patches for DPDK stable branches
 help / color / Atom feed
From: "Burakov, Anatoly" <anatoly.burakov@intel.com>
To: Haiyue Wang <haiyue.wang@intel.com>, dev@dpdk.org
Cc: stable@dpdk.org
Subject: Re: [dpdk-stable] [PATCH v2] bus/pci: fix VF bus error for memory access
Date: Mon, 22 Jun 2020 09:52:37 +0100
Message-ID: <7ea880c0-68d5-11f0-0499-73e3b87660b9@intel.com> (raw)
In-Reply-To: <20200622063029.95985-1-haiyue.wang@intel.com>

On 22-Jun-20 7:30 AM, Haiyue Wang wrote:
> To fix CVE-2020-12888, the linux vfio-pci module will invalidate mmaps
> and block MMIO access on disabled memory, it will send a SIGBUS to the
> application:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abafbc551fddede3e0a08dee1dcde08fc0eb8476
> 
> When the application opens the vfio PCI device, the vfio-pci module will
> enable the memory bus command through PCI read/write access. According
> to the PCIe specification, for VF, the 'Memory Space Enable' is always
> zero:
> 
>               Table 9-13 Command Register Changes
> 
> Bit Location | PF and VF Register Differences | PF         | VF
>               | From Base                      | Attributes | Attributes
> -------------+--------------------------------+------------+-----------
>               | Memory Space Enable - Does not |            |
>               | apply to VFs. Must be hardwired|  Base      |  0b
>       1       | to 0b for VFs. VF Memory Space |            |
>               | is controlled by the VF MSE bit|            |
>               | in the VF Control register.    |            |
> -------------+--------------------------------+------------+-----------
> 
> Then the vfio-pci module initializes its own virtual PCI config space
> data ('vconfig') by reading the VF's physical PCI config space, so the
> 'Memory Space Enable' bit in vconfig will also have 0b value. This will
> make the vfio-pci find that the BAR memory is disabled, and the SIGBUS
> will be triggerred if access these BARs.
> 
> So it needs to enable PCI bus memory command explicitly to avoid access
> on disabled memory, which will call vfio-pci virtual PCI read/write API
> to set the 'Memory Space Enable' in vconfig space to 1b.
> 
> Fixes: 33604c31354a ("vfio: refactor PCI BAR mapping")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>

The patch itself looks good, but i wonder how far back do these go, and 
do we need workarounds for older kernels. IIRC v17.11 is still a 
supported release, and its kernel support might go back all the way to 
v3.6 when VFIO was first introduced.

> ---
> v2: Rewrite the commit log, and put the link into it even it is long.
> ---
>   drivers/bus/pci/linux/pci_vfio.c | 37 ++++++++++++++++++++++++++++++++
>   1 file changed, 37 insertions(+)
> 
> diff --git a/drivers/bus/pci/linux/pci_vfio.c b/drivers/bus/pci/linux/pci_vfio.c
> index 64cd84a68..9b6e45da5 100644
> --- a/drivers/bus/pci/linux/pci_vfio.c
> +++ b/drivers/bus/pci/linux/pci_vfio.c
> @@ -149,6 +149,38 @@ pci_vfio_get_msix_bar(int fd, struct pci_msix_table *msix_table)
>   	return 0;
>   }
>   
> +/* enable PCI bus memory command */
> +static int
> +pci_vfio_enable_bus_memory(int dev_fd)
> +{
> +	uint16_t cmd;
> +	int ret;
> +
> +	ret = pread64(dev_fd, &cmd, sizeof(cmd),
> +		      VFIO_GET_REGION_ADDR(VFIO_PCI_CONFIG_REGION_INDEX) +
> +		      PCI_COMMAND);
> +
> +	if (ret != sizeof(cmd)) {
> +		RTE_LOG(ERR, EAL, "Cannot read command from PCI config space!\n");
> +		return -1;
> +	}
> +
> +	if (cmd & PCI_COMMAND_MEMORY)
> +		return 0;
> +
> +	cmd |= PCI_COMMAND_MEMORY;
> +	ret = pwrite64(dev_fd, &cmd, sizeof(cmd),
> +		       VFIO_GET_REGION_ADDR(VFIO_PCI_CONFIG_REGION_INDEX) +
> +		       PCI_COMMAND);
> +
> +	if (ret != sizeof(cmd)) {
> +		RTE_LOG(ERR, EAL, "Cannot write command to PCI config space!\n");
> +		return -1;
> +	}
> +
> +	return 0;
> +}
> +
>   /* set PCI bus mastering */
>   static int
>   pci_vfio_set_bus_master(int dev_fd, bool op)
> @@ -427,6 +459,11 @@ pci_rte_vfio_setup_device(struct rte_pci_device *dev, int vfio_dev_fd)
>   		return -1;
>   	}
>   
> +	if (pci_vfio_enable_bus_memory(vfio_dev_fd)) {
> +		RTE_LOG(ERR, EAL, "Cannot enable bus memory command!\n");

Nitpick, but i think the word "command" is unneeded here :)

> +		return -1;
> +	}
> +
>   	/* set bus mastering for the device */
>   	if (pci_vfio_set_bus_master(vfio_dev_fd, true)) {
>   		RTE_LOG(ERR, EAL, "Cannot set up bus mastering!\n");
> 


-- 
Thanks,
Anatoly

  reply index

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-21 17:40 [dpdk-stable] [PATCH v1] " Haiyue Wang
2020-06-22  6:30 ` [dpdk-stable] [PATCH v2] " Haiyue Wang
2020-06-22  8:52   ` Burakov, Anatoly [this message]
2020-06-22 11:25     ` Wang, Haiyue
2020-06-22 11:13 ` [dpdk-stable] [PATCH v3] " Haiyue Wang
2020-06-22 12:11   ` Burakov, Anatoly
2020-06-23 15:12   ` [dpdk-stable] [dpdk-dev] " Harman Kalra
2020-06-24 20:01   ` David Marchand
2020-06-25  4:01     ` Wang, Haiyue
2020-06-25  3:50 ` [dpdk-stable] [PATCH v4] " Haiyue Wang
2020-06-25 14:09   ` David Marchand
2020-06-25 16:45     ` Kevin Traynor
2020-06-25 18:33       ` Wang, Haiyue
2020-06-26  9:10         ` Kevin Traynor
2020-06-26  9:17         ` David Marchand
2020-06-26 14:14           ` Wang, Haiyue

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=7ea880c0-68d5-11f0-0499-73e3b87660b9@intel.com \
    --to=anatoly.burakov@intel.com \
    --cc=dev@dpdk.org \
    --cc=haiyue.wang@intel.com \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

patches for DPDK stable branches

Archives are clonable:
	git clone --mirror http://inbox.dpdk.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ http://inbox.dpdk.org/stable \
		stable@dpdk.org
	public-inbox-index stable


Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox