From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jike Song Subject: Re: [RFC PATCH v5 0/5] vfio-pci: Add support for mmapping MSI-X table Date: Tue, 15 Aug 2017 09:47:37 +0800 Message-ID: <599252B9.8030407@intel.com> References: <20170807072548.3023-1-aik@ozlabs.ru> <8f5f7b82-3c10-7f39-b587-db4c4424f04c@ozlabs.ru> <59924B85.5040405@intel.com> <1502760820.4493.40.camel@kernel.crashing.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Vlad Tsyrklevich , kvm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Alexey Kardashevskiy , Kyle Mahlkuch , Kirti Wankhede , kvm-ppc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Yongji Xie , Mauricio Faria de Oliveira , Paul Mackerras , Bjorn Helgaas , Arvind Yadav , linuxppc-dev-uLR06cmDAlY/bJ5BZ2RsiQ@public.gmane.org, David Woodhouse , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, David Gibson To: Benjamin Herrenschmidt Return-path: In-Reply-To: <1502760820.4493.40.camel-XVmvHMARGAS8U2dJNN8I7kB+6BGkLq7r@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org List-Id: kvm.vger.kernel.org On 08/15/2017 09:33 AM, Benjamin Herrenschmidt wrote: > On Tue, 2017-08-15 at 09:16 +0800, Jike Song wrote: >>> Taking a step back, though, why does vfio-pci perform this check in the >>> first place? If a malicious guest already has control of a device, any >>> kind of interrupt spoofing it could do by fiddling with the MSI-X >>> message address/data it could simply do with a DMA write anyway, so the >>> security argument doesn't stand up in general (sure, not all PCIe >>> devices may be capable of arbitrary DMA, but that seems like more of a >>> tenuous security-by-obscurity angle to me). > > I tried to make that point for years, thanks for re-iterating it :-) > >> Hi Robin, >> >> DMA writes will be translated (thereby censored) by DMA Remapping hardware, >> while MSI/MSI-X will not. Is this different for non-x86? > > There is no way your DMA remapping HW can differenciate. The only > difference between a DMA write and an MSI is ... the address. So if I > can make my device DMA to the MSI address range, I've defeated your > security. I don't think with IRQ remapping enabled, you can make your device DMA to MSI address, without being treated as an IRQ and remapped. If so, the IRQ remapping hardware is simply broken :) -- Thanks, Jike