On Fri, Oct 14, 2022 at 03:25:41PM -0700, Fenghua Yu wrote:
> When the idxd_user_drv driver is bound to a Work Queue (WQ) device
> without IOMMU or with IOMMU Passthrough without Shared Virtual
> Addressing (SVA), the application gains direct access to physical
> memory via the device by programming physical address to a submitted
> descriptor. This allows direct userspace read and write access to
> arbitrary physical memory. This is inconsistent with the security
> goals of a good kernel API.
>
> Unlike vfio_pci driver, the IDXD char device driver does not provide any
> ways to pin user pages and translate the address from user VA to IOVA or
> PA without IOMMU SVA. Therefore the application has no way to instruct the
> device to perform DMA function. This makes the char device not usable for
> normal application usage.
>
> Since user type WQ without SVA cannot be used for normal application usage
> and presents the security issue, bind idxd_user_drv driver and enable user
> type WQ only when SVA is enabled (i.e. user PASID is enabled).
>
> Fixes: 448c3de8ac83 ("dmaengine: idxd: create user driver for wq 'device'")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Arjan Van De Ven <arjan.van.de.ven@xxxxxxxxx>
> Signed-off-by: Fenghua Yu <fenghua.yu@xxxxxxxxx>
> Reviewed-by: Dave Jiang <dave.jiang@xxxxxxxxx>
Reviewed-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> ---
> v2:
> - Update changlog per Dave Hansen's comments
>
> drivers/dma/idxd/cdev.c | 18 ++++++++++++++++++
> include/uapi/linux/idxd.h | 1 +
> 2 files changed, 19 insertions(+)
>
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index c2808fd081d6..a9b96b18772f 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -312,6 +312,24 @@ static int idxd_user_drv_probe(struct idxd_dev *idxd_dev)
> if (idxd->state != IDXD_DEV_ENABLED)
> return -ENXIO;
>
> + /*
> + * User type WQ is enabled only when SVA is enabled for two reasons:
> + * - If no IOMMU or IOMMU Passthrough without SVA, userspace
> + * can directly access physical address through the WQ.
> + * - The IDXD cdev driver does not provide any ways to pin
> + * user pages and translate the address from user VA to IOVA or
> + * PA without IOMMU SVA. Therefore the application has no way
> + * to instruct the device to perform DMA function. This makes
> + * the cdev not usable for normal application usage.
> + */
> + if (!device_user_pasid_enabled(idxd)) {
> + idxd->cmd_status = IDXD_SCMD_WQ_USER_NO_IOMMU;
> + dev_dbg(&idxd->pdev->dev,
> + "User type WQ cannot be enabled without SVA.\n");
> +
> + return -EOPNOTSUPP;
> + }
> +
> mutex_lock(&wq->wq_lock);
> wq->type = IDXD_WQT_USER;
> rc = drv_enable_wq(wq);
> diff --git a/include/uapi/linux/idxd.h b/include/uapi/linux/idxd.h
> index 095299c75828..2b9e7feba3f3 100644
> --- a/include/uapi/linux/idxd.h
> +++ b/include/uapi/linux/idxd.h
> @@ -29,6 +29,7 @@ enum idxd_scmd_stat {
> IDXD_SCMD_WQ_NO_SIZE = 0x800e0000,
> IDXD_SCMD_WQ_NO_PRIV = 0x800f0000,
> IDXD_SCMD_WQ_IRQ_ERR = 0x80100000,
> + IDXD_SCMD_WQ_USER_NO_IOMMU = 0x80110000,
> };
>
> #define IDXD_SCMD_SOFTERR_MASK 0x80000000
> --
> 2.32.0
>
