> From: Yongji Xie > Sent: Tuesday, May 03, 2016 3:34 PM > > On 2016/5/3 14:22, Tian, Kevin wrote: > > >> From: Yongji Xie [mailto:xyjxie@xxxxxxxxxxxxxxxxxx] > >> Sent: Tuesday, May 03, 2016 2:08 PM > >> > >> On 2016/5/3 13:34, Tian, Kevin wrote: > >> > >>>> From: Yongji Xie > >>>> Sent: Wednesday, April 27, 2016 8:43 PM > >>>> > >>>> This patch enables mmapping MSI-X tables if hardware supports > >>>> interrupt remapping which can ensure that a given pci device > >>>> can only shoot the MSIs assigned for it. > >>>> > >>>> With MSI-X table mmapped, we also need to expose the > >>>> read/write interface which will be used to access MSI-X table. > >>>> > >>>> Signed-off-by: Yongji Xie <xyjxie@xxxxxxxxxxxxxxxxxx> > >>> A curious question here. Does "allow to mmap MSI-X" essentially > >>> mean that KVM guest can directly read/write physical MSI-X > >>> structure then? > >>> > >>> Thanks > >>> Kevin > >>> > >> Here we just allow to mmap MSI-X table in kernel. It doesn't > >> mean all KVM guest can directly read/write physical MSI-X > >> structure. This should be decided by QEMU. For PPC64 > >> platform, we would allow to passthrough the MSI-X table > >> because we know guest kernel would not write physical > >> MSI-X structure when enabling MSI. > >> > > A bit confused here. If guest kernel doesn't need to write > > physical MSI-X structure, what's the point of passing through > > the table then? > > We want to allow the MSI-X table because there may be > some critical registers in the same page as the MSI-X table. > We have to handle the mmio access to these register in QEMU > rather than in guest if mmapping MSI-X table is disallowed. So you mean critical registers in same MMIO BAR as MSI-X table, instead of two MMIO BARs in same page (the latter I suppose with your whole patchset it won't happen then)? > > > I think the key whether MSI-X table can be passed through > > is related to where hypervisor control is deployed. At least > > for x86: > > > > - When irq remapping is not enabled, host/hypervisor needs > > to control physical interrupt message including vector/dest/etc. > > directly in MSI-X structure, so we cannot allow a guest to > > access it; > > > > - when irq remapping is enabled, host/hypervisor can control > > interrupt routing in irq remapping table. However MSI-X > > also needs to be configured as remappable format. In this > > manner we also cannot allow direct access from guest. > > > > The only sane case to pass through MSI-X structure, is a > > mechanism similar to irq remapping but w/o need to change > > original MSI-X format so direct access from guest side is > > safe. Is it the case in PPC64? > > > > Thanks > > Kevin > > Acutually, we are not aimed at accessing MSI-X table from > guest. So I think it's safe to passthrough MSI-X table if we > can make sure guest kernel would not touch MSI-X table in > normal code path such as para-virtualized guest kernel on PPC64. > Then how do you prevent malicious guest kernel accessing it? Thanks Kevin ��.n��������+%������w��{.n�����{���"�)�� jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
