History

vfio: Include No-IOMMU mode

There is really no way to safely give a user full access to a DMA capable device without an IOMMU to protect the host system. There is also no way to provide DMA translation, for use cases such as device assignment to virtual machines. However, there are still those users that want userspace drivers even under those conditions. The UIO driver exists for this use case, but does not provide the degree of device access and programming that VFIO has. In an effort to avoid code duplication, this introduces a No-IOMMU mode for VFIO. This mode requires building VFIO with CONFIG_VFIO_NOIOMMU and enabling the "enable_unsafe_noiommu_mode" option on the vfio driver. This should make it very clear that this mode is not safe. Additionally, CAP_SYS_RAWIO privileges are necessary to work with groups and containers using this mode. Groups making use of this support are named /dev/vfio/noiommu-$GROUP and can only make use of the special VFIO_NOIOMMU_IOMMU for the container. Use of this mode, specifically binding a device without a native IOMMU group to a VFIO bus driver will taint the kernel and should therefore not be considered supported. This patch includes no-iommu support for the vfio-pci bus driver only.

Alex Williamson committed 11 years ago

Commit 033291e1 parent e324fc85 files · +209 −10Browse files

Unified · Split

5 files
  1. drivers/vfio/Kconfig +15 −0
  2. drivers/vfio/pci/vfio_pci.c +4 −4
  3. drivers/vfio/vfio.c +180 −6
  4. include/linux/vfio.h +3 −0
  5. include/uapi/linux/vfio.h +7 −0
drivers/vfio/Kconfig+15−0
@@ -31,5 +31,20 @@ menuconfig VFIO · 30 unmodified lines
3131
3232 If you don't know what to do here, say N.
3333
34+menuconfig VFIO_NOIOMMU
35+ bool "VFIO No-IOMMU support"
36+ depends on VFIO
37+ help
38+ VFIO is built on the ability to isolate devices using the IOMMU.
39+ Only with an IOMMU can userspace access to DMA capable devices be
40+ considered secure. VFIO No-IOMMU mode enables IOMMU groups for
41+ devices without IOMMU backing for the purpose of re-using the VFIO
42+ infrastructure in a non-secure mode. Use of this mode will result
43+ in an unsupportable kernel and will therefore taint the kernel.
44+ Device assignment to virtual machines is also not possible with
45+ this mode since there is no IOMMU to provide DMA translation.
46+
47+ If you don't know what to do here, say N.
48+
3449 source "drivers/vfio/pci/Kconfig"
3550 source "drivers/vfio/platform/Kconfig"
drivers/vfio/pci/vfio_pci.c+4−4
@@ -940,13 +940,13 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 939 unmodified lines
940940 if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
941941 return -EINVAL;
942942
943− group = iommu_group_get(&pdev->dev);
943+ group = vfio_iommu_group_get(&pdev->dev);
944944 if (!group)
945945 return -EINVAL;
946946
947947 vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
948948 if (!vdev) {
949− iommu_group_put(group);
949+ vfio_iommu_group_put(group, &pdev->dev);
950950 return -ENOMEM;
951951 }
952952
@@ -957,7 +957,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 4 unmodified lines
957957
958958 ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
959959 if (ret) {
960− iommu_group_put(group);
960+ vfio_iommu_group_put(group, &pdev->dev);
961961 kfree(vdev);
962962 return ret;
963963 }
@@ -993,7 +993,7 @@ static void vfio_pci_remove(struct pci_dev *pdev) · 29 unmodified lines
993993 if (!vdev)
994994 return;
995995
996− iommu_group_put(pdev->dev.iommu_group);
996+ vfio_iommu_group_put(pdev->dev.iommu_group, &pdev->dev);
997997 kfree(vdev);
998998
999999 if (vfio_pci_is_vga(pdev)) {
drivers/vfio/vfio.c+180−6
@@ -62,6 +62,7 @@ struct vfio_container { · 61 unmodified lines
6262 struct rw_semaphore group_lock;
6363 struct vfio_iommu_driver *iommu_driver;
6464 void *iommu_data;
65+ bool noiommu;
6566 };
6667
6768 struct vfio_unbound_dev {
@@ -84,6 +85,7 @@ struct vfio_group { · 16 unmodified lines
8485 struct list_head unbound_list;
8586 struct mutex unbound_lock;
8687 atomic_t opened;
88+ bool noiommu;
8789 };
8890
8991 struct vfio_device {
@@ -95,6 +97,147 @@ struct vfio_device { · 5 unmodified lines
9597 void *device_data;
9698 };
9799
100+#ifdef CONFIG_VFIO_NOIOMMU
101+static bool noiommu __read_mostly;
102+module_param_named(enable_unsafe_noiommu_support,
103+ noiommu, bool, S_IRUGO | S_IWUSR);
104+MODULE_PARM_DESC(enable_unsafe_noiommu_mode, "Enable UNSAFE, no-IOMMU mode. This mode provides no device isolation, no DMA translation, no host kernel protection, cannot be used for device assignment to virtual machines, requires RAWIO permissions, and will taint the kernel. If you do not know what this is for, step away. (default: false)");
105+#endif
106+
107+/*
108+ * vfio_iommu_group_{get,put} are only intended for VFIO bus driver probe
109+ * and remove functions, any use cases other than acquiring the first
110+ * reference for the purpose of calling vfio_add_group_dev() or removing
111+ * that symmetric reference after vfio_del_group_dev() should use the raw
112+ * iommu_group_{get,put} functions. In particular, vfio_iommu_group_put()
113+ * removes the device from the dummy group and cannot be nested.
