Re: [PATCH v6 1/2] PCI/ACPI: Support Microsoft's "DmaProperty"
On Tue, Apr 26, 2022 at 4:15 AM Robin Murphy wrote: > > On 2022-04-26 01:06, Rajat Jain via iommu wrote: > > The "DmaProperty" is supported and currently documented and used by > > Microsoft [link 1 below], to flag internal PCIe root ports that need > > DMA protection [link 2 below]. We have discussed with them and reached > > a common understanding that they shall change their MSDN documentation > > to say that the same property can be used to protect any PCI device, > > and not just internal PCIe root ports (since there is no point > > introducing yet another property for arbitrary PCI devices). This helps > > with security from internal devices that offer an attack surface for > > DMA attacks (e.g. internal network devices). > > > > Support DmaProperty to mark DMA from a PCI device as untrusted. > > > > Link: [1] > > https://docs.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-internal-pcie-ports-accessible-to-users-and-requiring-dma-protection > > Link: [2] > > https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt > > Signed-off-by: Rajat Jain > > Reviewed-by: Mika Westerberg > > Acked-by: Rafael J. Wysocki > > --- > > v6: * Take care of Bjorn's comments: > > - Update the commit log > > - Rename to pci_dev_has_dma_property() > > - Use acpi_dev_get_property() > > v5: * Reorder the patches in the series > > v4: * Add the GUID. > > * Update the comment and commitlog. > > v3: * Use Microsoft's documented property "DmaProperty" > > * Resctrict to ACPI only > > > > drivers/acpi/property.c | 3 +++ > > drivers/pci/pci-acpi.c | 21 + > > 2 files changed, 24 insertions(+) > > > > diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c > > index 12bbfe833609..bafe35c301ac 100644 > > --- a/drivers/acpi/property.c > > +++ b/drivers/acpi/property.c > > @@ -48,6 +48,9 @@ static const guid_t prp_guids[] = { > > /* Storage device needs D3 GUID: 5025030f-842f-4ab4-a561-99a5189762d0 > > */ > > GUID_INIT(0x5025030f, 0x842f, 0x4ab4, > > 0xa5, 0x61, 0x99, 0xa5, 0x18, 0x97, 0x62, 0xd0), > > + /* DmaProperty for PCI devices GUID: > > 70d24161-6dd5-4c9e-8070-705531292865 */ > > + GUID_INIT(0x70d24161, 0x6dd5, 0x4c9e, > > + 0x80, 0x70, 0x70, 0x55, 0x31, 0x29, 0x28, 0x65), > > }; > > > > /* ACPI _DSD data subnodes GUID: dbb8e3e6-5886-4ba6-8795-1319f52a966b */ > > diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c > > index 3ae435beaf0a..d7c6ba48486f 100644 > > --- a/drivers/pci/pci-acpi.c > > +++ b/drivers/pci/pci-acpi.c > > @@ -1369,12 +1369,33 @@ static void pci_acpi_set_external_facing(struct > > pci_dev *dev) > > dev->external_facing = 1; > > } > > > > +static int pci_dev_has_dma_property(struct pci_dev *dev) > > +{ > > + struct acpi_device *adev; > > + const union acpi_object *obj; > > + > > + adev = ACPI_COMPANION(>dev); > > + if (!adev) > > + return 0; > > + > > + /* > > + * Property also used by Microsoft Windows for same purpose, > > + * (to implement DMA protection from a device, using the IOMMU). > > Nit: there is no context for "same purpose" here, so this comment is > more confusing than helpful. Might I suggest a rewording like: > > /* > * Property used by Microsoft Windows to enforce IOMMU DMA > * protection for any device that the system might not fully > * trust; we'll honour it the same way. > */ > > ? Sure, will do. > > Personally I think it would have been more logical to handle this in > pci_set_dma_untrusted(), but I see some of those implementation aspects > have already been discussed, and Bjorn's preference definitely wins over > mine here :) Yes, this was discussed. The primary reason is that ACPI properties for PCI devices are not available at the time pci_set_untrusted_dma() is called. Thanks & Best