Re: swiotlb/virtio: unchecked device dma address and length

2020-12-16 Thread Jason Wang
On 2020/12/16 下午9:04, Konrad Rzeszutek Wilk wrote: On December 16, 2020 1:41:48 AM EST, Jason Wang wrote: - Original Message - - Original Message - .snip. This raises two issues: 1) swiotlb_tlb_unmap_single fails to check whether the index generated from the dma_addr is in

Re: [PATCH v3 4/7] iommu: Switch gather->end to unsigned long long

2020-12-16 Thread Yong Wu
Hi David, On Wed, 2020-12-16 at 11:03 +, David Laight wrote: > From: Yong Wu > > Sent: 16 December 2020 10:36 > > > > Currently gather->end is "unsigned long" which may be overflow in > > arch32 in the corner case: 0xfff0 + 0x10(iova + size). > > Although it doesn't affect the size(en

Re: [PATCH v3 4/7] iommu: Switch gather->end to unsigned long long

2020-12-16 Thread Yong Wu
On Wed, 2020-12-16 at 12:10 +, Robin Murphy wrote: > On 2020-12-16 10:36, Yong Wu wrote: > > Currently gather->end is "unsigned long" which may be overflow in > > arch32 in the corner case: 0xfff0 + 0x10(iova + size). > > Although it doesn't affect the size(end - start), it affects the

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-16 Thread Radev, Martin
Hello everybody, I will try help clarify some things. > On a DMA unmap SWIOTLB (when force is used) it trusts the driver from > providing > the correct DMA address and length which SWIOTLB uses to match to its > associated > original PA address. > The length is not checked so the attacker can m

Re: [GIT PULL] IOMMU updates for 5.11

2020-12-16 Thread Linus Torvalds
On Wed, Dec 16, 2020 at 2:10 PM Will Deacon wrote: > > Brill, cheers. I didn't realise you were going by subsystem, so that's > why I was getting worried. My "by subsystem" is a bit fuzzy, and it only really happens when I have a _lot_ of pending pull requests. Which this merge window has had mor

Re: [GIT PULL] IOMMU updates for 5.11

2020-12-16 Thread Will Deacon
On Wed, Dec 16, 2020 at 02:02:00PM -0800, Linus Torvalds wrote: > On Wed, Dec 16, 2020 at 10:54 AM Will Deacon wrote: > > > > I'm hoping to wind down a bit next week (ho ho ho), so I just wanted to > > check whether this had got caught in your spam filters, whether you wanted > > me to change some

Re: [GIT PULL] IOMMU updates for 5.11

2020-12-16 Thread pr-tracker-bot
The pull request you sent on Mon, 14 Dec 2020 23:45:18 +: > git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git > tags/iommu-updates-v5.11 has been merged into torvalds/linux.git: https://git.kernel.org/torvalds/c/19778dd504b5ff5c3c1283aa3da7a56f34c2c3b0 Thank you! -- Deet-doot-

Re: [GIT PULL] IOMMU updates for 5.11

2020-12-16 Thread Linus Torvalds
On Wed, Dec 16, 2020 at 10:54 AM Will Deacon wrote: > > I'm hoping to wind down a bit next week (ho ho ho), so I just wanted to > check whether this had got caught in your spam filters, whether you wanted > me to change something or whether you're just snowed under in pull requests. No, it didn't

Re: [GIT PULL] IOMMU updates for 5.11

2020-12-16 Thread Will Deacon
Hi again, Linus, On Mon, Dec 14, 2020 at 11:45:18PM +, Will Deacon wrote: > Hi Linus, > > Please pull these IOMMU updates for 5.11: there's a good mixture of > improvements to the core code and driver changes across the board. > Summary in the tag and merge commits. > > One thing worth point

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-16 Thread Konrad Rzeszutek Wilk
..snip.. >> > > This raises two issues: >> > > 1) swiotlb_tlb_unmap_single fails to check whether the index >generated >> > > from the dma_addr is in range of the io_tlb_orig_addr array. >> > That is fairly simple to implement I would think. That is it can >check >> > that the dma_addr is from the

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-16 Thread Konrad Rzeszutek Wilk
On December 16, 2020 1:41:48 AM EST, Jason Wang wrote: > > >- Original Message - >> >> >> - Original Message - >> > .snip. >> > > > > This raises two issues: >> > > > > 1) swiotlb_tlb_unmap_single fails to check whether the index >> > > > > generated >> > > > > from the dma_addr

Re: [PATCH v3 4/7] iommu: Switch gather->end to unsigned long long

2020-12-16 Thread Robin Murphy
On 2020-12-16 10:36, Yong Wu wrote: Currently gather->end is "unsigned long" which may be overflow in arch32 in the corner case: 0xfff0 + 0x10(iova + size). Although it doesn't affect the size(end - start), it affects the checking "gather->end < end" This won't help the same situation a

[PATCH] arm64: dts: mt8192: add m4u and smi nodes

2020-12-16 Thread Yong Wu
Add mt8192 IOMMU and smi larb/common nodes. Signed-off-by: Yong Wu --- This patch base on: 1. mt8192 dts base which is in the linux-next now. https://lore.kernel.org/linux-mediatek/20201030092207.26488-2-seiya.w...@mediatek.com/ 2. clock nodes and definitions: https://lore.kernel.org/linux-media