114+ */
115+struct iommu_group *vfio_iommu_group_get(struct device *dev)
116+{
117+ struct iommu_group *group;
118+ int __maybe_unused ret;
119+
120+ group = iommu_group_get(dev);
121+
122+#ifdef CONFIG_VFIO_NOIOMMU
123+ /*
124+ * With noiommu enabled, an IOMMU group will be created for a device
125+ * that doesn't already have one and doesn't have an iommu_ops on their
126+ * bus. We use iommu_present() again in the main code to detect these
127+ * fake groups.
128+ */
129+ if (group || !noiommu || iommu_present(dev->bus))
130+ return group;
131+
132+ group = iommu_group_alloc();
133+ if (IS_ERR(group))
134+ return NULL;
135+
136+ iommu_group_set_name(group, "vfio-noiommu");
137+ ret = iommu_group_add_device(group, dev);
138+ iommu_group_put(group);
139+ if (ret)
140+ return NULL;
141+
142+ /*
143+ * Where to taint? At this point we've added an IOMMU group for a
144+ * device that is not backed by iommu_ops, therefore any iommu_
145+ * callback using iommu_ops can legitimately Oops. So, while we may
146+ * be about to give a DMA capable device to a user without IOMMU
147+ * protection, which is clearly taint-worthy, let's go ahead and do
148+ * it here.
149+ */
150+ add_taint(TAINT_USER, LOCKDEP_STILL_OK);
151+ dev_warn(dev, "Adding kernel taint for vfio-noiommu group on device\n");
152+#endif
153+
154+ return group;
155+}
156+EXPORT_SYMBOL_GPL(vfio_iommu_group_get);
157+
158+void vfio_iommu_group_put(struct iommu_group *group, struct device *dev)
159+{
160+#ifdef CONFIG_VFIO_NOIOMMU
161+ if (!iommu_present(dev->bus))
162+ iommu_group_remove_device(dev);
163+#endif
164+
165+ iommu_group_put(group);
166+}
167+EXPORT_SYMBOL_GPL(vfio_iommu_group_put);
168+
169+#ifdef CONFIG_VFIO_NOIOMMU
170+static void *vfio_noiommu_open(unsigned long arg)
171+{
172+ if (arg != VFIO_NOIOMMU_IOMMU)
173+ return ERR_PTR(-EINVAL);
174+ if (!capable(CAP_SYS_RAWIO))
175+ return ERR_PTR(-EPERM);
176+
177+ return NULL;
178+}
179+
180+static void vfio_noiommu_release(void *iommu_data)
181+{
182+}
183+
184+static long vfio_noiommu_ioctl(void *iommu_data,
185+ unsigned int cmd, unsigned long arg)
186+{
187+ if (cmd == VFIO_CHECK_EXTENSION)
188+ return arg == VFIO_NOIOMMU_IOMMU ? 1 : 0;
189+
190+ return -ENOTTY;
191+}
192+
193+static int vfio_iommu_present(struct device *dev, void *unused)
194+{
195+ return iommu_present(dev->bus) ? 1 : 0;
196+}
197+
198+static int vfio_noiommu_attach_group(void *iommu_data,
199+ struct iommu_group *iommu_group)
200+{
201+ return iommu_group_for_each_dev(iommu_group, NULL,
202+ vfio_iommu_present) ? -EINVAL : 0;
203+}
204+
205+static void vfio_noiommu_detach_group(void *iommu_data,
206+ struct iommu_group *iommu_group)
207+{
208+}
209+
210+static struct vfio_iommu_driver_ops vfio_noiommu_ops = {
211+ .name = "vfio-noiommu",
212+ .owner = THIS_MODULE,
213+ .open = vfio_noiommu_open,
214+ .release = vfio_noiommu_release,
215+ .ioctl = vfio_noiommu_ioctl,
216+ .attach_group = vfio_noiommu_attach_group,
217+ .detach_group = vfio_noiommu_detach_group,
218+};
219+
220+static struct vfio_iommu_driver vfio_noiommu_driver = {
221+ .ops = &vfio_noiommu_ops,
222+};
223+
224+/*
225+ * Wrap IOMMU drivers, the noiommu driver is the one and only driver for
226+ * noiommu groups (and thus containers) and not available for normal groups.
