From: m.smarduch@samsung•com (Mario Smarduch)
To: linux-arm-kernel@lists•infradead.org
Subject: [PATCH 1/2] ARM: kvm: define PAGE_S2_DEVICE as read-only by default
Date: Wed, 17 Sep 2014 12:19:50 -0700 [thread overview]
Message-ID: <5419DED6.6050307@samsung.com> (raw)
In-Reply-To: <CAKv+Gu-MAkzFtrFk19mYB=jQyLsFLY+k3Ly=eZQ=3hWSALLRPw@mail.gmail.com>
On 09/14/2014 03:57 PM, Ard Biesheuvel wrote:
>
> Never mind. I read the whole thread this time.
>
> So, in summary, there is a concern that a malicious guest may request
> a cachable mapping for a device range, in an attempt to manipulate the
> VGIC or other device memory of another VM.
> I think that concern only applies to writable mappings, so perhaps we
> should just change
>
> if (kvm_is_mmio_pfn(pfn))
>
> to
>
> if (kvm_is_mmio_pfn(pfn) && writable)
Hi Ard,
What if the device passed through is read-only like maybe IPMI
sensors.
>
> and be done with it (which is coincidentally the very first naive fix
> I suggested for the issue i was seeing)
> That way, we never map read-only MMIO regions writable, and rely on
> the MT_DEVICE trumps MT_NORMAL rule to ensure the guest reads to those
> regions are uncached.
> (Wouldn't hurt to add a comment to explain it, I suppose)
>
prev parent reply other threads:[~2014-09-17 19:19 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-13 10:17 [PATCH 1/2] ARM: kvm: define PAGE_S2_DEVICE as read-only by default Ard Biesheuvel
2014-09-13 10:17 ` [PATCH 2/2] arm64: " Ard Biesheuvel
2014-09-13 10:41 ` [PATCH 1/2] ARM: " Marc Zyngier
2014-09-13 11:15 ` Ard Biesheuvel
2014-09-13 17:06 ` Christoffer Dall
2014-09-14 4:49 ` Ard Biesheuvel
2014-09-14 9:09 ` Marc Zyngier
2014-09-14 9:43 ` Ard Biesheuvel
2014-09-14 22:57 ` Ard Biesheuvel
2014-09-15 3:37 ` Peter Maydell
2014-09-15 19:41 ` Mario Smarduch
2014-09-15 19:45 ` Peter Maydell
2014-09-17 19:19 ` Mario Smarduch [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5419DED6.6050307@samsung.com \
--to=m.smarduch@samsung$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox