From patchwork Tue Jun 7 14:30:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Marek_Marczykowski-G=C3=B3recki?= X-Patchwork-Id: 12872013 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0F9CFCCA47E for ; Tue, 7 Jun 2022 14:31:40 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.343354.568760 (Exim 4.92) (envelope-from ) id 1nyaEy-0000C5-N0; Tue, 07 Jun 2022 14:31:28 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 343354.568760; Tue, 07 Jun 2022 14:31:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nyaEy-0000B4-EX; Tue, 07 Jun 2022 14:31:28 +0000 Received: by outflank-mailman (input) for mailman id 343354; Tue, 07 Jun 2022 14:31:26 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nyaEw-000619-K1 for xen-devel@lists.xenproject.org; Tue, 07 Jun 2022 14:31:26 +0000 Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 823b965b-e66e-11ec-bd2c-47488cf2e6aa; Tue, 07 Jun 2022 16:31:25 +0200 (CEST) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id D8C015C01A9; Tue, 7 Jun 2022 10:31:24 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute2.internal (MEProxy); Tue, 07 Jun 2022 10:31:24 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 7 Jun 2022 10:31:23 -0400 (EDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 823b965b-e66e-11ec-bd2c-47488cf2e6aa DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1654612284; x=1654698684; bh=bVSELf5uLQ 6uKc/B+4q8TUi8lxYysoFD6qxpJaiy/dU=; b=XVGLR8gbDGDMJ01qLDdQa2s0RW bwVjQzaCsTdHatp1qUKzzjlbTwJBKXg25OCF8wYvZoSvKl2f0VECtYye3DpnBRPu bwqERkdJ/khzDWLbSUPfEgy99MlYjf2jxwzfvzx7h3FquGFG2jhHjRF70K6vtGag ayYkckmyyfCZHRWYSi4EXr0Wiq7h38KIV6kapI6wxAqwCTeVm3B6jUdfKHPMpiWu bVhxKOctQKzqe7gnWHNE97EeRaHp5DMtQCO/hxvP2N8B56SDWLV/fGtMALZLjUQZ LdDK9KL+XOSGIRbglmwISUMKXVsrglYW4cK8nHHudh7voVstTI80rKYKDYHQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1654612284; x= 1654698684; bh=bVSELf5uLQ6uKc/B+4q8TUi8lxYysoFD6qxpJaiy/dU=; b=S 29bcsaAtrem1xMhKQHKkXzBYB57nkIGxGhCiFTiin1F7h/K0pUe6G8mMH62j1zuC kON8mTJN0pcJPMODq6oAaPudqfOeWpc02sNX9vpBFD5qGlwlI+X3wCNYR+scmnhA l6FC3IBFIrz3g9/j3l7vrZ+YvRF7g1Nj39yiLG/iYe45ymogY0ZFplYnQw/23Rej m8MbDF40qsRSCYR4LScwt+2YX0oYfSO617v7EwUgegQER+t8wbH3tLyaL5VRDpuF hX6OzsaTnNrpp/FXe4dQzBSeirp6mPZos/WvDk+kxq/8pcfNqLk+vR2YGiU5gGvT xWL8L684T7FmSsLoRdjog== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvfedruddthedgjeeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhephffvvefufffkofgjfhggtgfgsehtkeertdertdejnecuhfhrohhmpeforghr vghkucforghrtgiihihkohifshhkihdqifpkrhgvtghkihcuoehmrghrmhgrrhgvkhesih hnvhhishhisghlvghthhhinhhgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpefg ueduhefgvdefheehudejheefudevueeghfekhfehleegveduteeuiedugffgffenucevlh hushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmrghrmhgrrhgv khesihhnvhhishhisghlvghthhhinhhgshhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: i1568416f:Fastmail From: =?utf-8?q?Marek_Marczykowski-G=C3=B3recki?= To: xen-devel@lists.xenproject.org Cc: =?utf-8?q?Marek_Marczykowski-G=C3=B3recki?