bhyve: allow reading of fwctl signature multiple times
ClosedPublic
Actions

Authored by corvink on Sep 16 2021, 6:49 AM.

Details

Reviewers

manu
markj
jhb

Group Reviewers

bhyve

Commits

rGe6674c8f7fe7: bhyve: allow reading of fwctl signature multiple times
rG8ec366ec6c94: bhyve: allow reading of fwctl signature multiple times

Summary

At the moment, you only have one single chance to read the fwctl
signature. At boot bhyve is in the state IDENT_WAIT. It's then
possible to switch to IDENT_SEND. After bhyve sends the signature,
it switches to REQ. From now on it's impossible to switch back to
IDENT_SEND to read the signature. For that reason, only a single
driver can read the signature. A guest can't use two drivers to
identify that fwctl is present. It gets even worse when using
OVMF. OVMF uses a library to access fwctl. Therefore, every single
OVMF driver would try to read the signature. Currently, only a
single OVMF driver accesses the fwctl. So, there's no issue with
it yet. However, no OS driver would have a chance to detect fwctl when
using OVMF because it's signature was already consumed by OVMF.

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>

Note: You can have a look at https://github.com/Beckhoff/freebsd-src/commits/phab/corvink/fwctl-signature

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

corvink created this revision.Sep 16 2021, 6:49 AM

Herald added subscribers: bcran, rgrimes. · View Herald TranscriptSep 16 2021, 6:50 AM

corvink requested review of this revision.Sep 16 2021, 6:50 AM

corvink edited the summary of this revision. (Show Details)Nov 22 2021, 12:13 PM

corvink added reviewers: manu, markj.

Herald added a subscriber: imp. · View Herald TranscriptNov 22 2021, 12:13 PM

Is it sufficient to instead set be_state = IDENT_WAIT in fwctl_inl(), or handle be_state == REQ the same as be_state == IDENT_WAIT in fwctl_outw()?

usr.sbin/bhyve/fwctl.c
475–486	Presumably we should still ignore the write if `be_state == DORMANT`, or perhaps assert that that's not the case.

In D31981#747351, @markj wrote:

Is it sufficient to instead set be_state = IDENT_WAIT in fwctl_inl(), or handle be_state == REQ the same as be_state == IDENT_WAIT in fwctl_outw()?

When the guest checks the signature, the current state of fwctl is unknown. Additionally, bhyve's fwctl uses the same ports as qemu's fwcfg. When the guest checks the presence of qemu's fwcfg, he could misconfigure bhyve's fwctl. We should be able to recover from this situation. For that reason, I'd prefer to unconditionally switch to IDENT_SEND on outw.

corvink updated this revision to Diff 98865.Nov 23 2021, 6:32 AM

corvink marked an inline comment as done.Nov 23 2021, 7:27 AM

markj accepted this revision as: markj.Nov 29 2021, 4:36 PM

markj added inline comments.