PCI: Allow drivers to request exclusive config regions

[ Upstream commit 278294798ac9118412c9624a801d3f20f2279363 ]

PCI config space access from user space has traditionally been
unrestricted with writes being an understood risk for device operation.

Unfortunately, device breakage or odd behavior from config writes lacks
indicators that can leave driver writers confused when evaluating
failures.  This is especially true with the new PCIe Data Object
Exchange (DOE) mailbox protocol where backdoor shenanigans from user
space through things such as vendor defined protocols may affect device
operation without complete breakage.

A prior proposal restricted read and writes completely.[1]  Greg and
Bjorn pointed out that proposal is flawed for a couple of reasons.
First, lspci should always be allowed and should not interfere with any
device operation.  Second, setpci is a valuable tool that is sometimes
necessary and it should not be completely restricted.[2]  Finally
methods exist for full lock of device access if required.

Even though access should not be restricted it would be nice for driver
writers to be able to flag critical parts of the config space such that
interference from user space can be detected.

Introduce pci_request_config_region_exclusive() to mark exclusive config
regions.  Such regions trigger a warning and kernel taint if accessed
via user space.

Create pci_warn_once() to restrict the user from spamming the log.

[1] https://lore.kernel.org/all/161663543465.1867664.5674061943008380442.stgit@dwillia2-desk3.amr.corp.intel.com/
[2] https://lore.kernel.org/all/YF8NGeGv9vYcMfTV@kroah.com/

Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Suggested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lore.kernel.org/r/20220926215711.2893286-2-ira.weiny@intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Stable-dep-of: 5e70d0acf082 ("PCI: Add locking to RMW PCI Express Capability Register accessors")
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index ba38fc47d35e9278b460ff391f36d2dddc5f6ea6..dd0d9d9bc5097e567c7eeb50b101b0822d0b2589 100644 (file)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -756,6 +756,13 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj,
        if (ret)
                return ret;
 
+       if (resource_is_exclusive(&dev->driver_exclusive_resource, off,
+                                 count)) {
+               pci_warn_once(dev, "%s: Unexpected write to kernel-exclusive config offset %llx",
+                             current->comm, off);
+               add_taint(TAINT_USER, LOCKDEP_STILL_OK);
+       }
+
        if (off > dev->cfg_size)
                return 0;
        if (off + count > dev->cfg_size) {

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 7170516298b0b09f668a823b9376e732ab827a8b..e3a1dc6432bcd47f0860e946327b4d86ef7266e7 100644 (file)
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2306,6 +2306,12 @@ struct pci_dev *pci_alloc_dev(struct pci_bus *bus)
        INIT_LIST_HEAD(&dev->bus_list);
        dev->dev.type = &pci_dev_type;
        dev->bus = pci_bus_get(bus);
+       dev->driver_exclusive_resource = (struct resource) {
+               .name = "PCI Exclusive",
+               .start = 0,
+               .end = -1,
+       };
+
 #ifdef CONFIG_PCI_MSI
        raw_spin_lock_init(&dev->msi_lock);
 #endif

diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index 27642ca15d932f22823ef7b0a003a2d1ca1333f8..4ae3c541ea6f485943552fff034721042257a88a 100644 (file)
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -318,6 +318,8 @@ extern void __devm_release_region(struct device *dev, struct resource *parent,
                                  resource_size_t start, resource_size_t n);
 extern int iomem_map_sanity_check(resource_size_t addr, unsigned long size);
 extern bool iomem_is_exclusive(u64 addr);
+extern bool resource_is_exclusive(struct resource *resource, u64 addr,
+                                 resource_size_t size);
 
 extern int
 walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,

diff --git a/include/linux/pci.h b/include/linux/pci.h
index 9f617ffdb863f4d1c661e8c128eb6166f9114dfc..4ea8de6890beaba8f598d7158cc5ecf222c74f87 100644 (file)
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -409,6 +409,7 @@ struct pci_dev {
         */
        unsigned int    irq;
        struct resource resource[DEVICE_COUNT_RESOURCE]; /* I/O and memory regions + expansion ROMs */
+       struct resource driver_exclusive_resource;       /* driver exclusive resource ranges */
 
        bool            match_driver;           /* Skip attaching driver */
 
@@ -1408,6 +1409,21 @@ int pci_request_selected_regions(struct pci_dev *, int, const char *);
 int pci_request_selected_regions_exclusive(struct pci_dev *, int, const char *);
 void pci_release_selected_regions(struct pci_dev *, int);
 
+static inline __must_check struct resource *
+pci_request_config_region_exclusive(struct pci_dev *pdev, unsigned int offset,
+                                   unsigned int len, const char *name)
+{
+       return __request_region(&pdev->driver_exclusive_resource, offset, len,
+                               name, IORESOURCE_EXCLUSIVE);
+}
+
+static inline void pci_release_config_region(struct pci_dev *pdev,
+                                            unsigned int offset,
+                                            unsigned int len)
+{
+       __release_region(&pdev->driver_exclusive_resource, offset, len);
+}
+
 /* drivers/pci/bus.c */
 void pci_add_resource(struct list_head *resources, struct resource *res);
 void pci_add_resource_offset(struct list_head *resources, struct resource *res,
@@ -2487,6 +2503,7 @@ void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
 #define pci_crit(pdev, fmt, arg...)    dev_crit(&(pdev)->dev, fmt, ##arg)
 #define pci_err(pdev, fmt, arg...)     dev_err(&(pdev)->dev, fmt, ##arg)
 #define pci_warn(pdev, fmt, arg...)    dev_warn(&(pdev)->dev, fmt, ##arg)
+#define pci_warn_once(pdev, fmt, arg...) dev_warn_once(&(pdev)->dev, fmt, ##arg)
 #define pci_notice(pdev, fmt, arg...)  dev_notice(&(pdev)->dev, fmt, ##arg)
 #define pci_info(pdev, fmt, arg...)    dev_info(&(pdev)->dev, fmt, ##arg)
 #define pci_dbg(pdev, fmt, arg...)     dev_dbg(&(pdev)->dev, fmt, ##arg)

diff --git a/kernel/resource.c b/kernel/resource.c
index 1aeeededdd4c85de06e0a4b3b7abb9478f438254..8f52f880096528b9ffb169bbda7cad8ea8a0d105 100644 (file)
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1693,18 +1693,15 @@ static int strict_iomem_checks;
  *
  * Returns true if exclusive to the kernel, otherwise returns false.
  */
-bool iomem_is_exclusive(u64 addr)
+bool resource_is_exclusive(struct resource *root, u64 addr, resource_size_t size)
 {
        const unsigned int exclusive_system_ram = IORESOURCE_SYSTEM_RAM |
                                                  IORESOURCE_EXCLUSIVE;
        bool skip_children = false, err = false;
-       int size = PAGE_SIZE;
        struct resource *p;
 
-       addr = addr & PAGE_MASK;
-
        read_lock(&resource_lock);
-       for_each_resource(&iomem_resource, p, skip_children) {
+       for_each_resource(root, p, skip_children) {
                if (p->start >= addr + size)
                        break;
                if (p->end < addr) {
@@ -1743,6 +1740,12 @@ bool iomem_is_exclusive(u64 addr)
        return err;
 }
 
+bool iomem_is_exclusive(u64 addr)
+{
+       return resource_is_exclusive(&iomem_resource, addr & PAGE_MASK,
+                                    PAGE_SIZE);
+}
+
 struct resource_entry *resource_list_create_entry(struct resource *res,
                                                  size_t extra_size)
 {