Re: [PATCH 4/7] vfio: iommu_type1: Fix missing dirty page when promote pinned_scope

2020-12-15 Thread Alex Williamson
On Tue, 15 Dec 2020 17:37:11 +0800 zhukeqian wrote: > Hi Alex, > > On 2020/12/15 8:04, Alex Williamson wrote: > > On Thu, 10 Dec 2020 15:34:22 +0800 > > Keqian Zhu wrote: > > > >> When we pin or detach a group which is not dirty tracking capable, > >> we will try to promote pinned_scope of

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-15 Thread Konrad Rzeszutek Wilk
.snip. > > > This raises two issues: > > > 1) swiotlb_tlb_unmap_single fails to check whether the index generated > > > from the dma_addr is in range of the io_tlb_orig_addr array. > > That is fairly simple to implement I would think. That is it can check > > that the dma_addr is from the PA in

Re: [PATCH] drivers/iommu: fix null-ptr-deref bug of rk_iommu_from_dev's ret-val

2020-12-15 Thread Robin Murphy
On 2020-12-15 04:15, tangzhenhao wrote: From: Sugar we should check the ret-val of function rk_iommu_from_dev to avoid null-ptr-deref. Signed-off-by: Sugar --- drivers/iommu/rockchip-iommu.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/drivers/iommu/rockchip-iommu.c

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-15 Thread Konrad Rzeszutek Wilk
On Tue, Dec 15, 2020 at 11:54:08AM +0100, Felicitas Hetzelt wrote: > Hello, > thank you all for looking into this! To answer some of the questions: > - Did you have already some PoC fixes for this: >We don't have a full PoC or fix currently. Thought we have a PoC >with which were able to

[PATCH] iommu/amd: remove h from printk format specifier

2020-12-15 Thread trix
From: Tom Rix See Documentation/core-api/printk-formats.rst. commit cbacb5ab0aa0 ("docs: printk-formats: Stop encouraging use of unnecessary %h[xudi] and %hh[xudi]") Standard integer promotion is already done and %hx and %hhx is useless so do not encourage the use of %hh[xudi] or %h[xudi].

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-15 Thread Jason Wang
- Original Message - > .snip. > > > > This raises two issues: > > > > 1) swiotlb_tlb_unmap_single fails to check whether the index generated > > > > from the dma_addr is in range of the io_tlb_orig_addr array. > > > That is fairly simple to implement I would think. That is it can check

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-15 Thread Jason Wang
- Original Message - > > > - Original Message - > > .snip. > > > > > This raises two issues: > > > > > 1) swiotlb_tlb_unmap_single fails to check whether the index > > > > > generated > > > > > from the dma_addr is in range of the io_tlb_orig_addr array. > > > > That is fairly

[PATCH v4 09/13] iommu/amd: Rename variables to be consistent with struct io_pgtable_ops

2020-12-15 Thread Suravee Suthikulpanit
There is no functional change. Signed-off-by: Suravee Suthikulpanit --- drivers/iommu/amd/io_pgtable.c | 31 +++ 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/drivers/iommu/amd/io_pgtable.c b/drivers/iommu/amd/io_pgtable.c index

[PATCH v4 12/13] iommu/amd: Introduce iommu_v1_map_page and iommu_v1_unmap_page

2020-12-15 Thread Suravee Suthikulpanit
These implement map and unmap for AMD IOMMU v1 pagetable, which will be used by the IO pagetable framework. Also clean up unused extern function declarations. Signed-off-by: Suravee Suthikulpanit --- drivers/iommu/amd/amd_iommu.h | 13 - drivers/iommu/amd/io_pgtable.c | 25

[PATCH v4 10/13] iommu/amd: Refactor fetch_pte to use struct amd_io_pgtable

2020-12-15 Thread Suravee Suthikulpanit
To simplify the fetch_pte function. There is no functional change. Signed-off-by: Suravee Suthikulpanit --- drivers/iommu/amd/amd_iommu.h | 2 +- drivers/iommu/amd/io_pgtable.c | 13 +++-- drivers/iommu/amd/iommu.c | 4 +++- 3 files changed, 11 insertions(+), 8 deletions(-)

Re: [PATCH 4/7] vfio: iommu_type1: Fix missing dirty page when promote pinned_scope

2020-12-15 Thread zhukeqian
Hi Alex, On 2020/12/15 8:04, Alex Williamson wrote: > On Thu, 10 Dec 2020 15:34:22 +0800 > Keqian Zhu wrote: > >> When we pin or detach a group which is not dirty tracking capable, >> we will try to promote pinned_scope of vfio_iommu. >> >> If we succeed to do so, vfio only report pinned_scope

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-15 Thread Ashish Kalra
On Mon, Dec 14, 2020 at 04:49:50PM -0500, Konrad Rzeszutek Wilk wrote: > On Fri, Dec 11, 2020 at 06:31:21PM +0100, Felicitas Hetzelt wrote: > > Hello, > > Hi! Please see below my responses. > > > we have been analyzing the Hypervisor-OS interface of Linux > > and discovered bugs in the

Re: swiotlb/virtio: unchecked device dma address and length

2020-12-15 Thread Felicitas Hetzelt
Hello, thank you all for looking into this! To answer some of the questions: - Did you have already some PoC fixes for this: We don't have a full PoC or fix currently. Thought we have a PoC with which were able to overwrite memory outside of the mapped dma region. - Is there a CVE

[kbuild] Re: [PATCH 1/7] vfio: iommu_type1: Clear added dirty bit when unwind pin

2020-12-15 Thread Dan Carpenter
Hi Keqian, url: https://github.com/0day-ci/linux/commits/Keqian-Zhu/vfio-iommu_type1-Some-fixes-and-optimization/20201210-154322 base: https://github.com/awilliam/linux-vfio.git next config: x86_64-randconfig-m001-20201215 (attached as .config) compiler: gcc-9 (Debian 9.3.0-15) 9.3.0