227+ */
228+#define vfio_for_each_iommu_driver(con, pos) \
229+ for (pos = con->noiommu ? &vfio_noiommu_driver : \
230+ list_first_entry(&vfio.iommu_drivers_list, \
231+ struct vfio_iommu_driver, vfio_next); \
232+ (con->noiommu ? pos != NULL : \
233+ &pos->vfio_next != &vfio.iommu_drivers_list); \
234+ pos = con->noiommu ? NULL : list_next_entry(pos, vfio_next))
235+#else
236+#define vfio_for_each_iommu_driver(con, pos) \
237+ list_for_each_entry(pos, &vfio.iommu_drivers_list, vfio_next)
238+#endif
239+
240+
98241 /**
99242 * IOMMU driver registration
100243 */
@@ -199,7 +342,8 @@ static void vfio_group_unlock_and_free(struct vfio_group *group) · 98 unmodified lines
199342 /**
200343 * Group objects - create, release, get, put, search
201344 */
202−static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group)
345+static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group,
346+ bool noiommu)
203347 {
204348 struct vfio_group *group, *tmp;
205349 struct device *dev;
@@ -217,6 +361,7 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group) · 11 unmodified lines
217361 atomic_set(&group->container_users, 0);
218362 atomic_set(&group->opened, 0);
219363 group->iommu_group = iommu_group;
364+ group->noiommu = noiommu;
220365
221366 group->nb.notifier_call = vfio_iommu_group_notifier;
222367
@@ -252,7 +397,8 @@ static struct vfio_group *vfio_create_group(struct iommu_group *iommu_group) · 29 unmodified lines
252397
253398 dev = device_create(vfio.class, NULL,
254399 MKDEV(MAJOR(vfio.group_devt), minor),
255− group, "%d", iommu_group_id(iommu_group));
400+ group, "%s%d", noiommu ? "noiommu-" : "",
401+ iommu_group_id(iommu_group));
256402 if (IS_ERR(dev)) {
257403 vfio_free_group_minor(minor);
258404 vfio_group_unlock_and_free(group);
@@ -640,7 +786,8 @@ int vfio_add_group_dev(struct device *dev, · 381 unmodified lines
640786
641787 group = vfio_group_get_from_iommu(iommu_group);
642788 if (!group) {
643− group = vfio_create_group(iommu_group);
789+ group = vfio_create_group(iommu_group,
790+ !iommu_present(dev->bus));
644791 if (IS_ERR(group)) {
645792 iommu_group_put(iommu_group);
646793 return PTR_ERR(group);
@@ -852,8 +999,7 @@ static long vfio_ioctl_check_extension(struct vfio_container *container, · 205 unmodified lines
852999 */
8531000 if (!driver) {
8541001 mutex_lock(&vfio.iommu_drivers_lock);
855− list_for_each_entry(driver, &vfio.iommu_drivers_list,
856− vfio_next) {
1002+ vfio_for_each_iommu_driver(container, driver) {
8571003 if (!try_module_get(driver->ops->owner))
8581004 continue;
8591005
@@ -922,7 +1068,7 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, · 62 unmodified lines
9221068 }
9231069
9241070 mutex_lock(&vfio.iommu_drivers_lock);
925− list_for_each_entry(driver, &vfio.iommu_drivers_list, vfio_next) {
1071+ vfio_for_each_iommu_driver(container, driver) {
9261072 void *data;
9271073
9281074 if (!try_module_get(driver->ops->owner))
@@ -1187,6 +1333,9 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd) · 258 unmodified lines
11871333 if (atomic_read(&group->container_users))
11881334 return -EINVAL;
11891335
1336+ if (group->noiommu && !capable(CAP_SYS_RAWIO))
1337+ return -EPERM;
1338+
11901339 f = fdget(container_fd);
11911340 if (!f.file)
11921341 return -EBADF;
@@ -1202,6 +1351,13 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd) · 9 unmodified lines
12021351
