From patchwork Fri Aug 21 16:28:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jean-Philippe Brucker X-Patchwork-Id: 248132 Delivered-To: patch@linaro.org Received: by 2002:a54:3b12:0:0:0:0:0 with SMTP id j18csp447423ect; Fri, 21 Aug 2020 09:31:45 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyDWQu+XGECq09ZEtJP9nRzb6VMwGUZj4ye5oowcNU9blxUdi7BPl9IUpXPynaf0XUWsOwt X-Received: by 2002:aa7:9552:: with SMTP id w18mr3140359pfq.150.1598027505338; Fri, 21 Aug 2020 09:31:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1598027505; cv=none; d=google.com; s=arc-20160816; b=eHGz3MvW0vKVsk3qHHwYlVV2ZSJIKqnG/VHbx+7Yow+c1z76Bou+nzbM9NAywMrAl4 GNWF/izntfi6/Ma3B7Tk/9qZjZVjo3hj4BQ6pculAfddHcgI3p6RbA64TlT0zR46oNXq 7RchorHlCMdqkuvDBlBd3BaXNHhcqQHe0GDGIFBHUAHDeSU9qf9x3cFlsqNqFC5jKvcp KqMFFuKo0HVrZXq6qk1I8lUIn2F0RyxK6vBcEuaA4EGDz6ifTH+FdE6oBTjJe5L0D7pe 7rmb9g56nb27EtkJj5VtqEfaFvVFh7AWBe9GIszhoDRsZtrWHJF+p7JTo2km2f096SHL phXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:to:from :dkim-signature; bh=OuI8xnJndStSpo+ETjU3EU4hq5mCXR/FiYpus8sMWls=; b=uej/N1ZPfKL5CtqaN+e9Ej9VrAgRcIjm+OKt6uKKeUWQeUe33WmaYtNTvo3cyrlOB3 Al+OrH3LjfcyUF5pWaEpGuFX7vyYFiCbmIRoAUXCVK/DMTsICXVV7zeGg5l2vt9FOui7 C518eMydeyVGuDaUbEM5RSzwaBGU0VOjf/SFo1Y9Ja/RsvXQZUrg3uQ7U3VxiU7PL5Em upIgGyva6ls1lWCevNTOr5YvLylXFk8mEL0fDlSXO1hqqcEBSQD6wfgyQZnQDvf7mLIM bMtx411LVF0aXq02q5XDtEqkzer+RdQsMYSKV1JcUEnCtn/nkEgaONeg0rEnpsBxGt3N J1jw== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b="RtBd0+/t"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id x19si1873928plr.213.2020.08.21.09.31.45 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 21 Aug 2020 09:31:45 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b="RtBd0+/t"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1]:58214 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1k99x8-0008Je-VC for patch@linaro.org; Fri, 21 Aug 2020 12:31:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59668) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k99vx-0007tc-Rp for qemu-devel@nongnu.org; Fri, 21 Aug 2020 12:30:30 -0400 Received: from mail-ej1-x644.google.com ([2a00:1450:4864:20::644]:32796) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1k99vt-0006na-KE for qemu-devel@nongnu.org; Fri, 21 Aug 2020 12:30:29 -0400 Received: by mail-ej1-x644.google.com with SMTP id u21so2335586ejz.0 for ; Fri, 21 Aug 2020 09:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=OuI8xnJndStSpo+ETjU3EU4hq5mCXR/FiYpus8sMWls=; b=RtBd0+/tA0QB1kHWt9+BsloshL2hCQZsnr/oWm+0HJJVwqLPFyn6AT+SofxvLmuImX PsAfS3QcpNvxXPTTMzY3cg6GuW96O0nt20YxLWuOGab+e7ycvFO3onzdsygv0zXeSGCm gYk+MvS8rqcGAYFuVDwVYaUqZk7juHUkq9QcyCJc/eXlChsskoDjukYCLbfPuTNafalP QDS9V8yzFoUdYxgtAC7XBfW5fVgxkgfXSNcj86Ohb4gMrHsqlCCf0qhOsxs6Lr3MgLT4 cfYA588+j0y5p9YHHNgRaceedtGSBwmhCMKDLafRTMjagMg3ykvVBSqTwK/dVu4jpvJe a1rQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=OuI8xnJndStSpo+ETjU3EU4hq5mCXR/FiYpus8sMWls=; b=g7gt+i2CVTcVEBdcaLTOciHqx772YhugYi5iJGHkeAv/TIeA8apiy/tlEwK3dRew31 CulBLMaaVYPi3YB9om0gjl4Ty7/vmjjc7vEgVPd6AH/vgrws9r5kVnzbd3f9c7/OFlgT YxJZB2GCGwrxBiJs8V6zhV7SsYuX4MHVKRNnyOJ0PLIHhvhgAcZsm51fy/mtoSvKr3L6 wZoLWnJv1pMtcG8mFpDtdGvdmmqYmONmiVtJUXaQWHEhDxvohvXfChq3Zze4hcMmw/7e OpwEbQvwzMs6NcKLB4MfTauGa0zwKJ2L0OJrrgOKUWGJxikdVR7vJuVMPPxKp/1BTOVl XYvw== X-Gm-Message-State: AOAM531w/oJan7q+fqTM7IAebVer3In/B0U80jcRzbK0JEfADOVrotkY zweDQG5BDud5kddDALoD0yXElw== X-Received: by 2002:a17:906:3e06:: with SMTP id k6mr3616203eji.37.1598027423946; Fri, 21 Aug 2020 09:30:23 -0700 (PDT) Received: from localhost.localdomain ([2001:1715:4e26:a7e0:116c:c27a:3e7f:5eaf]) by smtp.gmail.com with ESMTPSA id dk28sm1398030edb.90.2020.08.21.09.30.