From: Jason Gunthorpe <jgg@nvidia.com>
To: Alex Williamson <alex.williamson@redhat.com>
Cc: Joerg Roedel <joro@8bytes.org>,
"Tian, Kevin" <kevin.tian@intel.com>,
Jean-Philippe Brucker <jean-philippe@linaro.org>,
David Gibson <david@gibson.dropbear.id.au>,
Jason Wang <jasowang@redhat.com>,
"parav@mellanox.com" <parav@mellanox.com>,
"Enrico Weigelt, metux IT consult" <lkml@metux.net>,
Paolo Bonzini <pbonzini@redhat.com>,
Shenming Lu <lushenming@huawei.com>,
Eric Auger <eric.auger@redhat.com>,
Jonathan Corbet <corbet@lwn.net>,
"Raj, Ashok" <ashok.raj@intel.com>,
"Liu, Yi L" <yi.l.liu@intel.com>, "Wu, Hao" <hao.wu@intel.com>,
"Jiang, Dave" <dave.jiang@intel.com>,
Jacob Pan <jacob.jun.pan@linux.intel.com>,
Kirti Wankhede <kwankhede@nvidia.com>,
Robin Murphy <robin.murphy@arm.com>,
"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
"iommu@lists.linux-foundation.org"
<iommu@lists.linux-foundation.org>,
David Woodhouse <dwmw2@infradead.org>,
LKML <linux-kernel@vger.kernel.org>,
Lu Baolu <baolu.lu@linux.intel.com>
Subject: Re: Plan for /dev/ioasid RFC v2
Date: Fri, 11 Jun 2021 22:28:46 -0300 [thread overview]
Message-ID: <20210612012846.GC1002214@nvidia.com> (raw)
In-Reply-To: <20210611133828.6c6e8b29.alex.williamson@redhat.com>
On Fri, Jun 11, 2021 at 01:38:28PM -0600, Alex Williamson wrote:
> That's fine for a serial port, but not a device that can do DMA.
> The entire point of vfio is to try to provide secure, DMA capable
> userspace drivers. If we relax enforcement of that isolation we've
> failed.
I don't understand why the IOASID matters at all in this. Can you
explain? What is the breach of isolation?
A userspace process can create many IOASIDs, it can create an IOASID
that can touch any memory the process can touch. It can create two
IOASID's that are identical copies of each other.
How does restricting a device from attaching to an IOASID create
security if I can just make a copy of that IOASID and attach to that?
Is there some quirk of the IOMMU I'm missing?
My understanding of isolation has been that two different security
contexts cannot have access to devices in the same group because that
can leak access across a security bounday, eg because device A can do
DMA to device B and take control of it.
Isolation means that the control of the devices in a group is not
inadventantly spread between two security contexts, like two
processes.
> I don't see how this provides isolation. If a user only needs to
> attach their devicefd to an ioasidfd to have full access to their
> device, not even bound by attaching to an ioasid context, then we've
> failed.
That is not quite what I tried to explain. The first ioasid any device
in the group attaches to becomes the only ioasid that any device in
the group attaches to. It is an ownership model unique to the
iommu_fd.
It directly prevents process A and process B from opening devices in
the same group and trying to operate them independently. A and B will
not posses the same iommu fd so only one of them can activate a
device. The other device remains unusable.
Iin this model, I consider the iommu_fd to be the security domain. The
meaning of isolation is that only devices explicitly joined to an
iommu_fd can access IOASIDs in that iommu_fd.
Userspace has choices how to use this
Placing all devices in the same iommu_fd userspace is telling the
kernel that they are in the same security domain. This means userspace
says is safe for them to all share IOASIDs without isolation.
If userspace wants tigher security domains then userspace can create
additional iommu_fds, up to a unique iommu_fd per group. This would
duplicate the security model that the vfio groups force today.
The kernel security feature is to prevent un-isolated devices from
being joined to different iommu_fd security contexts.
