patches for DPDK stable branches
 help / color / Atom feed
From: "Wang, Haiyue" <haiyue.wang@intel.com>
To: Kevin Traynor <ktraynor@redhat.com>,
	David Marchand <david.marchand@redhat.com>,
	Luca Boccassi <bluca@debian.org>
Cc: dev <dev@dpdk.org>,
	"Burakov, Anatoly" <anatoly.burakov@intel.com>,
	"dpdk stable" <stable@dpdk.org>,
	Harman Kalra <hkalra@marvell.com>
Subject: Re: [dpdk-stable] [PATCH v4] bus/pci: fix VF bus error for memory access
Date: Thu, 25 Jun 2020 18:33:48 +0000
Message-ID: <BN8PR11MB379570F26E47B86C9640F83AF7920@BN8PR11MB3795.namprd11.prod.outlook.com> (raw)
In-Reply-To: <d536e11a-f52e-eb4f-8b13-6ddd76c9ba47@redhat.com>

> -----Original Message-----
> From: Kevin Traynor <ktraynor@redhat.com>
> Sent: Friday, June 26, 2020 00:46
> To: David Marchand <david.marchand@redhat.com>; Wang, Haiyue <haiyue.wang@intel.com>; Luca Boccassi
> <bluca@debian.org>
> Cc: dev <dev@dpdk.org>; Burakov, Anatoly <anatoly.burakov@intel.com>; dpdk stable <stable@dpdk.org>;
> Harman Kalra <hkalra@marvell.com>
> Subject: Re: [PATCH v4] bus/pci: fix VF bus error for memory access
> 
> On 25/06/2020 15:09, David Marchand wrote:
> > On Thu, Jun 25, 2020 at 6:00 AM Haiyue Wang <haiyue.wang@intel.com> wrote:
> >>
> >> To fix CVE-2020-12888, the linux vfio-pci module will invalidate mmaps
> >> and block MMIO access on disabled memory, it will send a SIGBUS to the
> >> application:
> >>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abafbc551fddede3e0a08dee
> 1dcde08fc0eb8476
> >>
> >> When the application opens the vfio PCI device, the vfio-pci module will
> >> enable the bus memory space through PCI read/write access. According to
> >> the PCIe specification, the 'Memory Space Enable' is always zero for VF:
> >>
> >>              Table 9-13 Command Register Changes
> >>
> >> Bit Location | PF and VF Register Differences | PF         | VF
> >>              | From Base                      | Attributes | Attributes
> >> -------------+--------------------------------+------------+-----------
> >>              | Memory Space Enable - Does not |            |
> >>              | apply to VFs. Must be hardwired|  Base      |  0b
> >>      1       | to 0b for VFs. VF Memory Space |            |
> >>              | is controlled by the VF MSE bit|            |
> >>              | in the VF Control register.    |            |
> >> -------------+--------------------------------+------------+-----------
> >>
> >> Afterwards the vfio-pci will initialize its own virtual PCI config space
> >> data ('vconfig') by reading the VF's physical PCI config space, then the
> >> 'Memory Space Enable' bit in vconfig will always be 0b value. This will
> >> make the vfio-pci treat the BAR memory space as disabled, and the SIGBUS
> >> will be triggered if access these BARs.
> >>
> >> By investigation, the VF PCI device *passthrough* into the Guest OS by
> >> QEMU has the 'Memory Space Enable' with 1b value. That's because every
> >> PCI driver will start to enable the memory space, and this action will
> >> be hooked by vfio-pci virtual PCI read/write to set the 'Memory Space
> >> Enable' in vconfig space to 1b. So VF runs in guest OS has 'Mem+', but
> >> VF runs in host OS has 'Mem-'.
> >>
> >> Align with PCI working mode in Guest/QEMU/Host, in DPDK, enable the PCI
> >> bus memory space explicitly to avoid access on disabled memory.
> >>
> >> Fixes: 33604c31354a ("vfio: refactor PCI BAR mapping")
> >> Cc: stable@dpdk.org
> >>
> >> Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>
> >> Acked-by: Anatoly Burakov <anatoly.burakov@intel.com>
> >> Tested-by: Harman Kalra <hkalra@marvell.com>
> >> Tested-by: David Marchand <david.marchand@redhat.com>
> > Tested-by: Thierry Martin <thierry.martin.public@gmail.com>
> >
> > Applied, thanks again Haiyue.
> >
> >
> > Kevin, Luca,
> >
> > I can see that some distros have already started backporting the fix
> > in kernel (fc31, fc32 and rhel7 at least for what I saw).
> > 18.11 and 19.11 will need this fix at some point.
> > I'll let you decide on the proper timing.
> >
> >
> 
> It looks an important fix. I think it's worth having in 18.11.9. I will
> apply and create an 18.11.9-rc2 tomorrow, so if anyone hasn't started
> validation already, they can validate with it in.

Alex post a fix in kernel just now. So looks like the DPDK patch is nice
to have, not a MUST. ;-)

https://lore.kernel.org/kvm/159310421505.27590.16617666489295503039.stgit@gimli.home/T/#u


  reply index

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-21 17:40 [dpdk-stable] [PATCH v1] " Haiyue Wang
2020-06-22  6:30 ` [dpdk-stable] [PATCH v2] " Haiyue Wang
2020-06-22  8:52   ` Burakov, Anatoly
2020-06-22 11:25     ` Wang, Haiyue
2020-06-22 11:13 ` [dpdk-stable] [PATCH v3] " Haiyue Wang
2020-06-22 12:11   ` Burakov, Anatoly
2020-06-23 15:12   ` [dpdk-stable] [dpdk-dev] " Harman Kalra
2020-06-24 20:01   ` David Marchand
2020-06-25  4:01     ` Wang, Haiyue
2020-06-25  3:50 ` [dpdk-stable] [PATCH v4] " Haiyue Wang
2020-06-25 14:09   ` David Marchand
2020-06-25 16:45     ` Kevin Traynor
2020-06-25 18:33       ` Wang, Haiyue [this message]
2020-06-26  9:10         ` Kevin Traynor
2020-06-26  9:17         ` David Marchand
2020-06-26 14:14           ` Wang, Haiyue

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=BN8PR11MB379570F26E47B86C9640F83AF7920@BN8PR11MB3795.namprd11.prod.outlook.com \
    --to=haiyue.wang@intel.com \
    --cc=anatoly.burakov@intel.com \
    --cc=bluca@debian.org \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=hkalra@marvell.com \
    --cc=ktraynor@redhat.com \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

patches for DPDK stable branches

Archives are clonable:
	git clone --mirror http://inbox.dpdk.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ http://inbox.dpdk.org/stable \
		stable@dpdk.org
	public-inbox-index stable


Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox