linux-pci.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Tian, Kevin" <kevin.tian@intel.com>
To: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Cc: "linux-pci@vger.kernel.org" <linux-pci@vger.kernel.org>,
	"alex.williamson@redhat.com" <alex.williamson@redhat.com>,
	"jgg@nvidia.com" <jgg@nvidia.com>,
	"cohuck@redhat.com" <cohuck@redhat.com>,
	"mgurtovoy@nvidia.com" <mgurtovoy@nvidia.com>,
	"yishaih@nvidia.com" <yishaih@nvidia.com>,
	"linuxarm@huawei.com" <linuxarm@huawei.com>,
	"liulongfang@huawei.com" <liulongfang@huawei.com>,
	"prime.zeng@hisilicon.com" <prime.zeng@hisilicon.com>,
	"jonathan.cameron@huawei.com" <jonathan.cameron@huawei.com>,
	"wangzhou1@hisilicon.com" <wangzhou1@hisilicon.com>
Subject: RE: [PATCH v8 5/9] hisi_acc_vfio_pci: Restrict access to VF dev BAR2 migration region
Date: Tue, 8 Mar 2022 06:23:29 +0000	[thread overview]
Message-ID: <BN9PR11MB527681F9F6B0906596A77A178C099@BN9PR11MB5276.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20220303230131.2103-6-shameerali.kolothum.thodi@huawei.com>

Hi, Shameer,

> From: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
> Sent: Friday, March 4, 2022 7:01 AM
> 
> HiSilicon ACC VF device BAR2 region consists of both functional
> register space and migration control register space. From a
> security point of view, it's not advisable to export the migration
> control region to Guest.
> 
> Hence, introduce a separate struct vfio_device_ops for migration
> support which will override the ioctl/read/write/mmap methods to
> hide the migration region and limit the access only to the
> functional register space.
> 
> This will be used in subsequent patches when we add migration
> support to the driver.

As a security concern the migration control region should be always
disabled regardless of whether migration support is added to the
driver for such device... It sounds like we should first fix this security
hole for acc device assignment and then add the migration support
atop (at least organize the series in this way).

Thanks
Kevin

  parent reply	other threads:[~2022-03-08  6:23 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-03 23:01 [PATCH v8 0/9] vfio/hisilicon: add ACC live migration driver Shameer Kolothum
2022-03-03 23:01 ` [PATCH v8 1/9] crypto: hisilicon/qm: Move the QM header to include/linux Shameer Kolothum
2022-03-04  9:03   ` Zhou Wang
2022-03-04 11:33     ` Shameerali Kolothum Thodi
2022-03-08  1:07   ` liulongfang
2022-03-08 10:27   ` yekai(A)
2022-03-03 23:01 ` [PATCH v8 2/9] crypto: hisilicon/qm: Move few definitions to common header Shameer Kolothum
2022-03-04  9:06   ` Zhou Wang
2022-03-03 23:01 ` [PATCH v8 3/9] hisi_acc_qm: Move VF PCI device IDs " Shameer Kolothum
2022-03-04  9:34   ` Zhou Wang
2022-03-04 11:35     ` Shameerali Kolothum Thodi
2022-03-07 17:53   ` Alex Williamson
2022-03-10 13:55     ` Shameerali Kolothum Thodi
2022-03-08  1:08   ` liulongfang
2022-03-08 10:28   ` yekai(A)
2022-03-03 23:01 ` [PATCH v8 4/9] hisi_acc_vfio_pci: add new vfio_pci driver for HiSilicon ACC devices Shameer Kolothum
2022-03-03 23:01 ` [PATCH v8 5/9] hisi_acc_vfio_pci: Restrict access to VF dev BAR2 migration region Shameer Kolothum
2022-03-08  1:11   ` liulongfang
2022-03-08  6:23   ` Tian, Kevin [this message]
2022-03-08  8:33     ` Shameerali Kolothum Thodi
2022-03-08 10:09       ` Tian, Kevin
2022-03-08 11:02         ` Shameerali Kolothum Thodi
2022-03-03 23:01 ` [PATCH v8 6/9] hisi_acc_vfio_pci: Add helper to retrieve the struct pci_driver Shameer Kolothum
2022-03-04  9:40   ` Zhou Wang
2022-03-04 11:31     ` Shameerali Kolothum Thodi
2022-03-08 10:28   ` yekai(A)
2022-03-08 12:02   ` liulongfang
2022-03-03 23:01 ` [PATCH v8 7/9] crypto: hisilicon/qm: Set the VF QM state register Shameer Kolothum
2022-03-04  9:43   ` Zhou Wang
2022-03-08  6:31   ` Tian, Kevin
2022-03-08  8:46     ` Shameerali Kolothum Thodi
2022-03-08 10:10       ` Tian, Kevin
2022-03-03 23:01 ` [PATCH v8 8/9] hisi_acc_vfio_pci: Add support for VFIO live migration Shameer Kolothum
2022-03-04  8:48   ` Shameerali Kolothum Thodi
2022-03-04 19:44     ` Alex Williamson
2022-03-04 20:36       ` Shameerali Kolothum Thodi
2022-03-04 20:40         ` Alex Williamson
2022-03-04 20:57   ` Jason Gunthorpe
2022-03-07 19:05     ` Alex Williamson
2022-03-07 19:29       ` Shameerali Kolothum Thodi
2022-03-07 19:52         ` Alex Williamson
2022-03-08  8:11           ` Tian, Kevin
2022-03-08 19:33             ` Alex Williamson
2022-03-09 10:11               ` Tian, Kevin
2022-03-10 20:49                 ` Alex Williamson
2022-03-11  8:52                   ` Cornelia Huck
2022-03-11 13:21                   ` Shameerali Kolothum Thodi
2022-03-14  3:40                   ` Tian, Kevin
2022-03-14 15:03                   ` Jason Gunthorpe
2022-03-08  9:46           ` liulongfang
2022-03-08  7:41   ` Tian, Kevin
2022-03-08  8:52     ` Shameerali Kolothum Thodi
2022-03-08 10:17       ` Tian, Kevin
2022-03-03 23:01 ` [PATCH v8 9/9] hisi_acc_vfio_pci: Use its own PCI reset_done error handler Shameer Kolothum
2022-03-04 20:54   ` Jason Gunthorpe
2022-03-08  1:14   ` liulongfang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=BN9PR11MB527681F9F6B0906596A77A178C099@BN9PR11MB5276.namprd11.prod.outlook.com \
    --to=kevin.tian@intel.com \
    --cc=alex.williamson@redhat.com \
    --cc=cohuck@redhat.com \
    --cc=jgg@nvidia.com \
    --cc=jonathan.cameron@huawei.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pci@vger.kernel.org \
    --cc=linuxarm@huawei.com \
    --cc=liulongfang@huawei.com \
    --cc=mgurtovoy@nvidia.com \
    --cc=prime.zeng@hisilicon.com \
    --cc=shameerali.kolothum.thodi@huawei.com \
    --cc=wangzhou1@hisilicon.com \
    --cc=yishaih@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).