linux-ext4 - Re: [Qemu-devel] [PATCH v3 0/5] kvm "virtio pmem" device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <540171952.63371441.1547345866585.JavaMail.zimbra@redhat.com>
Date:   Sat, 12 Jan 2019 21:17:46 -0500 (EST)
From:   Pankaj Gupta <pagupta@...hat.com>
To:     Dan Williams <dan.j.williams@...el.com>
Cc:     Jan Kara <jack@...e.cz>, KVM list <kvm@...r.kernel.org>,
        David Hildenbrand <david@...hat.com>,
        linux-nvdimm <linux-nvdimm@...1.01.org>,
        Jason Wang <jasowang@...hat.com>,
        Dave Chinner <david@...morbit.com>,
        Qemu Developers <qemu-devel@...gnu.org>,
        virtualization@...ts.linux-foundation.org,
        adilger kernel <adilger.kernel@...ger.ca>,
        Ross Zwisler <zwisler@...nel.org>,
        dave jiang <dave.jiang@...el.com>,
        darrick wong <darrick.wong@...cle.com>,
        vishal l verma <vishal.l.verma@...el.com>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        Matthew Wilcox <willy@...radead.org>,
        Christoph Hellwig <hch@...radead.org>,
        Linux ACPI <linux-acpi@...r.kernel.org>,
        jmoyer <jmoyer@...hat.com>,
        linux-ext4 <linux-ext4@...r.kernel.org>,
        Rik van Riel <riel@...riel.com>,
        Stefan Hajnoczi <stefanha@...hat.com>,
        Igor Mammedov <imammedo@...hat.com>, lcapitulino@...hat.com,
        Kevin Wolf <kwolf@...hat.com>,
        Nitesh Narayan Lal <nilal@...hat.com>,
        Theodore Ts'o <tytso@....edu>,
        xiaoguangrong eric <xiaoguangrong.eric@...il.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-xfs <linux-xfs@...r.kernel.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [Qemu-devel] [PATCH v3 0/5] kvm "virtio pmem" device


> >
> >
> >
> > >
> > > On Thu 10-01-19 12:26:17, Dave Chinner wrote:
> > > > On Wed, Jan 09, 2019 at 08:17:31PM +0530, Pankaj Gupta wrote:
> > > > >  This patch series has implementation for "virtio pmem".
> > > > >  "virtio pmem" is fake persistent memory(nvdimm) in guest
> > > > >  which allows to bypass the guest page cache. This also
> > > > >  implements a VIRTIO based asynchronous flush mechanism.
> > > >
> > > > Hmmmm. Sharing the host page cache direct into the guest VM. Sounds
> > > > like a good idea, but.....
> > > >
> > > > This means the guest VM can now run timing attacks to observe host
> > > > side page cache residency, and depending on the implementation I'm
> > > > guessing that the guest will be able to control host side page
> > > > cache eviction, too (e.g. via discard or hole punch operations).
> > > >
> > > > Which means this functionality looks to me like a new vector for
> > > > information leakage into and out of the guest VM via guest
> > > > controlled host page cache manipulation.
> > > >
> > > > https://arxiv.org/pdf/1901.01161
> > > >
> > > > I might be wrong, but if I'm not we're going to have to be very
> > > > careful about how guest VMs can access and manipulate host side
> > > > resources like the page cache.....
> > >
> > > Right. Thinking about this I would be more concerned about the fact that
> > > guest can effectively pin amount of host's page cache upto size of the
> > > device/file passed to guest as PMEM, can't it Pankaj? Or is there some
> > > QEMU
> > > magic that avoids this?
> >
> > Yes, guest will pin these host page cache pages using 'get_user_pages' by
> > elevating the page reference count. But these pages can be reclaimed by
> > host
> > at any time when there is memory pressure.
> 
> Wait, how can the guest pin the host pages? I would expect this to
> happen only when using vfio and device assignment. Otherwise, no the
> host can't reclaim a pinned page, that's the whole point of a pin to
> prevent the mm from reclaiming ownership.

yes. You are right I just used the pin word but it does not actually pin pages 
permanently. I had gone through the discussion on existing problems with 
get_user_pages and DMA e.g [1] to understand Jan's POV. It does mention GUP 
pin pages so I also used the word 'pin'. But guest does not permanently pin 
these pages and these pages can be reclaimed by host.

> 
> > KVM does not permanently pin pages. vfio does that but we are not using
> > it here.
> 
> Right, so I'm confused by your pin assertion above.

Sorry! for the confusion. 

[1] https://lwn.net/Articles/753027/

Thanks,
Pankaj