Re: lack of permission checking with intel-iommu?

[Baolu Lu <baolu.lu@linux.intel.com>]

On 7/3/24 8:56 AM, Tian, Kevin wrote:
>> From: Baolu Lu <baolu.lu@linux.intel.com>
>> Sent: Tuesday, July 2, 2024 5:13 PM
>>
>> On 2024/7/2 16:25, Christoph Hellwig wrote:
>>> On Tue, Jul 02, 2024 at 04:22:25PM +0800, Baolu Lu wrote:
>>>> Is it about IOMMU blocking "device reading from buffer" or "device
>>>> writing to buffer"?
>>>>
>>>> The intel iommu driver might use first-stage translation for kernel DMA.
>>>> It seems not to block the "device reading from buffer" if I remember it
>>>> correctly.
>>> This is about device reading from buffer it is only supposed to write
>>> to (but doesn't).
>>
>> In this case, Intel IOMMU doesn't block device reading as the first-
>> stage page table only grants two types of permissions: Read-only or
>> Read-write. Write-only permission is not available.
>>
>> Do you have a functional requirement for Write-only permission? If so,
>> we can choose the second-stage page table.
>>
> 
> Note there could be configurations (e.g. vIOMMU) which only supports
> 1st-stage. So there is no guarantee that write-only permission can be
> always enforced on Intel.
> 
> btw according to current code looks write-only even doesn't work on
> 2nd-stage:
> 
> __domain_mapping()
> {
> 	...
> 	attr = prot & (DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP);
> 	attr |= DMA_FL_PTE_PRESENT;
> 	if (domain->use_first_level) {
>                  		...
> 	}
> 	...
> }
> 
> DMA_FL_PTE_PRESENT and DMA_PTE_READ are both bit-0, so
> READ is always set in 2nd-stage. That line should be done only
> for domain->use_first_level==true

This is intended to make the permission consistent between first and
second stage.

Thanks,
baolu