From: "Edgar E. Iglesias" <edgar.iglesias@gmail.com>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: "Michael S. Tsirkin" <mst@redhat.com>,
"Jason Wang" <jasowang@redhat.com>,
"Mark Cave-Ayland" <mark.cave-ayland@ilande.co.uk>,
"QEMU Developers" <qemu-devel@nongnu.org>,
"Peter Xu" <peterx@redhat.com>,
"Gerd Hoffmann" <kraxel@redhat.com>,
"Robert Foley" <robert.foley@linaro.org>,
"Edgar E . Iglesias" <edgar.iglesias@xilinx.com>,
Qemu-block <qemu-block@nongnu.org>, "Li Qiang" <liq3ea@163.com>,
"Laszlo Ersek" <lersek@redhat.com>,
"Emilio G . Cota" <cota@braap.org>,
"Peter Chubb" <peter.chubb@nicta.com.au>,
"Joel Stanley" <joel@jms.id.au>,
"Richard Henderson" <rth@twiddle.net>,
"Philippe Mathieu-Daudé" <philmd@redhat.com>,
"Eduardo Habkost" <ehabkost@redhat.com>,
"Alistair Francis" <alistair@alistair23.me>,
"Richard Henderson" <richard.henderson@linaro.org>,
"Beniamino Galvani" <b.galvani@gmail.com>,
"Eric Auger" <eric.auger@redhat.com>,
qemu-arm <qemu-arm@nongnu.org>, "Jan Kiszka" <jan.kiszka@web.de>,
"Cédric Le Goater" <clg@kaod.org>,
"Stefan Hajnoczi" <stefanha@redhat.com>,
"John Snow" <jsnow@redhat.com>,
"David Gibson" <david@gibson.dropbear.id.au>,
"Tony Nguyen" <tony.nguyen@bt.com>,
"Prasad J Pandit" <pjp@fedoraproject.org>,
"Alexander Bulekov" <alxndr@bu.edu>,
"Andrew Jeffery" <andrew@aj.id.au>,
"Klaus Jensen" <k.jensen@samsung.com>,
"Emanuele Giuseppe Esposito" <e.emanuelegiuseppe@gmail.com>,
"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
"Andrew Baumann" <Andrew.Baumann@microsoft.com>,
qemu-ppc <qemu-ppc@nongnu.org>,
"Paolo Bonzini" <pbonzini@redhat.com>
Subject: Re: [RFC PATCH 00/12] hw: Forbid DMA write accesses to MMIO regions
Date: Thu, 3 Sep 2020 16:24:10 +0200 [thread overview]
Message-ID: <20200903142410.GX2954729@toto> (raw)
In-Reply-To: <CAFEAcA8aOzq8UQwKiyuvJokBT9ui6JWxzf=T8=r13Vuu6+_kkQ@mail.gmail.com>
On Thu, Sep 03, 2020 at 02:58:19PM +0100, Peter Maydell wrote:
> On Thu, 3 Sep 2020 at 14:37, Laszlo Ersek <lersek@redhat.com> wrote:
> > Peter mentions an approach at the end of
> > <https://bugs.launchpad.net/qemu/+bug/1886362/comments/5> that I believe
> > to understand, but -- according to him -- it seems too much work.
>
> It also would only be effective for MMIO, not for qemu_irq lines...
>
> > I don't think such chains work unto arbitrary depths on physical
> > hardware either.
>
> Real hardware by and large doesn't get designed with this kind
> of DMA-to-self as a consideration either, but unfortunately it's
> not really very useful as a model to base QEMU's behaviour on:
>
> (1) real hardware is usually massively parallel, so the logic
> that handles incoming MMIO is decoupled anyway from logic
> that does outgoing DMA. (Arguably the "do all DMA in a
> bottom-half" idea is kind of following the hardware design.)
> Similarly simple "raise this outbound signal" logic just
> works as an instantaneous action that causes the device on
> the other end to change its state/do something parallel,
> whereas for QEMU we need to actually call some code in the
> device on the other end and so we serialize this stuff,
> sandwiching a bit of "device B code" in the middle of a
> run of "device A code". So a lot more of this stuff "just
> happens to work" on h/w than we get with QEMU.