Regards, Rajat > > Thanks, > Robin. > > > + */ > > + if (!acpi_dev_get_property(adev, "DmaProperty", ACPI_TYPE_INTEGER, > > +) && obj->integer.value == 1) > > + return 1; > > + > > + return 0; > > +} > > + > > void pci_acpi_setup(struct device *dev, struct acpi_device *adev) > > { > > struct pci_dev *pci_dev = to_pci_dev(dev); > > > > pci_acpi_optimize_delay(pci_dev, adev->handle); > > pci_acpi_set_external_facing(pci_dev); > > + pci_dev->untrusted |= pci_dev_has_dma_property(pci_dev); > > > pci_acpi_add_edr_notifier(pci_dev); > > > > pci_acpi_add_pm_notifier(adev, pci_dev); ___ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
Re: [PATCH v6 1/2] PCI/ACPI: Support Microsoft's "DmaProperty"
On 2022-04-26 01:06, Rajat Jain via iommu wrote: The "DmaProperty" is supported and currently documented and used by Microsoft [link 1 below], to flag internal PCIe root ports that need DMA protection [link 2 below]. We have discussed with them and reached a common understanding that they shall change their MSDN documentation to say that the same property can be used to protect any PCI device, and not just internal PCIe root ports (since there is no point introducing yet another property for arbitrary PCI devices). This helps with security from internal devices that offer an attack surface for DMA attacks (e.g. internal network devices). Support DmaProperty to mark DMA from a PCI device as untrusted. Link: [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-internal-pcie-ports-accessible-to-users-and-requiring-dma-protection Link: [2] https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt Signed-off-by: Rajat Jain Reviewed-by: Mika Westerberg Acked-by: Rafael J. Wysocki --- v6: * Take care of Bjorn's comments: - Update the commit log - Rename to pci_dev_has_dma_property() - Use acpi_dev_get_property() v5: * Reorder the patches in the series v4: * Add the GUID. * Update the comment and commitlog. v3: * Use Microsoft's documented property "DmaProperty" * Resctrict to ACPI only drivers/acpi/property.c | 3 +++ drivers/pci/pci-acpi.c | 21 + 2 files changed, 24 insertions(+) diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c index 12bbfe833609..bafe35c301ac 100644 --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -48,6 +48,9 @@ static const guid_t prp_guids[] = { /* Storage device needs D3 GUID: 5025030f-842f-4ab4-a561-99a5189762d0 */ GUID_INIT(0x5025030f, 0x842f, 0x4ab4, 0xa5, 0x61, 0x99, 0xa5, 0x18, 0x97, 0x62, 0xd0), + /* DmaProperty for PCI devices GUID: 70d24161-6dd5-4c9e-8070-705531292865 */ + GUID_INIT(0x70d24161, 0x6dd5, 0x4c9e, + 0x80, 0x70, 0x70, 0x55, 0x31, 0x29, 0x28, 0x65), }; /* ACPI _DSD data subnodes GUID: dbb8e3e6-5886-4ba6-8795-1319f52a966b */ diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c index 3ae435beaf0a..d7c6ba48486f 100644 --- a/drivers/pci/pci-acpi.c +++ b/drivers/pci/pci-acpi.c @@ -1369,12 +1369,33 @@ static void pci_acpi_set_external_facing(struct pci_dev *dev) dev->external_facing = 1; } +static int pci_dev_has_dma_property(struct pci_dev *dev) +{ + struct acpi_device *adev; + const union acpi_object *obj; + + adev = ACPI_COMPANION(>dev); + if (!adev) + return 0; + + /* +* Property also used by Microsoft Windows for same purpose, +* (to implement DMA protection from a device, using the IOMMU). Nit: there is no context for "same purpose" here, so this comment is more confusing than helpful. Might I suggest a rewording like: /* * Property used by Microsoft Windows to enforce IOMMU DMA * protection for any device that the system might not fully * trust; we'll honour it the same way. */ ? Personally I think it would have been more logical to handle this in pci_set_dma_untrusted(), but I see some of those implementation aspects have already been discussed, and