Re: [PATCH v3 00/18] Fix BUG_ON in vfio_iommu_group_notifier()

Lu Baolu
2021-12-17T06:41:52Z

On 12/6/21 9:58 AM, Lu Baolu wrote:
> Hi folks,
>
> The iommu group is the minimal isolation boundary for DMA. Devices in
> a group can access each other's MMIO registers via peer to peer DMA
> and also need share the same I/O address space.
>
> Once the I/O address space is assigned to user control it is no longer
> available to the dma_map* API, which effectively makes the DMA API
> non-working.
>
> Second, userspace can use DMA initiated by a device that it controls
> to access the MMIO spaces of other devices in the group. This allows
> userspace to indirectly attack any kernel owned device and it's driver.
>
> Therefore groups must either be entirely under kernel control or
> userspace control, never a mixture. Unfortunately some systems have
> problems with the granularity of groups and there are a couple of
> important exceptions:
>
> - pci_stub allows the admin to block driver binding on a device and
> make it permanently shared with userspace. Since PCI stub does not
> do DMA it is safe, however the admin must understand that using
> pci_stub allows userspace to attack whatever device it was bound
> it.
>
> - PCI bridges are sometimes included in groups. Typically PCI bridges
> do not use DMA, and generally do not have MMIO regions.
>
> Generally any device that does not have any MMIO registers is a
> possible candidate for an exception.
>
> Currently vfio adopts a workaround to detect violations of the above
> restrictions by monitoring the driver core BOUND event, and hardwiring
> the above exceptions. Since there is no way for vfio to reject driver
> binding at this point, BUG_ON() is triggered if a violation is
> captured (kernel driver BOUND event on a group which already has some
> devices assigned to userspace). Aside from the bad user experience
> this opens a way for root userspace to crash the kernel, even in high
> integrity configurations, by manipulating the module binding and
> triggering the BUG_ON.
>
> This series solves this problem by making the user/kernel ownership a
> core concept at the IOMMU layer. The driver core enforces kernel
> ownership while drivers are bound and violations now result in a error
> codes during probe, not BUG_ON failures.
>
> Patch partitions:
> [PATCH 1-9]: Detect DMA ownership conflicts during driver binding;
> [PATCH 10-13]: Add security context management for assigned devices;
> [PATCH 14-18]: Various cleanups.
>
> This is part one of three initial series for IOMMUFD:
> * Move IOMMU Group security into the iommu layer
> - Generic IOMMUFD implementation
> - VFIO ability to consume IOMMUFD

Thank you very much for reviewing my series. The v4 of this series has
been posted here:

https://lore.kernel.org/linux-iommu/20211217063708.1740334-1-baolu.lu@linux.intel.com/

Best regards,
baolu