Re: [PATCH 1/5] iommu/vt-d: Restore WO permissions on second-level paging entries

Re: [PATCH 1/5] iommu/vt-d: Restore WO permissions on second-level paging entries

[Aditya Garg]

Hi

Since the original patch which this patch aims to revert fixed CVE-2021-47035, I'd
like to know how is that managed now.

Thanks
Aditya

Re: [PATCH 1/5] iommu/vt-d: Restore WO permissions on second-level paging entries

[Baolu Lu]

On 5/14/25 13:52, Aditya Garg wrote:
> Hi
> 
> Since the original patch which this patch aims to revert fixed CVE-2021-47035, I'd
> like to know how is that managed now.

Modern IOMMU hardware supports multiple formats of page tables. Some of
them support write-only permission, but others do not due to
compatibility with the CPU page table. That's the reason why the
previous commit removed write-only permission to make it consistent.

Nowadays, we have renewed iommu domain allocation interface which takes
a device pointer and allocation flags. So, if the upper layers, for
example, VFIO or IOMMUFD, want the iommu driver to enforce write-only
protection, they should add an allocation flag for this explicitly.
Otherwise, the IOMMU driver will treat DMA_FROM_DEVICE as a hint, not an
enforcement.

Thanks,
baolu

[PATCH 0/5] [PULL REQUEST] Intel IOMMU updates for v6.16

[Lu Baolu]

Hi Joerg,

The following changes have been queued for v6.16-rc1. They are about new
features and code refactoring, including:

 - Restore WO permissions on second-level paging entries
 - Use ida to manage domain id
 - Miscellaneous cleanups

These patches are based on v6.15-rc6. Please consider them for the
iommu/vt-d branch.

Best regards,
baolu

Jason Gunthorpe (1):
  iommu/vt-d: Restore WO permissions on second-level paging entries

Lu Baolu (2):
  iommu/vt-d: Use ida to manage domain id
  iommu/vt-d: Replace spin_lock with mutex to protect domain ida

Wei Wang (2):
  iommu/vt-d: Eliminate pci_physfn() in dmar_find_matched_satc_unit()
  iommu/vt-d: Change dmar_ats_supported() to return boolean

 drivers/iommu/intel/dmar.c  |   4 ++
 drivers/iommu/intel/iommu.c | 113 ++++++++++--------------------------
 drivers/iommu/intel/iommu.h |  21 +++++--
 3 files changed, 51 insertions(+), 87 deletions(-)

-- 
2.43.0

[PATCH 1/5] iommu/vt-d: Restore WO permissions on second-level paging entries

[Lu Baolu]

From: Jason Gunthorpe <jgg@nvidia.com>

VT-D HW can do WO permissions on the second-stage but not the first-stage
page table formats. The commit eea53c581688 ("iommu/vt-d: Remove WO
permissions on second-level paging entries") wanted to make this uniform
for VT-D by disabling the support for WO permissions in the second-stage.

This isn't consistent with how other drivers are working. Instead if the
underlying HW can support WO, it should. For instance AMD already supports
WO on its second stage (v1) format and not its first (v2).

If WO support needs to be discoverable it should be done through an
iommu_domain capability flag.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/0-v1-c26553717e90+65f-iommu_vtd_ss_wo_jgg@nvidia.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
---
 drivers/iommu/intel/iommu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index cb0b993bebb4..67c6ea1d8d44 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -1681,9 +1681,8 @@ __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
 	}
 
 	attr = prot & (DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP);
-	attr |= DMA_FL_PTE_PRESENT;
 	if (domain->use_first_level) {
-		attr |= DMA_FL_PTE_US | DMA_FL_PTE_ACCESS;
+		attr |= DMA_FL_PTE_PRESENT | DMA_FL_PTE_US | DMA_FL_PTE_ACCESS;
 		if (prot & DMA_PTE_WRITE)
 			attr |= DMA_FL_PTE_DIRTY;
 	}
-- 
2.43.0