kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jason Wang <jasowang@redhat.com>
To: Stefan Hajnoczi <stefanha@redhat.com>,
	Yongji Xie <xieyongji@bytedance.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>,
	"Stefano Garzarella" <sgarzare@redhat.com>,
	"Parav Pandit" <parav@nvidia.com>,
	"Christoph Hellwig" <hch@infradead.org>,
	"Christian Brauner" <christian.brauner@canonical.com>,
	"Randy Dunlap" <rdunlap@infradead.org>,
	"Matthew Wilcox" <willy@infradead.org>,
	viro@zeniv.linux.org.uk, "Jens Axboe" <axboe@kernel.dk>,
	bcrl@kvack.org, "Jonathan Corbet" <corbet@lwn.net>,
	"Mika Penttilä" <mika.penttila@nextfour.com>,
	"Dan Carpenter" <dan.carpenter@oracle.com>,
	virtualization@lists.linux-foundation.org,
	netdev@vger.kernel.org, kvm@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH v6 10/10] Documentation: Add documentation for VDUSE
Date: Thu, 15 Apr 2021 17:04:58 +0800	[thread overview]
Message-ID: <02c19c22-13ea-ea97-d99b-71edfee0b703@redhat.com> (raw)
In-Reply-To: <80b31814-9e41-3153-7efb-c0c2fab44feb@redhat.com>


在 2021/4/15 下午4:36, Jason Wang 写道:
>>>
>> Please state this explicitly at the start of the document. Existing
>> interfaces like FUSE are designed to avoid trusting userspace.
>
>
> There're some subtle difference here. VDUSE present a device to kernel 
> which means IOMMU is probably the only thing to prevent a malicous 
> device.
>
>
>> Therefore
>> people might think the same is the case here. It's critical that people
>> are aware of this before deploying VDUSE with virtio-vdpa.
>>
>> We should probably pause here and think about whether it's possible to
>> avoid trusting userspace. Even if it takes some effort and costs some
>> performance it would probably be worthwhile.
>
>
> Since the bounce buffer is used the only attack surface is the 
> coherent area, if we want to enforce stronger isolation we need to use 
> shadow virtqueue (which is proposed in earlier version by me) in this 
> case. But I'm not sure it's worth to do that.



So this reminds me the discussion in the end of last year. We need to 
make sure we don't suffer from the same issues for VDUSE at least

https://yhbt.net/lore/all/c3629a27-3590-1d9f-211b-c0b7be152b32@redhat.com/T/#mc6b6e2343cbeffca68ca7a97e0f473aaa871c95b

Or we can solve it at virtio level, e.g remember the dma address instead 
of depending on the addr in the descriptor ring

Thanks


>
>
>>
>> Is the security situation different with vhost-vdpa? In that case it
>> seems more likely that the host kernel doesn't need to trust the
>> userspace VDUSE device.


