Re: [PATCH 1/5] iommu/vt-d: Restore WO permissions on second-level paging entries

[Baolu Lu <baolu.lu@linux.intel.com>]

On 5/14/25 13:52, Aditya Garg wrote:
> Hi
> 
> Since the original patch which this patch aims to revert fixed CVE-2021-47035, I'd
> like to know how is that managed now.

Modern IOMMU hardware supports multiple formats of page tables. Some of
them support write-only permission, but others do not due to
compatibility with the CPU page table. That's the reason why the
previous commit removed write-only permission to make it consistent.

Nowadays, we have renewed iommu domain allocation interface which takes
a device pointer and allocation flags. So, if the upper layers, for
example, VFIO or IOMMUFD, want the iommu driver to enforce write-only
protection, they should add an allocation flag for this explicitly.
Otherwise, the IOMMU driver will treat DMA_FROM_DEVICE as a hint, not an
enforcement.

Thanks,
baolu