• Marek Marczykowski-Górecki's avatar
    xen-pciback: optionally allow interrupt enable flag writes · 476878e4
    Marek Marczykowski-Górecki authored
    QEMU running in a stubdom needs to be able to set INTX_DISABLE, and the
    MSI(-X) enable flags in the PCI config space. This adds an attribute
    'allow_interrupt_control' which when set for a PCI device allows writes
    to this flag(s). The toolstack will need to set this for stubdoms.
    When enabled, guest (stubdomain) will be allowed to set relevant enable
    flags, but only one at a time - i.e. it refuses to enable more than one
    of INTx, MSI, MSI-X at a time.
    
    This functionality is needed only for config space access done by device
    model (stubdomain) serving a HVM with the actual PCI device. It is not
    necessary and unsafe to enable direct access to those bits for PV domain
    with the device attached. For PV domains, there are separate protocol
    messages (XEN_PCI_OP_{enable,disable}_{msi,msix}) for this purpose.
    Those ops in addition to setting enable bits, also configure MSI(-X) in
    dom0 kernel - which is undesirable for PCI passthrough to HVM guests.
    
    This should not introduce any new security issues since a malicious
    guest (or stubdom) can already generate MSIs through other ways, see
    [1] page 8. Additionally, when qemu runs in dom0, it already have direct
    access to those bits.
    
    This is the second iteration of this feature. First was proposed as a
    direct Xen interface through a new hypercall, but ultimately it was
    rejected by the maintainer, because of mixing pciback and hypercalls for
    PCI config space access isn't a good design. Full discussion at [2].
    
    [1]: https://invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf
    [2]: https://xen.markmail.org/thread/smpgpws4umdzizze
    
    [part of the commit message and sysfs handling]
    Signed-off-by: default avatarSimon Gaiser <simon@invisiblethingslab.com>
    [the rest]
    Signed-off-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
    Reviewed-by: default avatarRoger Pau Monné <roger.pau@citrix.com>
    [boris: A few small changes suggested by Roger, some formatting changes]
    Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
    476878e4
pciback.h 6.26 KB