Jason
WARNING: multiple messages have this Message-ID (diff)
From: Jason Gunthorpe <jgg@nvidia.com>
To: Alex Williamson <alex.williamson@redhat.com>
Cc: "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
Jason Wang <jasowang@redhat.com>,
Kirti Wankhede <kwankhede@nvidia.com>,
Jean-Philippe Brucker <jean-philippe@linaro.org>,
"Jiang, Dave" <dave.jiang@intel.com>,
"Raj, Ashok" <ashok.raj@intel.com>,
Jonathan Corbet <corbet@lwn.net>,
"Tian, Kevin" <kevin.tian@intel.com>,
"parav@mellanox.com" <parav@mellanox.com>,
"Enrico Weigelt, metux IT consult" <lkml@metux.net>,
David Gibson <david@gibson.dropbear.id.au>,
Robin Murphy <robin.murphy@arm.com>,
LKML <linux-kernel@vger.kernel.org>,
Shenming Lu <lushenming@huawei.com>,
"iommu@lists.linux-foundation.org"
<iommu@lists.linux-foundation.org>,
Paolo Bonzini <pbonzini@redhat.com>,
David Woodhouse <dwmw2@infradead.org>
Subject: Re: Plan for /dev/ioasid RFC v2
Date: Fri, 11 Jun 2021 22:28:46 -0300 [thread overview]
Message-ID: <20210612012846.GC1002214@nvidia.com> (raw)
In-Reply-To: <20210611133828.6c6e8b29.alex.williamson@redhat.com>
On Fri, Jun 11, 2021 at 01:38:28PM -0600, Alex Williamson wrote:
> That's fine for a serial port, but not a device that can do DMA.
> The entire point of vfio is to try to provide secure, DMA capable
> userspace drivers. If we relax enforcement of that isolation we've
> failed.
I don't understand why the IOASID matters at all in this. Can you
explain? What is the breach of isolation?
A userspace process can create many IOASIDs, it can create an IOASID
that can touch any memory the process can touch. It can create two
IOASID's that are identical copies of each other.
How does restricting a device from attaching to an IOASID create
security if I can just make a copy of that IOASID and attach to that?
Is there some quirk of the IOMMU I'm missing?
My understanding of isolation has been that two different security
contexts cannot have access to devices in the same group because that
can leak access across a security bounday, eg because device A can do
DMA to device B and take control of it.
Isolation means that the control of the devices in a group is not
inadventantly spread between two security contexts, like two
processes.
> I don't see how this provides isolation. If a user only needs to
> attach their devicefd to an ioasidfd to have full access to their
> device, not even bound by attaching to an ioasid context, then we've
> failed.
That is not quite what I tried to explain. The first ioasid any device
in the group attaches to becomes the only ioasid that any device in
the group attaches to. It is an ownership model unique to the
iommu_fd.
It directly prevents process A and process B from opening devices in
the same group and trying to operate them independently. A and B will
not posses the same iommu fd so only one of them can activate a
device. The other device remains unusable.
Iin this model, I consider the iommu_fd to be the security domain. The
meaning of isolation is that only devices explicitly joined to an
iommu_fd can access IOASIDs in that iommu_fd.
Userspace has choices how to use this
Placing all devices in the same iommu_fd userspace is telling the
kernel that they are in the same security domain. This means userspace
says is safe for them to all share IOASIDs without isolation.
If userspace wants tigher security domains then userspace can create
additional iommu_fds, up to a unique iommu_fd per group. This would
duplicate the security model that the vfio groups force today.
The kernel security feature is to prevent un-isolated devices from
being joined to different iommu_fd security contexts.
