On 2016-05-29 10:11, Wei Wang wrote: > Signed-off-by: Wei Wang <wei.w.wang@xxxxxxxxx> > --- > FutureWorks | 21 +++++++++++++++++++++ > 1 file changed, 21 insertions(+) > create mode 100644 FutureWorks > > diff --git a/FutureWorks b/FutureWorks > new file mode 100644 > index 0000000..210edcd > --- /dev/null > +++ b/FutureWorks > @@ -0,0 +1,21 @@ > +The vhost-pci design is currently suitable for a group of VMs who trust each > +other. To extend it to a more general use case, two security features can be > +added in the future. Sounds a bit like security is just "nice to have" in the foreseen use cases of this mechanism. Is that really true? > + > +1 vIOMMU > +vIOMMU provides the driver VM with the ability to restrict the device VM to > +transiently access a specified portion of its memory. The vhost-pci design > +proposed in this RFC can be extended to access the driver VM's memory with > +vIOMMU. Precisely, the vIOMMU engine in the driver VM configures access > +permissions (R/W) for the vhost-pci device to access its memory. More details > +can be found at https://wiki.opnfv.org/display/kvm/Vm2vm+Mst and > +https://lists.gnu.org/archive/html/qemu-devel/2015-08/msg03993.html Do you have performance estimates on this approach already? One challenge should be how to let the VMs reuse existing buffer mappings so that the vIOMMU isn't continuously reprogrammed - which is likely not very efficient. The other is how to hand over packets/buffers in a chain of multiple VMs. Ideally, there is already a hand-over from sender to the first receiver so that the sender can no longer mess with the packet after the receiver started processing it. However, that will work against efficiency. Essentially, it's the old IPC question of remap vs. copy here. The rest is "just" interfaces to exploit this elegantly. > + > +2 eptp switching > +The idea of eptp swithing allows a vhost-pci device driver to access the mapped > +driver VM's memory in an alternative view, where only a piece of trusted code > +can access the driver VM's memory. More details can be found at > +http://events.linuxfoundation.org/sites/events/files/slides/ > +Jun_Nakajima_NFV_KVM%202015_final.pdf As we learned a while back, this one is not really secure. Any updates on if/how this is going to be fixed? Jan -- Siemens AG, Corporate Technology, CT RDA ITP SES-DE Corporate Competence Center Embedded Linux -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
