From: John Johnson <john.g.johnson@oracle.com>
To: qemu-devel@nongnu.org
Subject: [RFC v5 18/23] vfio-user: secure DMA support
Date: Thu, 5 May 2022 10:20:01 -0700 [thread overview]
Message-ID: <009bd0af58106715c1b5be2454a1485909c213b5.1651709440.git.john.g.johnson@oracle.com> (raw)
In-Reply-To: <cover.1651709440.git.john.g.johnson@oracle.com>
Secure DMA forces the remote process to use DMA r/w messages
instead of directly mapping guest memeory.
Signed-off-by: John G Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
---
hw/vfio/pci.h | 1 +
hw/vfio/user.h | 1 +
hw/vfio/pci.c | 4 ++++
hw/vfio/user.c | 2 +-
4 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index a4eb5b9..c207847 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -194,6 +194,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserPCIDevice, VFIO_USER_PCI)
struct VFIOUserPCIDevice {
VFIOPCIDevice device;
char *sock_name;
+ bool secure_dma; /* disable shared mem for DMA */
bool send_queued; /* all sends are queued */
bool no_post; /* all regions write are sync */
};
diff --git a/hw/vfio/user.h b/hw/vfio/user.h
index 742e1a9..ec764d3 100644
--- a/hw/vfio/user.h
+++ b/hw/vfio/user.h
@@ -76,6 +76,7 @@ typedef struct VFIOProxy {
/* VFIOProxy flags */
#define VFIO_PROXY_CLIENT 0x1
+#define VFIO_PROXY_SECURE 0x2
#define VFIO_PROXY_FORCE_QUEUED 0x4
#define VFIO_PROXY_NO_POST 0x8
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 054a2bd..2faf890 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3589,6 +3589,9 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
vbasedev->proxy = proxy;
vfio_user_set_handler(vbasedev, vfio_user_pci_process_req, vdev);
+ if (udev->secure_dma) {
+ proxy->flags |= VFIO_PROXY_SECURE;
+ }
if (udev->send_queued) {
proxy->flags |= VFIO_PROXY_FORCE_QUEUED;
}
@@ -3720,6 +3723,7 @@ static void vfio_user_instance_finalize(Object *obj)
static Property vfio_user_pci_dev_properties[] = {
DEFINE_PROP_STRING("socket", VFIOUserPCIDevice, sock_name),
+ DEFINE_PROP_BOOL("secure-dma", VFIOUserPCIDevice, secure_dma, false),
DEFINE_PROP_BOOL("x-send-queued", VFIOUserPCIDevice, send_queued, false),
DEFINE_PROP_BOOL("x-no-posted-writes", VFIOUserPCIDevice, no_post, false),
DEFINE_PROP_END_OF_LIST(),
diff --git a/hw/vfio/user.c b/hw/vfio/user.c
index 29eff8a..b08108c 100644
--- a/hw/vfio/user.c
+++ b/hw/vfio/user.c
@@ -1528,7 +1528,7 @@ static int vfio_user_io_dma_map(VFIOContainer *container, MemoryRegion *mr,
* map->vaddr enters as a QEMU process address
* make it either a file offset for mapped areas or 0
*/
- if (fd != -1) {
+ if (fd != -1 && (container->proxy->flags & VFIO_PROXY_SECURE) == 0) {
void *addr = (void *)(uintptr_t)map->vaddr;
map->vaddr = qemu_ram_block_host_offset(mr->ram_block, addr);
--
1.8.3.1
next prev parent reply other threads:[~2022-05-05 17:22 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1651709440.git.john.g.johnson@oracle.com>
2022-05-05 17:19 ` [RFC v5 01/23] vfio-user: introduce vfio-user protocol specification John Johnson
2022-05-05 17:19 ` [RFC v5 02/23] vfio-user: add VFIO base abstract class John Johnson
2022-05-05 17:19 ` [RFC v5 03/23] vfio-user: add container IO ops vector John Johnson
2022-05-05 17:19 ` [RFC v5 04/23] vfio-user: add region cache John Johnson
2022-05-05 17:19 ` [RFC v5 05/23] vfio-user: add device IO ops vector John Johnson
2022-05-05 17:19 ` [RFC v5 06/23] vfio-user: Define type vfio_user_pci_dev_info John Johnson
2022-05-05 17:19 ` [RFC v5 07/23] vfio-user: connect vfio proxy to remote server John Johnson
2022-05-05 17:19 ` [RFC v5 08/23] vfio-user: define socket receive functions John Johnson
2022-05-05 17:19 ` [RFC v5 09/23] vfio-user: define socket send functions John Johnson
2022-05-05 17:19 ` [RFC v5 10/23] vfio-user: get device info John Johnson
2022-05-05 17:19 ` [RFC v5 11/23] vfio-user: get region info John Johnson
2022-05-05 17:19 ` [RFC v5 12/23] vfio-user: region read/write John Johnson
2022-05-05 17:19 ` [RFC v5 13/23] vfio-user: pci_user_realize PCI setup John Johnson
2022-05-05 17:19 ` [RFC v5 14/23] vfio-user: forward msix BAR accesses to server John Johnson
2022-05-05 17:19 ` [RFC v5 15/23] vfio-user: get and set IRQs John Johnson
2022-05-05 17:19 ` [RFC v5 16/23] vfio-user: proxy container connect/disconnect John Johnson
2022-05-05 17:20 ` [RFC v5 17/23] vfio-user: dma map/unmap operations John Johnson
2022-05-05 17:20 ` John Johnson [this message]
2022-05-05 17:20 ` [RFC v5 19/23] vfio-user: dma read/write operations John Johnson
2022-05-05 17:20 ` [RFC v5 20/23] vfio-user: pci reset John Johnson
2022-05-05 17:20 ` [RFC v5 21/23] vfio-user: add 'x-msg-timeout' option that specifies msg wait times John Johnson
2022-05-05 17:20 ` [RFC v5 22/23] vfio-user: add tracing to send/recv paths John Johnson
2022-05-05 17:20 ` [RFC v5 23/23] vfio-user: add dirty_bitmap stub until it support migration John Johnson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=009bd0af58106715c1b5be2454a1485909c213b5.1651709440.git.john.g.johnson@oracle.com \
--to=john.g.johnson@oracle.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.