Re: [Qemu-devel] KVM call for 2017-03-14

From: Paolo Bonzini <pbonzini@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>,
	Stefan Hajnoczi <stefanha@gmail.com>
Cc: Juan Quintela <quintela@redhat.com>,
	QEMU Developer <qemu-devel@nongnu.org>,
	KVM devel mailing list <kvm@vger.kernel.org>
Subject: Re: [Qemu-devel] KVM call for 2017-03-14
Date: Tue, 14 Mar 2017 11:44:39 +0100	[thread overview]
Message-ID: <db6cb6b2-d618-b158-9ac8-955375093b9b@redhat.com> (raw)
In-Reply-To: <CAFEAcA-Qb2fp1kvksE4gBc+-1s29swwqTApFTcaMXnTO7aWDcg@mail.gmail.com>

On 14/03/2017 11:39, Peter Maydell wrote:
>> 3. Is it safer than C even when writing code to operate on guest RAM
>>    (i.e. it's no good if you must use unsafe primitives to do the
>>    systems programming tasks that QEMU requires)?
> My impression is that many of our security vulnerabilities are
> overflows in local arrays in the device emulation (for instance
> good old VENOM), so I think that even if a candidate safer
> language only provided bounds-checking on arrays it knew about
> and not on raw guest RAM it would still be a significant
> improvement. (Accesses to guest RAM are often via APIs that
> we could add bounds-checks to "by hand" anyway.) 

Right, this was one of the reasons behind the introduction of
MemoryRegionCache: get both speed (like address_space_map) and bounds
checking (like address_space_rw).

It looks like it should be easy to wrap it in any language, be it Rust
or a scripting language like Lua.

Paolo