dmaengine: idxd: add a new security check to deal with a hardware erratum

On Sapphire Rapids and related platforms, the DSA and IAA devices have an
erratum that causes direct access (for example, by using the ENQCMD or
MOVDIR64 instructions) from untrusted applications to be a security problem.

To solve this, add a flag to the PCI device enumeration and device structures
to indicate the presence/absence of this security exposure. In the mmap()
method of the device, this flag is then used to enforce that the user
has the CAP_SYS_RAWIO capability.

In a future patch, a write() based method will be added that allows untrusted
applications submit work to the accelerator, where the kernel can do
sanity checking on the user input to ensure secure operation of the accelerator.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index c095a2c8f65956c696eab833f32308124dee2fd9..9326a918b132c64c29e45e58141ee84f5444b15c 100644 (file)
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -400,6 +400,18 @@ static int idxd_cdev_mmap(struct file *filp, struct vm_area_struct *vma)
        int rc;
 
        dev_dbg(&pdev->dev, "%s called\n", __func__);
+
+       /*
+        * Due to an erratum in some of the devices supported by the driver,
+        * direct user submission to the device can be unsafe.
+        * (See the INTEL-SA-01084 security advisory)
+        *
+        * For the devices that exhibit this behavior, require that the user
+        * has CAP_SYS_RAWIO capabilities.
+        */
+       if (!idxd->user_submission_safe && !capable(CAP_SYS_RAWIO))
+               return -EPERM;
+
        rc = check_vma(wq, vma, __func__);
        if (rc < 0)
                return rc;

diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h
index 7b98944135eb440c2c5659b8e4a637085698f93c..868b724a3b75bb3648f34801cf5c5eedc1489cf4 100644 (file)
--- a/drivers/dma/idxd/idxd.h
+++ b/drivers/dma/idxd/idxd.h
@@ -288,6 +288,7 @@ struct idxd_driver_data {
        int evl_cr_off;
        int cr_status_off;
        int cr_result_off;
+       bool user_submission_safe;
        load_device_defaults_fn_t load_device_defaults;
 };
 
@@ -374,6 +375,8 @@ struct idxd_device {
 
        struct dentry *dbgfs_dir;
        struct dentry *dbgfs_evl_file;
+
+       bool user_submission_safe;
 };
 
 static inline unsigned int evl_ent_size(struct idxd_device *idxd)

diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index 264c4e47d7cca5651c02595652419970504e554a..a7295943fa223353187aa2a295d4fc7fe1b7c4ce 100644 (file)
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -47,6 +47,7 @@ static struct idxd_driver_data idxd_driver_data[] = {
                .align = 32,
                .dev_type = &dsa_device_type,
                .evl_cr_off = offsetof(struct dsa_evl_entry, cr),
+               .user_submission_safe = false, /* See INTEL-SA-01084 security advisory */
                .cr_status_off = offsetof(struct dsa_completion_record, status),
                .cr_result_off = offsetof(struct dsa_completion_record, result),
        },
@@ -57,6 +58,7 @@ static struct idxd_driver_data idxd_driver_data[] = {
                .align = 64,
                .dev_type = &iax_device_type,
                .evl_cr_off = offsetof(struct iax_evl_entry, cr),
+               .user_submission_safe = false, /* See INTEL-SA-01084 security advisory */
                .cr_status_off = offsetof(struct iax_completion_record, status),
                .cr_result_off = offsetof(struct iax_completion_record, error_code),
                .load_device_defaults = idxd_load_iaa_device_defaults,
@@ -774,6 +776,8 @@ static int idxd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        dev_info(&pdev->dev, "Intel(R) Accelerator Device (v%x)\n",
                 idxd->hw.version);
 
+       idxd->user_submission_safe = data->user_submission_safe;
+
        return 0;
 
  err_dev_register: