From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751835AbdJXVtT convert rfc822-to-8bit (ORCPT ); Tue, 24 Oct 2017 17:49:19 -0400 Received: from mga04.intel.com ([192.55.52.120]:23086 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751267AbdJXVtQ (ORCPT ); Tue, 24 Oct 2017 17:49:16 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.43,429,1503385200"; d="scan'208";a="1234813156" From: "Wang, Liang-min" To: Alex Williamson , "Kirsher, Jeffrey T" CC: "kvm@vger.kernel.org" , "linux-pci@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "bhelgaas@google.com" , "Duyck, Alexander H" Subject: RE: [PATCH] Enable SR-IOV instantiation through /sys file Thread-Topic: [PATCH] Enable SR-IOV instantiation through /sys file Thread-Index: AQHTTQNc3Jvwy6Ow/U2KUKrBywbFv6Lz/a6A//+LFZA= Date: Tue, 24 Oct 2017 21:49:15 +0000 Message-ID: References: <20171024200426.62811-1-jeffrey.t.kirsher@intel.com> <20171024234351.0af0ff4a@t450s.home> In-Reply-To: <20171024234351.0af0ff4a@t450s.home> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.1.200.108] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Just like any PCIe devices that supports SR-IOV. There are restrictions set for VF. Also, there is a concept of trust VF now available for PF to manage certain features that only selected VF could exercise. Are you saying all the devices supporting SR-IOV all have security issue? Larry > -----Original Message----- > From: Alex Williamson [mailto:alex.williamson@redhat.com] > Sent: Tuesday, October 24, 2017 5:44 PM > To: Kirsher, Jeffrey T > Cc: Wang, Liang-min ; kvm@vger.kernel.org; > linux-pci@vger.kernel.org; linux-kernel@vger.kernel.org; > bhelgaas@google.com; Duyck, Alexander H > Subject: Re: [PATCH] Enable SR-IOV instantiation through /sys file > > On Tue, 24 Oct 2017 13:04:26 -0700 > Jeff Kirsher wrote: > > > From: Liang-Min Wang > > > > When a SR-IOV supported device is bound with vfio-pci, the driver > > could not create SR-IOV instance through /sys/bus/pci/devices/... > > /sriov_numvfs. This patch re-activates this capability for a PCIe > > device that supports SR-IOV and is bound with vfio-pci.ko. > > > > Signed-off-by: Liang-Min Wang > > --- > > drivers/vfio/pci/vfio_pci.c | 12 ++++++++++++ > > 1 file changed, 12 insertions(+) > > > Why? The PF bound to vfio-pci can be assigned to a user. PFs often > have backdoors into the VF. Therefore this enables creation of a VF in > the host that may be snooped or manipulated by a user. This clearly > seems like a security issue. Thanks, > > Alex > > > > diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c > > index f041b1a6cf66..8fbd362607e1 100644 > > --- a/drivers/vfio/pci/vfio_pci.c > > +++ b/drivers/vfio/pci/vfio_pci.c > > @@ -1256,6 +1256,7 @@ static void vfio_pci_remove(struct pci_dev *pdev) > > if (!vdev) > > return; > > > > + pci_disable_sriov(pdev); > > vfio_iommu_group_put(pdev->dev.iommu_group, &pdev->dev); > > kfree(vdev->region); > > kfree(vdev); > > @@ -1303,12 +1304,23 @@ static const struct pci_error_handlers > vfio_err_handlers = { > > .error_detected = vfio_pci_aer_err_detected, > > }; > > > > +static int vfio_sriov_configure(struct pci_dev *pdev, int num_vfs) > > +{ > > + if (!num_vfs) { > > + pci_disable_sriov(pdev); > > + return 0; > > + } > > + > > + return pci_enable_sriov(pdev, num_vfs); > > +} > > + > > static struct pci_driver vfio_pci_driver = { > > .name = "vfio-pci", > > .id_table = NULL, /* only dynamic ids */ > > .probe = vfio_pci_probe, > > .remove = vfio_pci_remove, > > .err_handler = &vfio_err_handlers, > > + .sriov_configure = vfio_sriov_configure, > > }; > > > > struct vfio_devices {