  reply	other threads:[~2021-04-15  9:05 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-31  8:05 [PATCH v6 00/10] Introduce VDUSE - vDPA Device in Userspace Xie Yongji
2021-03-31  8:05 ` [PATCH v6 01/10] file: Export receive_fd() to modules Xie Yongji
2021-03-31  9:15   ` Christian Brauner
2021-03-31  9:26     ` Dan Carpenter
2021-03-31  9:28       ` Christian Brauner
2021-03-31 11:32     ` Yongji Xie
2021-03-31 12:23       ` Christian Brauner
2021-03-31 13:59         ` Yongji Xie
2021-03-31 14:07           ` Christian Brauner
2021-03-31 14:37             ` Yongji Xie
2021-03-31  8:05 ` [PATCH v6 02/10] eventfd: Increase the recursion depth of eventfd_signal() Xie Yongji
2021-03-31  8:05 ` [PATCH v6 03/10] vhost-vdpa: protect concurrent access to vhost device iotlb Xie Yongji
2021-04-09 16:15   ` Michael S. Tsirkin
2021-04-11  5:36     ` Yongji Xie
2021-04-11 20:48       ` Michael S. Tsirkin
2021-04-12  2:29         ` Yongji Xie
2021-04-12  9:00           ` Michael S. Tsirkin
2021-03-31  8:05 ` [PATCH v6 04/10] vhost-iotlb: Add an opaque pointer for vhost IOTLB Xie Yongji
2021-03-31  8:05 ` [PATCH v6 05/10] vdpa: Add an opaque pointer for vdpa_config_ops.dma_map() Xie Yongji
2021-03-31  8:05 ` [PATCH v6 06/10] vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap() Xie Yongji
2021-03-31  8:05 ` [PATCH v6 07/10] vdpa: Support transferring virtual addressing during DMA mapping Xie Yongji
2021-04-08  2:36   ` Jason Wang
2021-03-31  8:05 ` [PATCH v6 08/10] vduse: Implement an MMU-based IOMMU driver Xie Yongji
2021-04-08  3:25   ` Jason Wang
2021-04-08  5:27     ` Yongji Xie
2021-03-31  8:05 ` [PATCH v6 09/10] vduse: Introduce VDUSE - vDPA Device in Userspace Xie Yongji
2021-04-08  6:57   ` Jason Wang
2021-04-08  9:36     ` Yongji Xie
2021-04-09  5:36       ` Jason Wang
2021-04-09  8:02         ` Yongji Xie
2021-04-12  7:16           ` Jason Wang
2021-04-12  8:02             ` Yongji Xie
2021-04-12  9:37               ` Jason Wang
2021-04-12  9:59                 ` Yongji Xie
2021-04-13  3:35                   ` Jason Wang
2021-04-13  4:28                     ` Yongji Xie
2021-04-14  8:18                       ` Jason Wang
2021-04-16  3:24   ` Jason Wang
2021-04-16  8:43     ` Yongji Xie
2021-03-31  8:05 ` [PATCH v6 10/10] Documentation: Add documentation for VDUSE Xie Yongji
2021-04-08  7:18   ` Jason Wang
2021-04-08  8:09     ` Yongji Xie
2021-04-14 14:14   ` Stefan Hajnoczi
2021-04-15  5:38     ` Yongji Xie
2021-04-15  7:19       ` Stefan Hajnoczi
2021-04-15  8:33         ` Yongji Xie
2021-04-15 14:17           ` Stefan Hajnoczi
2021-04-15  8:36         ` Jason Wang
2021-04-15  9:04           ` Jason Wang [this message]
2021-04-15 11:17             ` Yongji Xie
2021-04-16  2:20               ` Jason Wang
2021-04-16  2:58                 ` Yongji Xie
2021-04-16  3:02                   ` Jason Wang
2021-04-16  3:18                     ` Yongji Xie
2021-04-15 14:38           ` Stefan Hajnoczi
2021-04-16  2:23             ` Jason Wang
2021-04-16  3:19               ` Yongji Xie
2021-04-16  5:39                 ` Jason Wang
2021-04-16  3:13             ` Yongji Xie
2021-04-14  7:34 ` [PATCH v6 00/10] Introduce VDUSE - vDPA Device in Userspace Michael S. Tsirkin
2021-04-14  7:49   ` Jason Wang
2021-04-14  7:54   ` Yongji Xie

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=02c19c22-13ea-ea97-d99b-71edfee0b703@redhat.com \
    --to=jasowang@redhat.com \
    --cc=axboe@kernel.dk \
    --cc=bcrl@kvack.org \
    --cc=christian.brauner@canonical.com \
    --cc=corbet@lwn.net \
    --cc=dan.carpenter@oracle.com \
    --cc=hch@infradead.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=mika.penttila@nextfour.com \
    --cc=mst@redhat.com \
    --cc=netdev@vger.kernel.org \
    --cc=parav@nvidia.com \
    --cc=rdunlap@infradead.org \
    --cc=sgarzare@redhat.com \
    --cc=stefanha@redhat.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=virtualization@lists.linux-foundation.org \
    --cc=willy@infradead.org \
    --cc=xieyongji@bytedance.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).