Bjorn's preference definitely wins over mine here :) Thanks, Robin. +*/ + if (!acpi_dev_get_property(adev, "DmaProperty", ACPI_TYPE_INTEGER, + ) && obj->integer.value == 1) + return 1; + + return 0; +} + void pci_acpi_setup(struct device *dev, struct acpi_device *adev) { struct pci_dev *pci_dev = to_pci_dev(dev); pci_acpi_optimize_delay(pci_dev, adev->handle); pci_acpi_set_external_facing(pci_dev); + pci_dev->untrusted |= pci_dev_has_dma_property(pci_dev); > pci_acpi_add_edr_notifier(pci_dev); pci_acpi_add_pm_notifier(adev, pci_dev); ___ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
[PATCH v6 1/2] PCI/ACPI: Support Microsoft's "DmaProperty"
The "DmaProperty" is supported and currently documented and used by Microsoft [link 1 below], to flag internal PCIe root ports that need DMA protection [link 2 below]. We have discussed with them and reached a common understanding that they shall change their MSDN documentation to say that the same property can be used to protect any PCI device, and not just internal PCIe root ports (since there is no point introducing yet another property for arbitrary PCI devices). This helps with security from internal devices that offer an attack surface for DMA attacks (e.g. internal network devices). Support DmaProperty to mark DMA from a PCI device as untrusted. Link: [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-internal-pcie-ports-accessible-to-users-and-requiring-dma-protection Link: [2] https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt Signed-off-by: Rajat Jain Reviewed-by: Mika Westerberg Acked-by: Rafael J. Wysocki --- v6: * Take care of Bjorn's comments: - Update the commit log - Rename to pci_dev_has_dma_property() - Use acpi_dev_get_property() v5: * Reorder the patches in the series v4: * Add the GUID. * Update the comment and commitlog. v3: * Use Microsoft's documented property "DmaProperty" * Resctrict to ACPI only drivers/acpi/property.c | 3 +++ drivers/pci/pci-acpi.c | 21 + 2 files changed, 24 insertions(+) diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c index 12bbfe833609..bafe35c301ac 100644 --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -48,6 +48,9 @@ static const guid_t prp_guids[] = { /* Storage device needs D3 GUID: 5025030f-842f-4ab4-a561-99a5189762d0 */ GUID_INIT(0x5025030f, 0x842f, 0x4ab4, 0xa5, 0x61, 0x99, 0xa5, 0x18, 0x97, 0x62, 0xd0), + /* DmaProperty for PCI devices GUID: 70d24161-6dd5-4c9e-8070-705531292865 */ + GUID_INIT(0x70d24161, 0x6dd5, 0x4c9e, + 0x80, 0x70, 0x70, 0x55, 0x31, 0x29, 0x28, 0x65), }; /* ACPI _DSD data subnodes GUID: dbb8e3e6-5886-4ba6-8795-1319f52a966b */ diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c index 3ae435beaf0a..d7c6ba48486f 100644 --- a/drivers/pci/pci-acpi.c +++ b/drivers/pci/pci-acpi.c @@ -1369,12 +1369,33 @@ static void pci_acpi_set_external_facing(struct pci_dev *dev) dev->external_facing = 1; } +static int pci_dev_has_dma_property(struct pci_dev *dev) +{ + struct acpi_device *adev; + const union acpi_object *obj; + + adev = ACPI_COMPANION(>dev); + if (!adev) + return 0; + + /* +* Property also used by Microsoft Windows for same purpose, +* (to implement DMA protection from a device, using the IOMMU). +*/ + if (!acpi_dev_get_property(adev, "DmaProperty", ACPI_TYPE_INTEGER, + ) && obj->integer.value == 1) + return 1; + + return 0; +} + void pci_acpi_setup(struct device *dev, struct acpi_device *adev) { struct pci_dev *pci_dev = to_pci_dev(dev); pci_acpi_optimize_delay(pci_dev, adev->handle); pci_acpi_set_external_facing(pci_dev); + pci_dev->untrusted |= pci_dev_has_dma_property(pci_dev); pci_acpi_add_edr_notifier(pci_dev); pci_acpi_add_pm_notifier(adev, pci_dev); -- 2.36.0.rc2.479.g8af0fa9b8e-goog ___ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu