> -----Original Message----- > From: Kevin Traynor <ktray...@redhat.com> > Sent: Friday, June 26, 2020 00:46 > To: David Marchand <david.march...@redhat.com>; Wang, Haiyue > <haiyue.w...@intel.com>; Luca Boccassi > <bl...@debian.org> > Cc: dev <dev@dpdk.org>; Burakov, Anatoly <anatoly.bura...@intel.com>; dpdk > stable <sta...@dpdk.org>; > Harman Kalra <hka...@marvell.com> > Subject: Re: [PATCH v4] bus/pci: fix VF bus error for memory access > > On 25/06/2020 15:09, David Marchand wrote: > > On Thu, Jun 25, 2020 at 6:00 AM Haiyue Wang <haiyue.w...@intel.com> wrote: > >> > >> To fix CVE-2020-12888, the linux vfio-pci module will invalidate mmaps > >> and block MMIO access on disabled memory, it will send a SIGBUS to the > >> application: > >> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abafbc551fddede3e0a08dee > 1dcde08fc0eb8476 > >> > >> When the application opens the vfio PCI device, the vfio-pci module will > >> enable the bus memory space through PCI read/write access. According to > >> the PCIe specification, the 'Memory Space Enable' is always zero for VF: > >> > >> Table 9-13 Command Register Changes > >> > >> Bit Location | PF and VF Register Differences | PF | VF > >> | From Base | Attributes | Attributes > >> -------------+--------------------------------+------------+----------- > >> | Memory Space Enable - Does not | | > >> | apply to VFs. Must be hardwired| Base | 0b > >> 1 | to 0b for VFs. VF Memory Space | | > >> | is controlled by the VF MSE bit| | > >> | in the VF Control register. | | > >> -------------+--------------------------------+------------+----------- > >> > >> Afterwards the vfio-pci will initialize its own virtual PCI config space > >> data ('vconfig') by reading the VF's physical PCI config space, then the > >> 'Memory Space Enable' bit in vconfig will always be 0b value. This will > >> make the vfio-pci treat the BAR memory space as disabled, and the SIGBUS > >> will be triggered if access these BARs. > >> > >> By investigation, the VF PCI device *passthrough* into the Guest OS by > >> QEMU has the 'Memory Space Enable' with 1b value. That's because every > >> PCI driver will start to enable the memory space, and this action will > >> be hooked by vfio-pci virtual PCI read/write to set the 'Memory Space > >> Enable' in vconfig space to 1b. So VF runs in guest OS has 'Mem+', but > >> VF runs in host OS has 'Mem-'. > >> > >> Align with PCI working mode in Guest/QEMU/Host, in DPDK, enable the PCI > >> bus memory space explicitly to avoid access on disabled memory. > >> > >> Fixes: 33604c31354a ("vfio: refactor PCI BAR mapping") > >> Cc: sta...@dpdk.org > >> > >> Signed-off-by: Haiyue Wang <haiyue.w...@intel.com> > >> Acked-by: Anatoly Burakov <anatoly.bura...@intel.com> > >> Tested-by: Harman Kalra <hka...@marvell.com> > >> Tested-by: David Marchand <david.march...@redhat.com> > > Tested-by: Thierry Martin <thierry.martin.pub...@gmail.com> > > > > Applied, thanks again Haiyue. > > > > > > Kevin, Luca, > > > > I can see that some distros have already started backporting the fix > > in kernel (fc31, fc32 and rhel7 at least for what I saw). > > 18.11 and 19.11 will need this fix at some point. > > I'll let you decide on the proper timing. > > > > > > It looks an important fix. I think it's worth having in 18.11.9. I will > apply and create an 18.11.9-rc2 tomorrow, so if anyone hasn't started > validation already, they can validate with it in.
Alex post a fix in kernel just now. So looks like the DPDK patch is nice to have, not a MUST. ;-) https://lore.kernel.org/kvm/159310421505.27590.16617666489295503039.st...@gimli.home/T/#u
