diff --git a/patches.suse/dmaengine-idxd-Do-not-enable-user-type-Work-Queue-wi.patch b/patches.suse/dmaengine-idxd-Do-not-enable-user-type-Work-Queue-wi.patch new file mode 100644 index 0000000..c7420e6 --- /dev/null +++ b/patches.suse/dmaengine-idxd-Do-not-enable-user-type-Work-Queue-wi.patch @@ -0,0 +1,78 @@ +From 0ec8ce07394442d722806fe61b901a5b2b17249d Mon Sep 17 00:00:00 2001 +From: Fenghua Yu +Date: Fri, 14 Oct 2022 15:25:41 -0700 +Subject: [PATCH] dmaengine: idxd: Do not enable user type Work Queue without Shared Virtual Addressing +Git-commit: 0ec8ce07394442d722806fe61b901a5b2b17249d +Patch-mainline: v6.1-rc5 +References: git-fixes + +When the idxd_user_drv driver is bound to a Work Queue (WQ) device +without IOMMU or with IOMMU Passthrough without Shared Virtual +Addressing (SVA), the application gains direct access to physical +memory via the device by programming physical address to a submitted +descriptor. This allows direct userspace read and write access to +arbitrary physical memory. This is inconsistent with the security +goals of a good kernel API. + +Unlike vfio_pci driver, the IDXD char device driver does not provide any +ways to pin user pages and translate the address from user VA to IOVA or +PA without IOMMU SVA. Therefore the application has no way to instruct the +device to perform DMA function. This makes the char device not usable for +normal application usage. + +Since user type WQ without SVA cannot be used for normal application usage +and presents the security issue, bind idxd_user_drv driver and enable user +type WQ only when SVA is enabled (i.e. user PASID is enabled). + +Fixes: 448c3de8ac83 ("dmaengine: idxd: create user driver for wq 'device'") +Cc: stable@vger.kernel.org +Suggested-by: Arjan Van De Ven +Signed-off-by: Fenghua Yu +Reviewed-by: Dave Jiang +Reviewed-by: Jerry Snitselaar +Link: https://lore.kernel.org/r/20221014222541.3912195-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Acked-by: Takashi Iwai + +--- + drivers/dma/idxd/cdev.c | 18 ++++++++++++++++++ + include/uapi/linux/idxd.h | 1 + + 2 files changed, 19 insertions(+) + +--- a/drivers/dma/idxd/cdev.c ++++ b/drivers/dma/idxd/cdev.c +@@ -312,6 +312,24 @@ static int idxd_user_drv_probe(struct id + if (idxd->state != IDXD_DEV_ENABLED) + return -ENXIO; + ++ /* ++ * User type WQ is enabled only when SVA is enabled for two reasons: ++ * - If no IOMMU or IOMMU Passthrough without SVA, userspace ++ * can directly access physical address through the WQ. ++ * - The IDXD cdev driver does not provide any ways to pin ++ * user pages and translate the address from user VA to IOVA or ++ * PA without IOMMU SVA. Therefore the application has no way ++ * to instruct the device to perform DMA function. This makes ++ * the cdev not usable for normal application usage. ++ */ ++ if (!device_user_pasid_enabled(idxd)) { ++ idxd->cmd_status = IDXD_SCMD_WQ_USER_NO_IOMMU; ++ dev_dbg(&idxd->pdev->dev, ++ "User type WQ cannot be enabled without SVA.\n"); ++ ++ return -EOPNOTSUPP; ++ } ++ + mutex_lock(&wq->wq_lock); + wq->type = IDXD_WQT_USER; + rc = __drv_enable_wq(wq); +--- a/include/uapi/linux/idxd.h ++++ b/include/uapi/linux/idxd.h +@@ -29,6 +29,7 @@ enum idxd_scmd_stat { + IDXD_SCMD_WQ_NO_SIZE = 0x800e0000, + IDXD_SCMD_WQ_NO_PRIV = 0x800f0000, + IDXD_SCMD_WQ_IRQ_ERR = 0x80100000, ++ IDXD_SCMD_WQ_USER_NO_IOMMU = 0x80110000, + }; + + #define IDXD_SCMD_SOFTERR_MASK 0x80000000 diff --git a/series.conf b/series.conf index bbbbb17..c830c54 100644 --- a/series.conf +++ b/series.conf @@ -17193,6 +17193,7 @@ patches.suse/mmc-sdhci-esdhc-imx-use-the-correct-host-caps-for-MM.patch patches.suse/spi-stm32-Print-summary-callbacks-suppressed-message.patch patches.suse/spi-stm32-fix-stm32_spi_prepare_mbr-that-halves-spi-.patch + patches.suse/dmaengine-idxd-Do-not-enable-user-type-Work-Queue-wi.patch patches.suse/dmaengine-pxa_dma-use-platform_get_irq_optional.patch patches.suse/dmaengine-mv_xor_v2-Fix-a-resource-leak-in-mv_xor_v2.patch patches.suse/dmaengine-ti-k3-udma-glue-fix-memory-leak-when-regis.patch