On Sun, Nov 22, 2015 at 03:58:28PM +0000, David Woodhouse wrote: > On Fri, 2015-11-20 at 10:21 +0200, Michael S. Tsirkin wrote: > > > > David, there are two things a hypervisor needs to tell the guest. > > 1. The actual device is behind an IOMMU. This is what you > > are suggesting we use DMAR for. > > 2. Using IOMMU from kernel (as opposed to from userspace with VFIO) > > actually adds security. For exising virtio devices on KVM, > > the answer is no. And DMAR has no way to reflect that. > > Using the IOMMU from the kernel *always* adds security. It protects > against device driver (and device) bugs which can be made exploitable > by allowing DMA to anywhere in the system. No - speaking about QEMU/KVM here - you are not "allowing" DMA - by programming the virtual IOMMU you are asking the hypervisor nicely to do that. If it's buggy, it can ignore you and there's nothing you can do. As with any random change in the system, some bugs might get masked and become non-exploitable, but then some other bugs might surface and become exploitable. I gather that e.g. Xen is different. > Sure, there are classes of that which are far more interesting, for > example where you give the whole device to a guest and let it load the > firmware. But "we trust the hypervisor" and "we trust the hardware" are > not *so* far apart conceptually. Depends on the hypervisor I guess. At least for QEMU/KVM, one conceptual difference is that we actually could have the hypervisor tell us whether a specific device has to be trusted, or can be protected against, and user can actually read the code and verify that QEMU is doing the right thing. Hardware is closed source so harder to trust. > Hell, with ATS you *still* have to trust the hardware to a large > extent. > > I really think that something like the proposed DMA_ATTR_IOMMU_BYPASS > should suffice I'm not sure how that is supposed to be used - does the driver request DMA_ATTR_IOMMU_BYPASS at setup time? If yes then I think that will work for virtio - we can just set that in the driver. > for the "who cares about security; we want performance" > case. > > -- > dwmw2 > There's that, and there's an "I care about security, but do not want to burn up cycles on fake protections that do not work" case. -- MST -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
