From: Peter Xu <peterx@redhat.com>
To: Alex Williamson <alex.williamson@redhat.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
cohuck@redhat.com, jgg@ziepe.ca
Subject: Re: [PATCH v2 0/3] vfio-pci: Block user access to disabled device MMIO
Date: Thu, 7 May 2020 22:31:56 -0400 [thread overview]
Message-ID: <20200508023156.GV228260@xz-x1> (raw)
In-Reply-To: <20200507163437.77b4bf2e@x1.home>
On Thu, May 07, 2020 at 04:34:37PM -0600, Alex Williamson wrote:
> On Thu, 7 May 2020 17:59:08 -0400
> Peter Xu <peterx@redhat.com> wrote:
>
> > On Tue, May 05, 2020 at 03:54:36PM -0600, Alex Williamson wrote:
> > > v2:
> > >
> > > Locking in 3/ is substantially changed to avoid the retry scenario
> > > within the fault handler, therefore a caller who does not allow retry
> > > will no longer receive a SIGBUS on contention. IOMMU invalidations
> > > are still not included here, I expect that will be a future follow-on
> > > change as we're not fundamentally changing that issue in this series.
> > > The 'add to vma list only on fault' behavior is also still included
> > > here, per the discussion I think it's still a valid approach and has
> > > some advantages, particularly in a VM scenario where we potentially
> > > defer the mapping until the MMIO BAR is actually DMA mapped into the
> > > VM address space (or the guest driver actually accesses the device
> > > if that DMA mapping is eliminated at some point). Further discussion
> > > and review appreciated. Thanks,
> >
> > Hi, Alex,
> >
> > I have a general question on the series.
> >
> > IIUC this series tries to protect illegal vfio userspace writes to device MMIO
> > regions which may cause platform-level issues. That makes perfect sense to me.
> > However what if the write comes from the devices' side? E.g.:
> >
> > - Device A maps MMIO region X
> >
> > - Device B do VFIO_IOMMU_DMA_MAP on Device A's MMIO region X
> > (so X's MMIO PFNs are mapped in device B's IOMMU page table)
> >
> > - Device A clears PCI_COMMAND_MEMORY (reset, etc.)
> > - this should zap all existing vmas that mapping region X, however device
> > B's IOMMU page table is not aware of this?
> >
> > - Device B writes to MMIO region X of device A even if PCI_COMMAND_MEMORY
> > cleared on device A's PCI_COMMAND register
> >
> > Could this happen?
>
> Yes, this can happen and Jason has brought up variations on this
> scenario that are important to fix as well. I've got some ideas, but
> the access in this series was the current priority. There are also
> issues in the above scenario that if a platform considers a DMA write
> to an invalid IOMMU PTE and triggering an IOMMU fault to have the same
> severity as the write to disabled MMIO space we've prevented, then our
> hands are tied. Thanks,
I see the point now; it makes sense to start with a series like this. Thanks, Alex.
--
Peter Xu
prev parent reply other threads:[~2020-05-08 2:32 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-05 21:54 [PATCH v2 0/3] vfio-pci: Block user access to disabled device MMIO Alex Williamson
2020-05-05 21:54 ` [PATCH v2 1/3] vfio/type1: Support faulting PFNMAP vmas Alex Williamson
2020-05-07 21:24 ` Peter Xu
2020-05-07 21:47 ` Alex Williamson
2020-05-07 23:54 ` Jason Gunthorpe
2020-05-08 2:19 ` Peter Xu
2020-05-08 12:10 ` Jason Gunthorpe
2020-05-08 14:30 ` Peter Xu
2020-05-08 15:05 ` Jason Gunthorpe
2020-05-08 15:42 ` Alex Williamson
2020-05-08 16:05 ` Peter Xu
2020-05-08 18:39 ` Peter Xu
2020-05-05 21:54 ` [PATCH v2 2/3] vfio-pci: Fault mmaps to enable vma tracking Alex Williamson
2020-05-07 21:47 ` Peter Xu
2020-05-07 22:03 ` Alex Williamson
2020-05-07 22:22 ` Peter Xu
2020-05-07 23:56 ` Jason Gunthorpe
2020-05-08 2:16 ` Peter Xu
2020-05-08 6:44 ` Jason Wang
2020-05-08 14:27 ` Peter Xu
2020-05-08 12:08 ` Jason Gunthorpe
2020-05-08 14:26 ` Peter Xu
2020-05-05 21:55 ` [PATCH v2 3/3] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory Alex Williamson
2020-05-22 2:39 ` Qian Cai
2020-05-22 4:18 ` Alex Williamson
2020-05-07 21:59 ` [PATCH v2 0/3] vfio-pci: Block user access to disabled device MMIO Peter Xu
2020-05-07 22:34 ` Alex Williamson
2020-05-08 2:31 ` Peter Xu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200508023156.GV228260@xz-x1 \
--to=peterx@redhat.com \
--cc=alex.williamson@redhat.com \
--cc=cohuck@redhat.com \
--cc=jgg@ziepe.ca \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).