Re: [PATCH 0/2] Introduce PCI_FIXUP_IOMMU

2020-12-16 Thread Zhou Wang
On 2020/6/23 23:04, Bjorn Helgaas wrote: > On Fri, Jun 19, 2020 at 10:26:54AM +0800, Zhangfei Gao wrote: >> Have studied _DSM method, two issues we met comparing using quirk. >> >> 1. Need change definition of either pci_host_bridge or pci_dev, like adding >> member can_stall, >> while pci system d

RE: [PATCH v3 4/7] iommu: Switch gather->end to unsigned long long

2020-12-16 Thread David Laight
From: Yong Wu > Sent: 16 December 2020 10:36 > > Currently gather->end is "unsigned long" which may be overflow in > arch32 in the corner case: 0xfff0 + 0x10(iova + size). > Although it doesn't affect the size(end - start), it affects the checking > "gather->end < end" > > Fixes: a7d20dc1

[PATCH v3 6/7] iommu/mediatek: Gather iova in iommu_unmap to achieve tlb sync once

2020-12-16 Thread Yong Wu
In current iommu_unmap, this code is: iommu_iotlb_gather_init(&iotlb_gather); ret = __iommu_unmap(domain, iova, size, &iotlb_gather); iommu_iotlb_sync(domain, &iotlb_gather); We could gather the whole iova range in __iommu_unmap, and then do tlb synchronization in the iomm

[PATCH v3 7/7] iommu/mediatek: Remove the tlb-ops for v7s

2020-12-16 Thread Yong Wu
Until now, we have already used the tlb operations from iommu framework, then the tlb operations for v7s can be removed. Correspondingly, Switch the paramenter "cookie" to internal structure. Signed-off-by: Yong Wu --- drivers/iommu/mtk_iommu.c | 27 --- 1 file changed,

[PATCH v3 5/7] iommu: Allow io_pgtable_tlb ops optional

2020-12-16 Thread Yong Wu
This patch allows io_pgtable_tlb ops could be null since the IOMMU drivers may use the tlb ops from iommu framework. Signed-off-by: Yong Wu --- include/linux/io-pgtable.h | 8 +--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgt

[PATCH v3 4/7] iommu: Switch gather->end to unsigned long long

2020-12-16 Thread Yong Wu
Currently gather->end is "unsigned long" which may be overflow in arch32 in the corner case: 0xfff0 + 0x10(iova + size). Although it doesn't affect the size(end - start), it affects the checking "gather->end < end" Fixes: a7d20dc19d9e ("iommu: Introduce struct iommu_iotlb_gather for batchi

[PATCH v3 3/7] iommu/mediatek: Add iotlb_sync_map to sync whole the iova range

2020-12-16 Thread Yong Wu
Remove IO_PGTABLE_QUIRK_TLBI_ON_MAP to avoid tlb sync for each a small chunk memory, Use the new iotlb_sync_map to tlb_sync once for whole the iova range of iommu_map. Signed-off-by: Yong Wu Reviewed-by: Robin Murphy --- drivers/iommu/mtk_iommu.c | 10 +- 1 file changed, 9 insertions(+)

[PATCH v3 1/7] iommu: Move iotlb_sync_map out from __iommu_map

2020-12-16 Thread Yong Wu
In the end of __iommu_map, It alway call iotlb_sync_map. This patch moves iotlb_sync_map out from __iommu_map since it is unnecessary to call this for each sg segment especially iotlb_sync_map is flush tlb all currently. Signed-off-by: Yong Wu Reviewed-by: Robin Murphy --- drivers/iommu/iommu.c

[PATCH v3 2/7] iommu: Add iova and size as parameters in iotlb_sync_map

2020-12-16 Thread Yong Wu
iotlb_sync_map allow IOMMU drivers tlb sync after completing the whole mapping. This patch adds iova and size as the parameters in it. then the IOMMU driver could flush tlb with the whole range once after iova mapping to improve performance. Signed-off-by: Yong Wu Reviewed-by: Robin Murphy ---

[PATCH v3 0/7] MediaTek IOMMU improve tlb flush performance in map/unmap

2020-12-16 Thread Yong Wu
This patchset is to improve tlb flushing performance in iommu_map/unmap for MediaTek IOMMU. For iommu_map, currently MediaTek IOMMU use IO_PGTABLE_QUIRK_TLBI_ON_MAP to do tlb_flush for each a memory chunk. this is so unnecessary. we could improve it by tlb flushing one time at the end of iommu_map

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-16 Thread Michael S. Tsirkin
On Tue, Dec 15, 2020 at 11:20:48AM +0800, Jason Wang wrote: > > On 2020/12/15 上午5:49, Konrad Rzeszutek Wilk wrote: > > On Fri, Dec 11, 2020 at 06:31:21PM +0100, Felicitas Hetzelt wrote: > > > Hello, > > Hi! Please see below my responses. > > > > > we have been analyzing the Hypervisor-OS interfac