while a driver is bound.
The second issue is DMA - because there is only one iommu_domain
underlying many devices if we give that iommu_domain to userspace it
means the kernel DMA API on other devices no longer works.
Actually, the DMA API itself via iommu-dma will "work" just fine in the
sense that it will still successfully perform all its operations in the
unattached default domain, it's just that if the driver then programs
the device to access the returned DMA address, the device is likely to
get a nasty surprise.
So no kernel driver doing DMA can work at all, under any PCI topology,
if userspace owns the IO page table.
This isn't really about userspace at all - it's true of any case where a
kernel driver wants to attach a grouped device to its own unmanaged
domain. The fact that the VFIO kernel driver uses its unmanaged domains
to map user pages upon user requests is merely a VFIO detail, and VFIO
happens to be the only common case where unmanaged domains and
non-singleton groups intersect. I'd say that, logically, if you want to
put policy on mutual driver/usage compatibility anywhere it should be in
iommu_attach_group().
Robin.