Jason
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
next prev parent reply other threads:[~2021-06-12 1:28 UTC|newest]
Thread overview: 162+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-07 2:58 Plan for /dev/ioasid RFC v2 Tian, Kevin
2021-06-07 2:58 ` Tian, Kevin
2021-06-09 8:14 ` Eric Auger
2021-06-09 8:14 ` Eric Auger
2021-06-09 9:37 ` Tian, Kevin
2021-06-09 9:37 ` Tian, Kevin
2021-06-09 10:14 ` Eric Auger
2021-06-09 10:14 ` Eric Auger
2021-06-09 9:01 ` Leon Romanovsky
2021-06-09 9:01 ` Leon Romanovsky
2021-06-09 9:43 ` Tian, Kevin
2021-06-09 9:43 ` Tian, Kevin
2021-06-09 12:24 ` Joerg Roedel
2021-06-09 12:24 ` Joerg Roedel
2021-06-09 12:39 ` Jason Gunthorpe
2021-06-09 12:39 ` Jason Gunthorpe
2021-06-09 13:32 ` Joerg Roedel
2021-06-09 13:32 ` Joerg Roedel
2021-06-09 15:00 ` Jason Gunthorpe
2021-06-09 15:00 ` Jason Gunthorpe
2021-06-09 15:51 ` Joerg Roedel
2021-06-09 15:51 ` Joerg Roedel
2021-06-09 16:15 ` Alex Williamson
2021-06-09 16:15 ` Alex Williamson
2021-06-09 16:27 ` Alex Williamson
2021-06-09 16:27 ` Alex Williamson
2021-06-09 18:49 ` Jason Gunthorpe
2021-06-09 18:49 ` Jason Gunthorpe
2021-06-10 15:38 ` Alex Williamson
2021-06-10 15:38 ` Alex Williamson
2021-06-11 0:58 ` Tian, Kevin
2021-06-11 0:58 ` Tian, Kevin
2021-06-11 21:38 ` Alex Williamson
2021-06-11 21:38 ` Alex Williamson
2021-06-14 3:09 ` Tian, Kevin
2021-06-14 3:09 ` Tian, Kevin
2021-06-14 3:22 ` Alex Williamson
2021-06-14 3:22 ` Alex Williamson
2021-06-15 1:05 ` Tian, Kevin
2021-06-15 1:05 ` Tian, Kevin
2021-06-14 13:38 ` Jason Gunthorpe
2021-06-14 13:38 ` Jason Gunthorpe
2021-06-15 1:21 ` Tian, Kevin
2021-06-15 1:21 ` Tian, Kevin
2021-06-15 16:56 ` Alex Williamson
2021-06-15 16:56 ` Alex Williamson
2021-06-16 6:53 ` Tian, Kevin
2021-06-16 6:53 ` Tian, Kevin
2021-06-24 4:50 ` David Gibson
2021-06-24 4:50 ` David Gibson
2021-06-11 16:45 ` Jason Gunthorpe
2021-06-11 16:45 ` Jason Gunthorpe
2021-06-11 19:38 ` Alex Williamson
2021-06-11 19:38 ` Alex Williamson
2021-06-12 1:28 ` Jason Gunthorpe [this message]
2021-06-12 1:28 ` Jason Gunthorpe
2021-06-12 16:57 ` Alex Williamson
2021-06-12 16:57 ` Alex Williamson
2021-06-14 14:07 ` Jason Gunthorpe
2021-06-14 14:07 ` Jason Gunthorpe
2021-06-14 16:28 ` Alex Williamson
2021-06-14 16:28 ` Alex Williamson
2021-06-14 19:40 ` Jason Gunthorpe
2021-06-14 19:40 ` Jason Gunthorpe
2021-06-15 2:31 ` Tian, Kevin
2021-06-15 2:31 ` Tian, Kevin
2021-06-15 16:12 ` Alex Williamson
2021-06-15 16:12 ` Alex Williamson
2021-06-16 6:43 ` Tian, Kevin
2021-06-16 6:43 ` Tian, Kevin
2021-06-16 19:39 ` Alex Williamson
2021-06-16 19:39 ` Alex Williamson
2021-06-17 3:39 ` Liu Yi L
2021-06-17 3:39 ` Liu Yi L
2021-06-17 7:31 ` Tian, Kevin
2021-06-17 7:31 ` Tian, Kevin
2021-06-17 21:14 ` Alex Williamson
2021-06-17 21:14 ` Alex Williamson
2021-06-18 0:19 ` Jason Gunthorpe
2021-06-18 0:19 ` Jason Gunthorpe
2021-06-18 16:57 ` Tian, Kevin
2021-06-18 16:57 ` Tian, Kevin
2021-06-18 18:23 ` Jason Gunthorpe
2021-06-18 18:23 ` Jason Gunthorpe
2021-06-25 10:27 ` Tian, Kevin
2021-06-25 10:27 ` Tian, Kevin
2021-06-25 14:36 ` Jason Gunthorpe
2021-06-25 14:36 ` Jason Gunthorpe
2021-06-28 1:09 ` Tian, Kevin
