On Wed, Mar 22, 2023 at 09:30:41PM +0800, Cheng Xu wrote:
>
>
> On 3/22/23 7:54 PM, Jason Gunthorpe wrote:
> > On Wed, Mar 22, 2023 at 03:05:29PM +0800, Cheng Xu wrote:
> >
> >> The current generation of erdma devices do not have this capability due to
> >> implementation complexity. Without this HW capability, isolating the MMIO
> >> space in software doesn't prevent the attack, because the malicious APPs
> >> can map mmio itself, not through verbs interface.
> >
> > This doesn't meet the security model of Linux, verbs HW is expected to
> > protect one process from another process.
>
> OK, I see.
>
> So the key point is that HW should restrict each process to use its own doorbell
> space. If hardware can do this, share or do not share MMIO pages both will meet
> the security requirement. Do I get it right?
HW can never do that, HW is supposed to rely on the system MMU to
isolate doorbell registers
The HW responsibility is to make doorbell MMIO registers safe in the
hands of other processes.
Simple doorbells that only 'kick' and don't convey any information are
probably safe to share, and don't require HW checks between the
doorbell page and the PD/QP/CQ/etc
Doorbells that deliver data - eg a head pointer - are not safe because
the wrong head pointer can corrupt the HW state. Process B must not be
able to corrupt the head pointer of a QP/CQ owned by Process A under
any circumstances. Definitely they cannot have access to the MMIO and
also the HW must ensure that writes coming from process B are rejected
if they touch resources owned by process a (eg by PD/QPN/CQN checks in
HW)
Doorbells that accept entire WQE's are definately not safe as a
hostile process could execute a WQE on a QP it does not own.
> It seems that EFA uses shared MMIO pages with hardware security assurance.
I'm not sure how EFA works, it writes this:
EFA_SET(&db, EFA_IO_REGS_CQ_DB_CONSUMER_INDEX, cq->cc);
EFA_SET(&db, EFA_IO_REGS_CQ_DB_CMD_SN, cq->cmd_sn & 0x3);
EFA_SET(&db, EFA_IO_REGS_CQ_DB_ARM, arm);
But interestingly there is no CQN value, so I have no idea how it
associates the doorbell register with the CQ to load the data into.
If it is using a DB register offset to learn the CQN then obviously it
cannot share the same doorbell page (or associated CQNs) across verbs
FD contexts, that would be a security bug. EFA folks?
Jason