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Aug 2020 09:30:23 -0700 (PDT) From: Jean-Philippe Brucker To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Subject: [PATCH 1/5] virtio-iommu: Default to bypass during boot Date: Fri, 21 Aug 2020 18:28:35 +0200 Message-Id: <20200821162839.3182051-2-jean-philippe@linaro.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200821162839.3182051-1-jean-philippe@linaro.org> References: <20200821162839.3182051-1-jean-philippe@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::644; envelope-from=jean-philippe@linaro.org; helo=mail-ej1-x644.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, ehabkost@redhat.com, mst@redhat.com, eric.auger@redhat.com, Jean-Philippe Brucker , pbonzini@redhat.com, rth@twiddle.net Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" When a virtio-iommu is present, we currently require the guest to configure it before it can use DMA in any other PCI device. This prevents, for example, a bootloader that doesn't know how to drive virtio-iommu from loading an OS from storage. Add the "boot-bypass" option, defaulting to true, to let DMA bypass the virtio-iommu during boot similarly to the other vIOMMUs. It makes the system vulnerable to malicious endpoints during boot, but that isn't much of a concern in virtual systems. Signed-off-by: Jean-Philippe Brucker --- include/hw/virtio/virtio-iommu.h | 1 + hw/virtio/virtio-iommu.c | 22 ++++++++++++++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-) -- 2.28.0 diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h index 49eb105cd84..ae57efab1f3 100644 --- a/include/hw/virtio/virtio-iommu.h +++ b/include/hw/virtio/virtio-iommu.h @@ -58,6 +58,7 @@ typedef struct VirtIOIOMMU { GTree *domains; QemuMutex mutex; GTree *endpoints; + bool boot_bypass; } VirtIOIOMMU; #endif diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c index 5d56865e569..3b821fc005d 100644 --- a/hw/virtio/virtio-iommu.c +++ b/hw/virtio/virtio-iommu.c @@ -595,6 +595,24 @@ static void virtio_iommu_report_fault(VirtIOIOMMU *viommu, uint8_t reason, } +static bool virtio_iommu_bypass_is_allowed(VirtIOIOMMU *s) +{ + VirtIODevice *vdev = &s->parent_obj; + /* + * Allow bypass if: + * - boot_bypass is enabled and the BYPASS feature hasn't yet been + * acknowledged. + * - the BYPASS feature has been negotiated. + */ + if (s->boot_bypass && !(vdev->status & VIRTIO_CONFIG_S_FEATURES_OK)) { + return true; + } + if (virtio_vdev_has_feature(vdev, VIRTIO_IOMMU_F_BYPASS)) { + return true; + } + return false; +} + static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr, IOMMUAccessFlags flag, int iommu_idx) @@ -621,8 +639,7 @@ static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr, .perm = IOMMU_NONE, }; - bypass_allowed = virtio_vdev_has_feature(&s->parent_obj, - VIRTIO_IOMMU_F_BYPASS); + bypass_allowed = virtio_iommu_bypass_is_allowed(s); sid = virtio_iommu_get_bdf(sdev); @@ -947,6 +964,7 @@ static const VMStateDescription vmstate_virtio_iommu = { static Property virtio_iommu_properties[] = { DEFINE_PROP_LINK("primary-bus", VirtIOIOMMU, primary_bus, "PCI", PCIBus *), + DEFINE_PROP_BOOL("boot-bypass", VirtIOIOMMU, boot_bypass, true), DEFINE_PROP_END_OF_LIST(), };