12031352 down_write(&container->group_lock);
12041353
1354+ /* Real groups and fake groups cannot mix */
1355+ if (!list_empty(&container->group_list) &&
1356+ container->noiommu != group->noiommu) {
1357+ ret = -EPERM;
1358+ goto unlock_out;
1359+ }
1360+
12051361 driver = container->iommu_driver;
12061362 if (driver) {
12071363 ret = driver->ops->attach_group(container->iommu_data,
@@ -1211,6 +1367,7 @@ static int vfio_group_set_container(struct vfio_group *group, int container_fd) · 3 unmodified lines
12111367 }
12121368
12131369 group->container = container;
1370+ container->noiommu = group->noiommu;
12141371 list_add(&group->container_next, &container->group_list);
12151372
12161373 /* Get a reference on the container and mark a user within the group */
@@ -1241,6 +1398,9 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf) · 24 unmodified lines
12411398 !group->container->iommu_driver || !vfio_group_viable(group))
12421399 return -EINVAL;
12431400
1401+ if (group->noiommu && !capable(CAP_SYS_RAWIO))
1402+ return -EPERM;
1403+
12441404 device = vfio_device_get_from_name(group, buf);
12451405 if (!device)
12461406 return -ENODEV;
@@ -1283,6 +1443,10 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf) · 36 unmodified lines
12831443
12841444 fd_install(ret, filep);
12851445
1446+ if (group->noiommu)
1447+ dev_warn(device->dev, "vfio-noiommu device opened by user "
1448+ "(%s:%d)\n", current->comm, task_pid_nr(current));
1449+
12861450 return ret;
12871451 }
12881452
@@ -1371,6 +1535,11 @@ static int vfio_group_fops_open(struct inode *inode, struct file *filep) · 82 unmodified lines
13711535 if (!group)
13721536 return -ENODEV;
13731537
1538+ if (group->noiommu && !capable(CAP_SYS_RAWIO)) {
1539+ vfio_group_put(group);
1540+ return -EPERM;
1541+ }
1542+
13741543 /* Do we need multiple instances of the group open? Seems not. */
13751544 opened = atomic_cmpxchg(&group->opened, 0, 1);
13761545 if (opened) {
@@ -1533,6 +1702,11 @@ struct vfio_group *vfio_group_get_external_user(struct file *filep) · 156 unmodified lines
15331702 if (!atomic_inc_not_zero(&group->container_users))
15341703 return ERR_PTR(-EINVAL);
15351704
1705+ if (group->noiommu) {
1706+ atomic_dec(&group->container_users);
1707+ return ERR_PTR(-EPERM);
1708+ }
1709+
15361710 if (!group->container->iommu_driver ||
15371711 !vfio_group_viable(group)) {
15381712 atomic_dec(&group->container_users);
include/linux/vfio.h+3−0
@@ -44,6 +44,9 @@ struct vfio_device_ops { · 43 unmodified lines
4444 void (*request)(void *device_data, unsigned int count);
4545 };
4646
47+extern struct iommu_group *vfio_iommu_group_get(struct device *dev);
48+extern void vfio_iommu_group_put(struct iommu_group *group, struct device *dev);
49+
4750 extern int vfio_add_group_dev(struct device *dev,
4851 const struct vfio_device_ops *ops,
4952 void *device_data);
include/uapi/linux/vfio.h+7−0
@@ -38,6 +38,13 @@ · 37 unmodified lines
3838
3939 #define VFIO_SPAPR_TCE_v2_IOMMU 7
4040
41+/*
42+ * The No-IOMMU IOMMU offers no translation or isolation for devices and
43+ * supports no ioctls outside of VFIO_CHECK_EXTENSION. Use of VFIO's No-IOMMU
44+ * code will taint the host kernel and should be used with extreme caution.
45+ */
46+#define VFIO_NOIOMMU_IOMMU 8
47+
4148 /*
4249 * The IOCTL interface is designed for extensibility by embedding the
4350 * structure length (argsz) and flags into structures passed between