2021-06-28 1:09 ` Tian, Kevin
2021-06-28 22:31 ` Alex Williamson
2021-06-28 22:31 ` Alex Williamson
2021-06-28 22:48 ` Jason Gunthorpe
2021-06-28 22:48 ` Jason Gunthorpe
2021-06-28 23:09 ` Alex Williamson
2021-06-28 23:09 ` Alex Williamson
2021-06-28 23:13 ` Jason Gunthorpe
2021-06-28 23:13 ` Jason Gunthorpe
2021-06-29 0:26 ` Tian, Kevin
2021-06-29 0:26 ` Tian, Kevin
2021-06-29 0:28 ` Tian, Kevin
2021-06-29 0:28 ` Tian, Kevin
2021-06-29 0:43 ` Tian, Kevin
2021-06-29 0:43 ` Tian, Kevin
2021-06-28 2:03 ` Tian, Kevin
2021-06-28 2:03 ` Tian, Kevin
2021-06-28 14:41 ` Jason Gunthorpe
2021-06-28 14:41 ` Jason Gunthorpe
2021-06-28 6:45 ` Tian, Kevin
2021-06-28 6:45 ` Tian, Kevin
2021-06-28 16:26 ` Jason Gunthorpe
2021-06-28 16:26 ` Jason Gunthorpe
2021-06-24 4:26 ` David Gibson
2021-06-24 4:26 ` David Gibson
2021-06-24 5:59 ` Tian, Kevin
2021-06-24 5:59 ` Tian, Kevin
2021-06-24 12:22 ` Lu Baolu
2021-06-24 12:22 ` Lu Baolu
2021-06-24 4:23 ` David Gibson
2021-06-24 4:23 ` David Gibson
2021-06-18 0:52 ` Jason Gunthorpe
2021-06-18 0:52 ` Jason Gunthorpe
2021-06-18 13:47 ` Joerg Roedel
2021-06-18 13:47 ` Joerg Roedel
2021-06-18 15:15 ` Jason Gunthorpe
2021-06-18 15:15 ` Jason Gunthorpe
2021-06-18 15:37 ` Raj, Ashok
2021-06-18 15:37 ` Raj, Ashok
2021-06-18 15:51 ` Alex Williamson
2021-06-18 15:51 ` Alex Williamson
2021-06-24 4:29 ` David Gibson
2021-06-24 4:29 ` David Gibson
2021-06-24 11:56 ` Jason Gunthorpe
2021-06-24 11:56 ` Jason Gunthorpe
2021-06-18 0:10 ` Jason Gunthorpe
2021-06-18 0:10 ` Jason Gunthorpe
2021-06-17 5:29 ` David Gibson
2021-06-17 5:29 ` David Gibson
2021-06-17 5:02 ` David Gibson
2021-06-17 5:02 ` David Gibson
2021-06-17 23:04 ` Jason Gunthorpe
2021-06-17 23:04 ` Jason Gunthorpe
2021-06-24 4:37 ` David Gibson
2021-06-24 4:37 ` David Gibson
2021-06-24 11:57 ` Jason Gunthorpe
2021-06-24 11:57 ` Jason Gunthorpe
2021-06-10 5:50 ` Lu Baolu
2021-06-10 5:50 ` Lu Baolu
2021-06-17 5:22 ` David Gibson
2021-06-17 5:22 ` David Gibson
2021-06-18 5:21 ` Lu Baolu
2021-06-18 5:21 ` Lu Baolu
2021-06-24 4:03 ` David Gibson
2021-06-24 4:03 ` David Gibson
2021-06-24 13:42 ` Lu Baolu
2021-06-24 13:42 ` Lu Baolu
2021-06-17 4:45 ` David Gibson
2021-06-17 4:45 ` David Gibson
2021-06-17 23:10 ` Jason Gunthorpe
2021-06-17 23:10 ` Jason Gunthorpe
2021-06-24 4:07 ` David Gibson
2021-06-24 4:07 ` David Gibson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210612012846.GC1002214@nvidia.com \
--to=jgg@nvidia.com \
--cc=alex.williamson@redhat.com \
--cc=ashok.raj@intel.com \
--cc=baolu.lu@linux.intel.com \
--cc=corbet@lwn.net \
--cc=dave.jiang@intel.com \
--cc=david@gibson.dropbear.id.au \
--cc=dwmw2@infradead.org \
--cc=eric.auger@redhat.com \
--cc=hao.wu@intel.com \
--cc=iommu@lists.linux-foundation.org \
--cc=jacob.jun.pan@linux.intel.com \
--cc=jasowang@redhat.com \
--cc=jean-philippe@linaro.org \
--cc=joro@8bytes.org \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=kwankhede@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkml@metux.net \
--cc=lushenming@huawei.com \
--cc=parav@mellanox.com \
--cc=pbonzini@redhat.com \
--cc=robin.murphy@arm.com \
--cc=yi.l.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.