linux-kernel - Re: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned VINTF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 17 Apr 2024 09:04:21 -0700
From: Nicolin Chen <nicolinc@...dia.com>
To: Shameerali Kolothum Thodi <shameerali.kolothum.thodi@...wei.com>
CC: "will@...nel.org" <will@...nel.org>, "robin.murphy@....com"
	<robin.murphy@....com>, "joro@...tes.org" <joro@...tes.org>, "jgg@...dia.com"
	<jgg@...dia.com>, "thierry.reding@...il.com" <thierry.reding@...il.com>,
	"vdumpa@...dia.com" <vdumpa@...dia.com>, "jonathanh@...dia.com"
	<jonathanh@...dia.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "iommu@...ts.linux.dev"
	<iommu@...ts.linux.dev>, "linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-tegra@...r.kernel.org"
	<linux-tegra@...r.kernel.org>
Subject: Re: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned
 VINTF

On Wed, Apr 17, 2024 at 03:12:57PM +0000, Shameerali Kolothum Thodi wrote:
> > -----Original Message-----
> > From: Nicolin Chen <nicolinc@...dia.com>
> > Sent: Saturday, April 13, 2024 4:44 AM
> > To: will@...nel.org; robin.murphy@....com
> > Cc: joro@...tes.org; jgg@...dia.com; thierry.reding@...il.com;
> > vdumpa@...dia.com; jonathanh@...dia.com; linux-kernel@...r.kernel.org;
> > iommu@...ts.linux.dev; linux-arm-kernel@...ts.infradead.org; linux-
> > tegra@...r.kernel.org
> > Subject: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned
> > VINTF
> >
> > When VCMDQs are assigned to a VINTF owned by a guest (HYP_OWN bit unset),
> > only TLB and ATC invalidation commands are supported by the VCMDQ HW. So,
> > add a new helper to scan the input cmds to make sure every single command
> > is supported when selecting a queue.
> >
> > Note that the guest VM shouldn't have HYP_OWN bit being set regardless of
> > guest kernel driver writing it or not, i.e. the hypervisor running in the
> > host OS should wire this bit to zero when trapping a write access to this
> > VINTF_CONFIG register from a guest kernel.
> 
> Just curious, suppose there is a malicious guest with a compromised kernel
> which bypasses the HYP_OWN bit check and issues other commands, does
> the hardware has the capability to detect it and not make the host unstable
> in any way?

Only that specific VINTF/VCMDQ would stop and error an IRQ.

Even a device command (ATC_INV) would be strictly checked
against the Stream ID table that's set at the host level.

Thanks
Nicolin