On 3/22/23 7:54 PM, Jason Gunthorpe wrote: > On Wed, Mar 22, 2023 at 03:05:29PM +0800, Cheng Xu wrote: > >> The current generation of erdma devices do not have this capability due to >> implementation complexity. Without this HW capability, isolating the MMIO >> space in software doesn't prevent the attack, because the malicious APPs >> can map mmio itself, not through verbs interface. > > This doesn't meet the security model of Linux, verbs HW is expected to > protect one process from another process. OK, I see. So the key point is that HW should restrict each process to use its own doorbell space. If hardware can do this, share or do not share MMIO pages both will meet the security requirement. Do I get it right? It seems that EFA uses shared MMIO pages with hardware security assurance. > if this is the case we should consider restricting this HW to > CAP_SYS_RAW_IO only. > Please give us a chance to fix this issue first. > You should come with an explanation why this HW is safe enough to > avoid this. I need to discuss with our HW guys and implement the similar security check in HW, and this won't be long. Thanks, Cheng Xu
