On Wed, Oct 28, 2015 at 10:35:27PM +0900, David Woodhouse wrote:> On Wed, 2015-10-28 at 13:35 +0200, Michael S. Tsirkin wrote: > > E.g. on intel x86, there's an option iommu=pt which does the 1:1 > > thing for devices when used by kernel, but enables > > the iommu if used by userspace/VMs. > > That's none of your business. > > You call the DMA API when you do DMA. That's all there is to it. > > If the IOMMU happens to be in passthrough mode, or your device happens > to not to be routed through an IOMMU today, then I/O virtual address > you get back from the DMA API will look a *lot* like the physical > address you asked the DMA to map. You might think there's no IOMMU. We > couldn't possibly comment. > > Use the DMA API. Always. Let the platform worry about whether it > actually needs to *do* anything or not. > -- > dwmw2 > >Short answer - platforms need a way to discover, and express different security requirements of different devices. If they continue to lack that, we'll need a custom API in virtio, and while this seems a bit less elegant, I would not see that as the end of the world at all, there are not that many virtio drivers. And hey - that's just an internal API. We can change it later at a whim. Long answer - PV is weird. It's not always the same as real hardware. For PV, it's generally hypervisor doing writes into memory. If it's monolitic with device emulation in same memory space as the hypervisor (e.g. in the case of the current QEMU, or using vhost in host kernel), then you gain *no security* by "restricting" it by means of the IOMMU - the IOMMU is part of the same hypervisor. If it is modular with device emulation in a separate memory space (e.g. in case of Xen, or vhost-user in modern QEMU) then you do gain security: the part emulating the IOMMU limits the part doing DMA. In both cases for assigned devices, it is always modular in a sense, so you do gain security since that is restricted by the hardware IOMMU. The way things are set up at the moment, it's mostly global, with iommu=pt on intel being a kind of exception. We need host/guest and API interfaces that are more nuanced than that. -- MST
On Wed, 2015-10-28 at 16:05 +0200, Michael S. Tsirkin wrote:> > Short answer - platforms need a way to discover, and express different > security requirements of different devices.Sure. PLATFORMS need that. Do not let it go anywhere near your device drivers. Including the virtio drivers.> If they continue to lack that, we'll need a custom API in virtio, > and while this seems a bit less elegant, I would not see that as > the end of the world at all, there are not that many virtio drivers.No. If they continue to lack that, we fix them. This is a *platform* issue. The DMA API shall do the right thing. Do not second-guess it. (From the other mail)> > > OK so I guess that means we should prefer a transport-specific > > > interface in virtio-pci then. > > > > Why? > > Because you said you are doing something device tree specific for > ARM, aren't you?Nonono. The ARM platform code might do that, and the DMA API on ARM *might* give you I/O virtual addresses that look a lot like the physical addresses you asked it to map. That's none of your business. Drivers use DMA API. No more talky. -- dwmw2 -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 5691 bytes Desc: not available URL: <http://lists.linuxfoundation.org/pipermail/virtualization/attachments/20151028/1c07114f/attachment.bin>
On Wed, Oct 28, 2015 at 11:13:29PM +0900, David Woodhouse wrote:> On Wed, 2015-10-28 at 16:05 +0200, Michael S. Tsirkin wrote: > > > > Short answer - platforms need a way to discover, and express different > > security requirements of different devices. > > Sure. PLATFORMS need that. Do not let it go anywhere near your device > drivers. Including the virtio drivers.But would there be any users of this outside the virtio subsystem? If no, maybe virtio core is a logical place to keep this.> > If they continue to lack that, we'll need a custom API in virtio, > > and while this seems a bit less elegant, I would not see that as > > the end of the world at all, there are not that many virtio drivers. > > No. If they continue to lack that, we fix them. This is a *platform* > issue. The DMA API shall do the right thing. Do not second-guess it. > > > (From the other mail)I don't have a problem with extending DMA API to address more usecases.> > > > OK so I guess that means we should prefer a transport-specific > > > > interface in virtio-pci then. > > > > > > Why? > > > > Because you said you are doing something device tree specific for > > ARM, aren't you? > > Nonono. The ARM platform code might do that, and the DMA API on ARM > *might* give you I/O virtual addresses that look a lot like the > physical addresses you asked it to map. That's none of your business. > Drivers use DMA API. No more talky.Well for virtio they don't ATM. And 1:1 mapping makes perfect sense for the wast majority of users, so I can't switch them over until the DMA API actually addresses all existing usecases.> -- > dwmw2 > >