> (2) if software running on real h/w does do something silly with
> programming a device to DMA to itself then the worst case is
> generally that they manage to wedge that device (or the whole
> machine, if you're really unlucky), in which case the response
> is "don't do that then". There isn't the same "guest code
> can escape the VM" security boundary that QEMU needs to guard
> against [*].
>
> [*] I do wonder about hardware-device-passthrough setups; I
> don't think I would care to pass through an arbitrary device
> to an untrusted guest...
Hmm, I guess it would make sense to have a configurable option in KVM
to isolate passthrough devices so they only can DMA to guest RAM...
Cheers,
Edgar
next prev parent reply other threads:[~2020-09-03 14:24 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-03 11:08 [RFC PATCH 00/12] hw: Forbid DMA write accesses to MMIO regions Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 01/12] pci: pass along the return value of dma_memory_rw Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 02/12] dma: Let dma_memory_valid() take MemTxAttrs argument Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 03/12] dma: Let dma_memory_set() " Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 04/12] dma: Let dma_memory_rw_relaxed() " Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 05/12] dma: Let dma_memory_rw() " Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 06/12] dma: Let dma_memory_read/write() " Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 07/12] dma: Let dma_memory_map() " Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 08/12] docs/devel/loads-stores: Add regexp for DMA functions Philippe Mathieu-Daudé
2020-09-03 11:08 ` [PATCH 09/12] dma: Let load/store DMA functions take MemTxAttrs argument Philippe Mathieu-Daudé
2020-09-03 11:08 ` [RFC PATCH 10/12] exec/memattrs: Introduce MemTxAttrs::direct_access field Philippe Mathieu-Daudé
2020-09-03 11:08 ` [RFC PATCH 11/12] hw/pci: Only allow PCI slave devices to write to direct memory Philippe Mathieu-Daudé
2020-09-03 12:26 ` Paolo Bonzini
2020-09-03 13:18 ` Philippe Mathieu-Daudé
2020-09-03 21:43 ` Paolo Bonzini
2020-09-03 11:08 ` [RFC PATCH 12/12] dma: Assert when device writes to indirect memory (such MMIO regions) Philippe Mathieu-Daudé
2020-09-03 13:51 ` Edgar E. Iglesias
2020-09-03 13:37 ` [RFC PATCH 00/12] hw: Forbid DMA write accesses to MMIO regions Laszlo Ersek
2020-09-03 13:58 ` Peter Maydell
2020-09-03 14:24 ` Edgar E. Iglesias [this message]
2020-09-03 15:46 ` Paolo Bonzini
2020-09-03 15:50 ` Edgar E. Iglesias
2020-09-03 17:53 ` Paolo Bonzini
2020-09-03 19:46 ` Edgar E. Iglesias
2020-09-04 2:50 ` Jason Wang
2020-09-05 2:27 ` Li Qiang
2020-09-08 14:37 ` Stefan Hajnoczi
2020-09-09 13:23 ` Peter Maydell
2020-09-09 13:41 ` Stefan Hajnoczi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200903142410.GX2954729@toto \
--to=edgar.iglesias@gmail.com \
--cc=Andrew.Baumann@microsoft.com \
--cc=alistair@alistair23.me \
--cc=alxndr@bu.edu \
--cc=andrew@aj.id.au \
--cc=b.galvani@gmail.com \
--cc=clg@kaod.org \
--cc=cota@braap.org \
--cc=david@gibson.dropbear.id.au \
--cc=e.emanuelegiuseppe@gmail.com \
--cc=edgar.iglesias@xilinx.com \
--cc=ehabkost@redhat.com \
--cc=eric.auger@redhat.com \
--cc=f4bug@amsat.org \
--cc=jan.kiszka@web.de \
--cc=jasowang@redhat.com \
--cc=joel@jms.id.au \
--cc=jsnow@redhat.com \
--cc=k.jensen@samsung.com \
--cc=kraxel@redhat.com \
--cc=lersek@redhat.com \
--cc=liq3ea@163.com \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.chubb@nicta.com.au \
--cc=peter.maydell@linaro.org \
--cc=peterx@redhat.com \
--cc=philmd@redhat.com \
--cc=pjp@fedoraproject.org \
--cc=qemu-arm@nongnu.org \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=robert.foley@linaro.org \
--cc=rth@twiddle.net \
--cc=stefanha@redhat.com \
--cc=tony.nguyen@bt.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).