Re: [PATCH v3 0/3] virtio DMA API core stuff

From	David Woodhouse <dwmw2@infradead.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3 0/3] virtio DMA API core stuff
Date	2015-11-22 17:00 +0100
Message-ID	<qxFdw-5OZ-13@gated-at.bofh.it> (permalink)
References	<qosyS-7ut-7@gated-at.bofh.it> <qwxL5-1xA-35@gated-at.bofh.it> <qwFpf-6AK-13@gated-at.bofh.it> <qwGY1-7GJ-9@gated-at.bofh.it> <qwPeW-4Iu-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Fri, 2015-11-20 at 10:21 +0200, Michael S. Tsirkin wrote:
> 
> David, there are two things a hypervisor needs to tell the guest.
> 1. The actual device is behind an IOMMU. This is what you
>    are suggesting we use DMAR for.
> 2. Using IOMMU from kernel (as opposed to from userspace with VFIO)
>    actually adds security. For exising virtio devices on KVM,
>    the answer is no. And DMAR has no way to reflect that.

Using the IOMMU from the kernel *always* adds security. It protects
against device driver (and device) bugs which can be made exploitable
by allowing DMA to anywhere in the system.

Sure, there are classes of that which are far more interesting, for
example where you give the whole device to a guest and let it load the
firmware. But "we trust the hypervisor" and "we trust the hardware" are
not *so* far apart conceptually.

Hell, with ATS you *still* have to trust the hardware to a large
extent.

I really think that something like the proposed DMA_ATTR_IOMMU_BYPASS
should suffice for the "who cares about security; we want performance"
case.

-- 
dwmw2

Thread

Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-19 14:50 +0100
  Re: [PATCH v3 0/3] virtio DMA API core stuff Andy Lutomirski <luto@amacapital.net> - 2015-11-19 23:00 +0100
    Re: [PATCH v3 0/3] virtio DMA API core stuff David Woodhouse <dwmw2@infradead.org> - 2015-11-20 00:40 +0100
      Re: [PATCH v3 0/3] virtio DMA API core stuff Benjamin Herrenschmidt <benh@kernel.crashing.org> - 2015-11-20 04:00 +0100
        Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-20 09:40 +0100
      Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-20 09:30 +0100
        Re: [PATCH v3 0/3] virtio DMA API core stuff David Woodhouse <dwmw2@infradead.org> - 2015-11-22 17:00 +0100
          Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-22 23:00 +0100
            Re: [PATCH v3 0/3] virtio DMA API core stuff "David Woodhouse" <dwmw2@infradead.org> - 2015-11-23 00:10 +0100
              Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-23 09:00 +0100
            Re: [PATCH v3 0/3] virtio DMA API core stuff "David Woodhouse" <dwmw2@infradead.org> - 2015-11-23 00:10 +0100
    Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-20 08:00 +0100
      Re: [PATCH v3 0/3] virtio DMA API core stuff "Michael S. Tsirkin" <mst@redhat.com> - 2015-11-20 08:50 +0100

csiph-web