@@ -321,9 +321,14 @@ void pci_bus_add_device(struct pci_dev *dev)
pci_bridge_d3_update(dev);
dev->match_driver = true;
- retval = device_attach(&dev->dev);
- if (retval < 0 && retval != -EPROBE_DEFER)
- pci_warn(dev, "device attach failed (%d)\n", retval);
+
+ if (dev->untrusted && pci_dont_attach_untrusted_devs) {
+ pci_info(dev, "not attaching untrusted device\n");
+ } else {
+ retval = device_attach(&dev->dev);
+ if (retval < 0 && retval != -EPROBE_DEFER)
+ pci_warn(dev, "device attach failed (%d)\n", retval);
+ }
pci_dev_assign_added(dev, true);
}
@@ -127,6 +127,13 @@ static bool pcie_ats_disabled;
/* If set, the PCI config space of each device is printed during boot. */
bool pci_early_dump;
+/*
+ * If set, the devices with "untrusted" flag shall not be attached automatically
+ * Userspace will need to attach them manually:
+ * echo <pci device> > /sys/bus/pci/drivers/<driver>/bind
+ */
+bool pci_dont_attach_untrusted_devs;
+
bool pci_ats_disabled(void)
{
return pcie_ats_disabled;
@@ -6522,6 +6529,8 @@ static int __init pci_setup(char *str)
pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
} else if (!strncmp(str, "disable_acs_redir=", 18)) {
disable_acs_redir_param = str + 18;
+ } else if (!strcmp(str, "dont_attach_untrusted_devs")) {
+ pci_dont_attach_untrusted_devs = true;
} else {
pr_err("PCI: Unknown option `%s'\n", str);
}
@@ -13,6 +13,7 @@
extern const unsigned char pcie_link_speed[];
extern bool pci_early_dump;
+extern bool pci_dont_attach_untrusted_devs;
bool pcie_cap_has_lnkctl(const struct pci_dev *dev);
bool pcie_cap_has_rtctl(const struct pci_dev *dev);
Introduce a PCI parameter that disables the automatic attachment of untrusted devices to their drivers. Signed-off-by: Rajat Jain <rajatja@google.com> --- Context: I set out to implement the approach outlined in https://lkml.org/lkml/2020/6/9/1331 https://lkml.org/lkml/2020/6/15/1453 But to my surprise, I found that the new hotplugged PCI devices were getting automatically attached to drivers even though /sys/bus/pci/drivers_autoprobe was set to 0. I realized that the device core's "drivers_autoprobe": * only disables the *initial* probe of the device (i.e. from device_add()). If a subsystem calls device_attach() explicitly for its devices like PCI subsystem does, the drivers_autoprobe setting does not matter. The core will attach device to the driver. This looks like correct semantic behavior to me because PCI is explicitly calling device_attach(), which is a way to explicitly ask the core to find and attach a driver for a device. * "drivers_autoprobe" cannot be controlled at boot time (to restrict any drivers before userspace comes up). The options I considered were: 1) Change device_attach() so that it takes into consideration the drivers_autoprobe property. Not sure if this is semantically correct thing to do though. If I do this, then the only way a driver can be attached to the drivers would be via userspace (/sys/bus/pci/drivers/bind) (Good for our use case though!). 2) Make the drivers_autoprobe property available to PCI to use (currently it is private to device core). The PCI could use this to determine whether or not to call device_attach(). This still leaves the other problem (of not being able to set drivers_autoprobe via command line open). 3) I found the pci_dev->match_driver, which seemed similar to what I am trying to do, but can't be controlled from userspace. I considered populating that field based on drivers_autoprobe (still need (2)). But the problem is that there is the AMD IOMMU driver which is setting this independently, so setting the match_driver based on drivers_autoprobe may not be a good idea. May be we can populate it for untrusted devicesi, based on the parameter that I'm introducing? 4) This patch was my option 4 that helps fix both the problems for me. drivers/pci/bus.c | 11 ++++++++--- drivers/pci/pci.c | 9 +++++++++ drivers/pci/pci.h | 1 + 3 files changed, 18 insertions(+), 3 deletions(-)