[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 5 May 2016 19:42:38 +0800
From: Yongji Xie <xyjxie@...ux.vnet.ibm.com>
To: David Laight <David.Laight@...LAB.COM>,
"'Tian, Kevin'" <kevin.tian@...el.com>,
"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
"linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
"iommu@...ts.linux-foundation.org" <iommu@...ts.linux-foundation.org>
Cc: "alex.williamson@...hat.com" <alex.williamson@...hat.com>,
"bhelgaas@...gle.com" <bhelgaas@...gle.com>,
"aik@...abs.ru" <aik@...abs.ru>,
"benh@...nel.crashing.org" <benh@...nel.crashing.org>,
"paulus@...ba.org" <paulus@...ba.org>,
"mpe@...erman.id.au" <mpe@...erman.id.au>,
"joro@...tes.org" <joro@...tes.org>,
"warrier@...ux.vnet.ibm.com" <warrier@...ux.vnet.ibm.com>,
"zhong@...ux.vnet.ibm.com" <zhong@...ux.vnet.ibm.com>,
"nikunj@...ux.vnet.ibm.com" <nikunj@...ux.vnet.ibm.com>,
"eric.auger@...aro.org" <eric.auger@...aro.org>,
"will.deacon@....com" <will.deacon@....com>,
"gwshan@...ux.vnet.ibm.com" <gwshan@...ux.vnet.ibm.com>,
"alistair@...ple.id.au" <alistair@...ple.id.au>,
"ruscur@...sell.cc" <ruscur@...sell.cc>
Subject: Re: [PATCH 5/5] vfio-pci: Allow to mmap MSI-X table if interrupt
remapping is supported
Hi David and Kevin,
On 2016/5/5 17:54, David Laight wrote:
> From: Tian, Kevin
>> Sent: 05 May 2016 10:37
> ...
>>> Acutually, we are not aimed at accessing MSI-X table from
>>> guest. So I think it's safe to passthrough MSI-X table if we
>>> can make sure guest kernel would not touch MSI-X table in
>>> normal code path such as para-virtualized guest kernel on PPC64.
>>>
>> Then how do you prevent malicious guest kernel accessing it?
> Or a malicious guest driver for an ethernet card setting up
> the receive buffer ring to contain a single word entry that
> contains the address associated with an MSI-X interrupt and
> then using a loopback mode to cause a specific packet be
> received that writes the required word through that address.
>
> Remember the PCIe cycle for an interrupt is a normal memory write
> cycle.
>
> David
>
If we have enough permission to load a malicious driver or
kernel, we can easily break the guest without exposed
MSI-X table.
I think it should be safe to expose MSI-X table if we can
make sure that malicious guest driver/kernel can't use
the MSI-X table to break other guest or host. The
capability of IRQ remapping could provide this
kind of protection.
Thanks,
Yongji
Powered by blists - more mailing lists