> -----Original Message-----
> From: David Marchand <david.march...@redhat.com>
> Sent: Thursday, June 25, 2020 04:01
> To: Wang, Haiyue <haiyue.w...@intel.com>
> Cc: dev <dev@dpdk.org>; Burakov, Anatoly <anatoly.bura...@intel.com>; dpdk
> stable <sta...@dpdk.org>;
> Maxime Coquelin <maxime.coque...@redhat.com>
> Subject: Re: [dpdk-dev] [PATCH v3] bus/pci: fix VF bus error for memory access
>
> On Mon, Jun 22, 2020 at 1:23 PM Haiyue Wang <haiyue.w...@intel.com> wrote:
> >
> > To fix CVE-2020-12888, the linux vfio-pci module will invalidate mmaps
> > and block MMIO access on disabled memory, it will send a SIGBUS to the
> > application:
> >
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abafbc551fddede3e0a08dee
> 1dcde08fc0eb8476
> >
> > When the application opens the vfio PCI device, the vfio-pci module will
> > enable the bus memory space through PCI read/write access. According to
> > the PCIe specification, the 'Memory Space Enable' is always zero for VF:
> >
> > Table 9-13 Command Register Changes
> >
> > Bit Location | PF and VF Register Differences | PF | VF
> > | From Base | Attributes | Attributes
> > -------------+--------------------------------+------------+-----------
> > | Memory Space Enable - Does not | |
> > | apply to VFs. Must be hardwired| Base | 0b
> > 1 | to 0b for VFs. VF Memory Space | |
> > | is controlled by the VF MSE bit| |
> > | in the VF Control register. | |
> > -------------+--------------------------------+------------+-----------
> >
> > Afterwards the vfio-pci will initialize its own virtual PCI config space
> > data ('vconfig') by reading the VF's physical PCI config space, then the
> > 'Memory Space Enable' bit in vconfig will always be 0b value. This will
> > make the vfio-pci treat the BAR memory space as disabled, and the SIGBUS
> > will be triggerred if access these BARs.
>
> triggered
>
Fixed in v4.
> >
> > By investigation, the VF PCI device *passthrough* into the Guest OS by
> > QEMU has the 'Memory Space Enable' with 1b value. That's because every
> > PCI driver will start to enable the memory space, and this action will
> > be hooked by vfio-pci virtual PCI read/write to set the 'Memory Space
> > Enable' in vconfig space to 1b. So VF runs in guest OS has 'Mem+', but
> > VF runs in host OS has 'Mem-'.
> >
> > Align with PCI working mode in Guest/QEMU/Host, in DPDK, enable the PCI
> > bus memory space explicitly to avoid access on disabled memory.
> >
> > Fixes: 33604c31354a ("vfio: refactor PCI BAR mapping")
> > Cc: sta...@dpdk.org
> >
> > Signed-off-by: Haiyue Wang <haiyue.w...@intel.com>
>
> Ouch, we just hit it.
> Thanks for fixing!
>
> Tested-by: David Marchand <david.march...@redhat.com>
>
>
> --
> David Marchand
