Messages in this thread | | | Date | Wed, 17 Apr 2024 09:04:21 -0700 | From | Nicolin Chen <> | Subject | Re: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned VINTF |
| |
On Wed, Apr 17, 2024 at 03:12:57PM +0000, Shameerali Kolothum Thodi wrote: > > -----Original Message----- > > From: Nicolin Chen <nicolinc@nvidia.com> > > Sent: Saturday, April 13, 2024 4:44 AM > > To: will@kernel.org; robin.murphy@arm.com > > Cc: joro@8bytes.org; jgg@nvidia.com; thierry.reding@gmail.com; > > vdumpa@nvidia.com; jonathanh@nvidia.com; linux-kernel@vger.kernel.org; > > iommu@lists.linux.dev; linux-arm-kernel@lists.infradead.org; linux- > > tegra@vger.kernel.org > > Subject: [PATCH v5 6/6] iommu/tegra241-cmdqv: Limit CMDs for guest owned > > VINTF > > > > When VCMDQs are assigned to a VINTF owned by a guest (HYP_OWN bit unset), > > only TLB and ATC invalidation commands are supported by the VCMDQ HW. So, > > add a new helper to scan the input cmds to make sure every single command > > is supported when selecting a queue. > > > > Note that the guest VM shouldn't have HYP_OWN bit being set regardless of > > guest kernel driver writing it or not, i.e. the hypervisor running in the > > host OS should wire this bit to zero when trapping a write access to this > > VINTF_CONFIG register from a guest kernel. > > Just curious, suppose there is a malicious guest with a compromised kernel > which bypasses the HYP_OWN bit check and issues other commands, does > the hardware has the capability to detect it and not make the host unstable > in any way?
Only that specific VINTF/VCMDQ would stop and error an IRQ.
Even a device command (ATC_INV) would be strictly checked against the Stream ID table that's set at the host level.
Thanks Nicolin
| |