Re: ENQCMD

[Stefan Hajnoczi]

On Fri, Oct 30, 2020 at 08:04:54AM +0000, Tian, Kevin wrote:
> > From: Stefan Hajnoczi <stefanha@redhat.com>
> > Sent: Friday, October 30, 2020 3:51 PM
> > 
> > Hi,
> > The "Scalable Work Submission in Device Virtualization" talk at KVM
> > Forum 2020 was interesting and I have some beginner questions about
> > ENQCMD:
> > https://static.sched.com/hosted_files/kvmforum2020/22/Scalable_Work_Su
> > bmission_In_Device_Virtualization.pdf
> > 
> > Security
> > --------
> > If the ENQCMD instruction is allowed for userspace applications, how can
> > they be prevented from writing to the MMIO address directly (without the
> > ENQCMD instruction) and faking the 64-byte enqueue register data format?
> > For example, they could set the PRIV bit or an arbitrary PASID.
> 
> ENQCMD payload is transmitted through DMWr transactions (slide 10), which
> cannot be triggered through other memory instructions. The device portal
> only handles DMWr transactions.

Thanks, that explains it! I was wondering the a regular write
transaction could fool the device :).

Stefan

signature.asc
Description: PGP signature