Re: lack of permission checking with intel-iommu?

[Yi Liu <yi.l.liu@intel.com>]

Hi Baolu,

On 2024/7/2 16:22, Baolu Lu wrote:
> On 2024/7/2 16:02, Christoph Hellwig wrote:
>> On Tue, Jul 02, 2024 at 12:46:59AM -0700, Christoph Hellwig wrote:
>>> Hi all,
> Hi Christoph,
> 
>>>
>>> we've recently had an interesting case where a device unexpectedly
>>> modified a dma buffer passed to it.  On AMD systems this caused iommu
>>> faults because the buffer was mapped read only (DMA_FROM_DEVICE), but
>>> on an Intel system everything worked fine as the IOMMU did not trip up
>>> on the device writes to that buffer.  Any idea why that could sneak
>>> through?
>> Sorry if this was confusing, the permission checking is of course about
>> the device reading from a buffer mapped read-only for the device
>> (as that is what DMA_FROM_DEVICE is), which on intel still allows it
>> to read.
> 
> Is it about IOMMU blocking "device reading from buffer" or "device
> writing to buffer"?
> 
> The intel iommu driver might use first-stage translation for kernel DMA.
> It seems not to block the "device reading from buffer" if I remember it
> correctly.

does the current kernel use the first-stage page table by default?

-- 
Regards,
Yi Liu