Messages in this thread | | | Subject | Re: [PATCH 3/4] KVM: PPC: Add support for IOMMU in-kernel handling | From | Benjamin Herrenschmidt <> | Date | Mon, 17 Jun 2013 08:39:03 +1000 |
| |
On Wed, 2013-06-05 at 16:11 +1000, Alexey Kardashevskiy wrote: > +long kvm_vm_ioctl_create_spapr_tce_iommu(struct kvm *kvm, > + struct kvm_create_spapr_tce_iommu *args) > +{ > + struct kvmppc_spapr_tce_table *tt = NULL; > + struct iommu_group *grp; > + struct iommu_table *tbl; > + > + /* Find an IOMMU table for the given ID */ > + grp = iommu_group_get_by_id(args->iommu_id); > + if (!grp) > + return -ENXIO; > + > + tbl = iommu_group_get_iommudata(grp); > + if (!tbl) > + return -ENXIO;
So Alex Graf pointed out here, there is a security issue here, or are we missing something ?
What prevents a malicious program that has access to /dev/kvm from taking over random iommu groups (including host used ones) that way?
What is the security model of that whole iommu stuff to begin with ?
Cheers, Ben.
| |