lkml.org 
[lkml]   [2013]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] intel_iommu: Disable vfio and kvm interrupt assignment when unsafe
On Thu, Feb 7, 2013 at 3:33 AM, Joerg Roedel <joro@8bytes.org> wrote:
> On Wed, Feb 06, 2013 at 07:08:24PM -0800, Andy Lutomirski wrote:
>> - if (x2apic_present)
>> - WARN(1, KERN_WARNING
>> - "Failed to enable irq remapping. You are vulnerable to irq-injection attacks.\n");
>> -
>> + irq_remapping_is_secure = 0;
>> return -1;
>> }
>
> Why do you remove this warning? It seems unrelated to the rest of the
> patch.

The idea is that setting irq_remapping_is_secure = 0 makes you (much
less) vulnerable to irq-injection attacks: you're vulnerable to
malicious hardware but not to attack via vfio or kvm, because those
paths are disabled.

I'd have no problem leaving the warning in and letting whoever manages
to trigger it and get annoyed fix it. FWIW, it's actually likely to
be interesting if the warning hits.

--Andy


\
 
 \ /
  Last update: 2013-02-07 18:02    [W:2.092 / U:0.580 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site