= , Andrew Cooper , George Dunlap , Jan Beulich , Julien Grall , Stefano Stabellini , Wei Liu , Kevin Tian Subject: [PATCH v1 09/10] xue: mark DMA buffers as reserved for the device Date: Tue, 7 Jun 2022 16:30:15 +0200 Message-Id: X-Mailer: git-send-email 2.35.3 In-Reply-To: References: MIME-Version: 1.0 The important part is to include those buffers in IOMMU page table relevant for the USB controller. Otherwise, DbC will stop working as soon as IOMMU is enabled, regardless of to which domain device assigned (be it xen or dom0). If the device is passed through to dom0 or other domain (see later patches), that domain will effectively have access to those buffers too. It does give such domain yet another way to DoS the system (as is the case when having PCI device assigned already), but also possibly steal the console ring content. Thus, such domain should be a trusted one. In any case, prevent anything else being placed on those pages by adding artificial padding. Using this API for DbC pages requires raising MAX_USER_RMRR_PAGES. Signed-off-by: Marek Marczykowski-Górecki --- xen/drivers/char/xue.c | 45 ++++++++++++++++++++----------- xen/drivers/passthrough/vtd/dmar.c | 2 +- 2 files changed, 31 insertions(+), 16 deletions(-) diff --git a/xen/drivers/char/xue.c b/xen/drivers/char/xue.c index b253426a95f8..6fd26c3d38a8 100644 --- a/xen/drivers/char/xue.c +++ b/xen/drivers/char/xue.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include @@ -995,13 +996,21 @@ static struct uart_driver xue_uart_driver = { .getc = NULL }; -static struct xue_trb evt_trb[XUE_TRB_RING_CAP] __aligned(XUE_PAGE_SIZE); -static struct xue_trb out_trb[XUE_TRB_RING_CAP] __aligned(XUE_PAGE_SIZE); -static struct xue_trb in_trb[XUE_TRB_RING_CAP] __aligned(XUE_PAGE_SIZE); -static struct xue_erst_segment erst __aligned(64); -static struct xue_dbc_ctx ctx __aligned(64); -static uint8_t wrk_buf[XUE_WORK_RING_CAP] __aligned(XUE_PAGE_SIZE); -static char str_buf[XUE_PAGE_SIZE] __aligned(64); +struct xue_dma_bufs { + struct xue_trb evt_trb[XUE_TRB_RING_CAP] __aligned(XUE_PAGE_SIZE); + struct xue_trb out_trb[XUE_TRB_RING_CAP] __aligned(XUE_PAGE_SIZE); + struct xue_trb in_trb[XUE_TRB_RING_CAP] __aligned(XUE_PAGE_SIZE); + struct xue_erst_segment erst __aligned(64); + struct xue_dbc_ctx ctx __aligned(64); + uint8_t wrk_buf[XUE_WORK_RING_CAP] __aligned(XUE_PAGE_SIZE); + char str_buf[XUE_PAGE_SIZE] __aligned(64); + /* + * Don't place anything else on this page - it will be + * DMA-reachable by the USB controller. + */ + char _pad[0] __aligned(XUE_PAGE_SIZE); +}; +static struct xue_dma_bufs xue_dma_bufs __aligned(XUE_PAGE_SIZE); static char __initdata opt_dbgp[30]; string_param("dbgp", opt_dbgp); @@ -1033,15 +1042,21 @@ void __init xue_uart_init(void) xue->sbdf = PCI_SBDF(0, bus, slot, func); } - xue->dbc_ctx = &ctx; - xue->dbc_erst = &erst; - xue->dbc_ering.trb = evt_trb; - xue->dbc_oring.trb = out_trb; - xue->dbc_iring.trb = in_trb; - xue->dbc_owork.buf = wrk_buf; - xue->dbc_str = str_buf; + xue->dbc_ctx = &xue_dma_bufs.ctx; + xue->dbc_erst = &xue_dma_bufs.erst; + xue->dbc_ering.trb = xue_dma_bufs.evt_trb; + xue->dbc_oring.trb = xue_dma_bufs.out_trb; + xue->dbc_iring.trb = xue_dma_bufs.in_trb; + xue->dbc_owork.buf = xue_dma_bufs.wrk_buf; + xue->dbc_str = xue_dma_bufs.str_buf; - xue_open(xue); + if ( xue_open(xue) ) + { + iommu_add_extra_reserved_device_memory( + PFN_DOWN(virt_to_maddr(&xue_dma_bufs)), + PFN_UP(sizeof(xue_dma_bufs)), + uart->xue.sbdf.sbdf); + } serial_register_uart(SERHND_DBGP, &xue_uart_driver, &xue_uart); } diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index 661a182b08d9..2caa3e9ad1b0 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -845,7 +845,7 @@ out: return ret; } -#define MAX_USER_RMRR_PAGES 16 +#define MAX_USER_RMRR_PAGES 64 #define MAX_USER_RMRR 10 /* RMRR units derived from command line rmrr option. */