lkml.org 
[lkml]   [2022]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRE: [RFC] thunderbolt: Automatically authorize PCIe tunnels when IOMMU is active
    Date
    [AMD Official Use Only]



    > -----Original Message-----
    > From: Mika Westerberg <mika.westerberg@linux.intel.com>
    > Sent: Wednesday, March 16, 2022 01:30
    > To: Limonciello, Mario <Mario.Limonciello@amd.com>
    > Cc: Andreas Noever <andreas.noever@gmail.com>; Michael Jamet
    > <michael.jamet@intel.com>; Yehezkel Bernat <YehezkelShB@gmail.com>;
    > open list:THUNDERBOLT DRIVER <linux-usb@vger.kernel.org>; open list
    > <linux-kernel@vger.kernel.org>
    > Subject: Re: [RFC] thunderbolt: Automatically authorize PCIe tunnels when
    > IOMMU is active
    >
    > Hi Mario,
    >
    > On Tue, Mar 15, 2022 at 04:30:08PM -0500, Mario Limonciello wrote:
    > > Historically TBT3 in Linux used "Thunderbolt security levels" as a primary
    > > means of "security" against DMA attacks. This mean that users would need
    > to
    > > ack any device plugged in via userspace. In ~2018 machines started to use
    > > the IOMMU for protection, but instead of dropping security levels a
    > > convoluted flow was introduced:
    > > * User hotplugs device
    > > * Driver discovers supported tunnels
    > > * Driver emits a uevent to userspace that a PCIe tunnel is present
    > > * Userspace reads 'iommu_dma_protection' attribute (which currently
    > > indicates an Intel IOMMU is present and was enabled pre-boot not that
    > > it's active "now")
    > > * Based on that value userspace then authorizes automatically or prompts
    > > the user like how security level based support worked.
    >
    > There are legitimate reasons to disable PCIe tunneling even if the IOMMU
    > bits are in place. The ACPI _OSC allows the boot firmware to do so and
    > our "security levels" allows the userspace policy to do the same. I
    > would not like to change that unless absolutely necessary.

    Actually I intentionally left that in the RFC patch, to only do this based off
    of tb_acpi_may_tunnel_pcie, so I think that should still work as you described
    if boot firmware turned off PCIe tunneling.

    \
     
     \ /
      Last update: 2022-03-16 14:07    [W:2.977 / U:0.424 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site