lkml.org 
[lkml]   [2024]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned VINTF
On Wed, Apr 17, 2024 at 03:12:57PM +0000, Shameerali Kolothum Thodi wrote:
> > -----Original Message-----
> > From: Nicolin Chen <nicolinc@nvidia.com>
> > Sent: Saturday, April 13, 2024 4:44 AM
> > To: will@kernel.org; robin.murphy@arm.com
> > Cc: joro@8bytes.org; jgg@nvidia.com; thierry.reding@gmail.com;
> > vdumpa@nvidia.com; jonathanh@nvidia.com; linux-kernel@vger.kernel.org;
> > iommu@lists.linux.dev; linux-arm-kernel@lists.infradead.org; linux-
> > tegra@vger.kernel.org
> > Subject: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned
> > VINTF
> >
> > When VCMDQs are assigned to a VINTF owned by a guest (HYP_OWN bit unset),
> > only TLB and ATC invalidation commands are supported by the VCMDQ HW. So,
> > add a new helper to scan the input cmds to make sure every single command
> > is supported when selecting a queue.
> >
> > Note that the guest VM shouldn't have HYP_OWN bit being set regardless of
> > guest kernel driver writing it or not, i.e. the hypervisor running in the
> > host OS should wire this bit to zero when trapping a write access to this
> > VINTF_CONFIG register from a guest kernel.
>
> Just curious, suppose there is a malicious guest with a compromised kernel
> which bypasses the HYP_OWN bit check and issues other commands, does
> the hardware has the capability to detect it and not make the host unstable
> in any way?

Only that specific VINTF/VCMDQ would stop and error an IRQ.

Even a device command (ATC_INV) would be strictly checked
against the Stream ID table that's set at the host level.

Thanks
Nicolin

\
 
 \ /
  Last update: 2024-04-17 18:05    [W:0.067 / U:0.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site