github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2026-01-06 08:04:55 +00:00
Code Issues Projects Releases Wiki Activity

HV: deny pre-launched VM ptdev bar access from SOS

Browse Source 
This patch denies Service VM the access permission to device
resources owned by pre-launched VMs.
Rationale:
 * Pre-launched VMs in ACRN are independent of service VM,
   and should be immune to attacks from service VM. However,
   current implementation exposes the bar resource of passthru
   devices to service VM for some reason. This makes it possible
   for service VM to crash or attack pre-launched VMs.
 * It is same for hypervisor owned devices.

NOTE:
 * The MMIO spaces pre-allocated to VFs are still presented to
  Service VM. The SR-IOV capable devices assigned to pre-launched
  VMs doesn't have the SR-IOV capability. So the MMIO address spaces
  pre-allocated by BIOS for VFs are not decoded by hardware and
  couldn't be enabled by guest. SOS may live with seeing the address
  space or not. We will revisit later.

Tracked-On: #5615
Signed-off-by: Tao Yuhong <yuhong.tao@intel.com>
Reviewed-by: Fei Li <fei1.li@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This commit is contained in:
Tao Yuhong
2021-01-29 19:40:16 -05:00
committed by wenlingz
parent bc40e455aa
commit 6e7ce4a73f
3 changed files with 77 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
hypervisor/include/hw/pci.h
View File

@@ -246,6 +246,14 @@ struct pci_sriov_cap {
bool hide_sriov;
};
/* PCI BAR size is detected at run time. We don't want to re-detect it to avoid malfunction of
* the device. We have record physical bar values, we need to record size_mask.
*/
struct pci_bar_resource {
uint32_t phy_bar; /* the origional raw data read from physical BAR */
uint32_t size_mask; /* read value of physical BAR after write 0xffffffff */
};
struct pci_pdev {
uint8_t hdr_type;
uint8_t base_class;
@@ -259,7 +267,7 @@ struct pci_pdev {
/* The bar info of the physical PCI device. */
uint32_t nr_bars; /* 6 for normal device, 2 for bridge, 1 for cardbus */
uint32_t bars[PCI_STD_NUM_BARS];
struct pci_bar_resource bars[PCI_STD_NUM_BARS]; /* For common bar resource recording */
/* The bus/device/function triple of the physical PCI device. */
union pci_bdf bdf;
@@ -384,4 +392,5 @@ bool pdev_need_bar_restore(const struct pci_pdev *pdev);
void pdev_restore_bar(const struct pci_pdev *pdev);
void pci_switch_to_mmio_cfg_ops(void);
void reserve_vmsix_on_msi_irtes(struct pci_pdev *pdev);
#endif /* PCI_H_ */