Currently, VMbus drivers use pointers into guest memory as request IDs
for interactions with Hyper-V. To be more robust in the face of errors
or malicious behavior from a compromised Hyper-V, avoid exposing
guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a
bad request ID that is then treated as the address of a guest data
structure with no validation. Instead, encapsulate these memory
addresses and provide small integers as request IDs.
The first patch creates the definitions for the data structure, provides
helper methods to generate new IDs and retrieve data, and
allocates/frees the memory needed for vmbus_requestor.
The second and third patches make use of vmbus_requestor to send request
IDs to Hyper-V in storvsc and netvsc respectively.
Thanks.
Andres Beltran
Cc: James E.J. Bottomley <[email protected]>
Cc: Martin K. Petersen <[email protected]>
Cc: David S. Miller <[email protected]>
Andres Beltran (3):
Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus
hardening
scsi: storvsc: Use vmbus_requestor to generate transaction IDs for
VMBus hardening
hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus
hardening
drivers/hv/channel.c | 175 ++++++++++++++++++++++++++++++
drivers/net/hyperv/hyperv_net.h | 13 +++
drivers/net/hyperv/netvsc.c | 79 +++++++++++---
drivers/net/hyperv/rndis_filter.c | 1 +
drivers/scsi/storvsc_drv.c | 85 +++++++++++++--
include/linux/hyperv.h | 22 ++++
6 files changed, 350 insertions(+), 25 deletions(-)
--
2.25.1
On Wed, 22 Jul 2020 11:10:48 -0700
"Andres Beltran" <[email protected]> wrote:
> Currently, VMbus drivers use pointers into guest memory as request IDs
> for interactions with Hyper-V. To be more robust in the face of errors
> or malicious behavior from a compromised Hyper-V, avoid exposing
> guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a
> bad request ID that is then treated as the address of a guest data
> structure with no validation. Instead, encapsulate these memory
> addresses and provide small integers as request IDs.
>
> The first patch creates the definitions for the data structure, provides
> helper methods to generate new IDs and retrieve data, and
> allocates/frees the memory needed for vmbus_requestor.
>
> The second and third patches make use of vmbus_requestor to send request
> IDs to Hyper-V in storvsc and netvsc respectively.
>
> Thanks.
> Andres Beltran
>
> Cc: James E.J. Bottomley <[email protected]>
> Cc: Martin K. Petersen <[email protected]>
> Cc: David S. Miller <[email protected]>
>
> Andres Beltran (3):
> Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus
> hardening
> scsi: storvsc: Use vmbus_requestor to generate transaction IDs for
> VMBus hardening
> hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus
> hardening
>
> drivers/hv/channel.c | 175 ++++++++++++++++++++++++++++++
> drivers/net/hyperv/hyperv_net.h | 13 +++
> drivers/net/hyperv/netvsc.c | 79 +++++++++++---
> drivers/net/hyperv/rndis_filter.c | 1 +
> drivers/scsi/storvsc_drv.c | 85 +++++++++++++--
> include/linux/hyperv.h | 22 ++++
> 6 files changed, 350 insertions(+), 25 deletions(-)
>
What is the performance impact of this?
It means keeping a global (bookkeeping) structure which should have
noticeable impact on mult-queue performance.
From: Stephen Hemminger <[email protected]> Sent: Wednesday, July 22, 2020 11:41 AM
>
> On Wed, 22 Jul 2020 11:10:48 -0700
> "Andres Beltran" <[email protected]> wrote:
>
> > Currently, VMbus drivers use pointers into guest memory as request IDs
> > for interactions with Hyper-V. To be more robust in the face of errors
> > or malicious behavior from a compromised Hyper-V, avoid exposing
> > guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a
> > bad request ID that is then treated as the address of a guest data
> > structure with no validation. Instead, encapsulate these memory
> > addresses and provide small integers as request IDs.
> >
> > The first patch creates the definitions for the data structure, provides
> > helper methods to generate new IDs and retrieve data, and
> > allocates/frees the memory needed for vmbus_requestor.
> >
> > The second and third patches make use of vmbus_requestor to send request
> > IDs to Hyper-V in storvsc and netvsc respectively.
> >
> > Thanks.
> > Andres Beltran
> >
> > Cc: James E.J. Bottomley <[email protected]>
> > Cc: Martin K. Petersen <[email protected]>
> > Cc: David S. Miller <[email protected]>
> >
> > Andres Beltran (3):
> > Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus
> > hardening
> > scsi: storvsc: Use vmbus_requestor to generate transaction IDs for
> > VMBus hardening
> > hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus
> > hardening
> >
> > drivers/hv/channel.c | 175 ++++++++++++++++++++++++++++++
> > drivers/net/hyperv/hyperv_net.h | 13 +++
> > drivers/net/hyperv/netvsc.c | 79 +++++++++++---
> > drivers/net/hyperv/rndis_filter.c | 1 +
> > drivers/scsi/storvsc_drv.c | 85 +++++++++++++--
> > include/linux/hyperv.h | 22 ++++
> > 6 files changed, 350 insertions(+), 25 deletions(-)
> >
>
>
> What is the performance impact of this?
> It means keeping a global (bookkeeping) structure which should have
> noticeable impact on mult-queue performance.
The bookkeeping structure is per-VMbus channel. There's nothing
global. Andrea Parri previously did some testing and reported no
measurable impact.
Michael