linux-kernel - Re: [PATCH 15/52] fuse: map virtio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Dec 2018 20:09:36 +0000
From:   "Dr. David Alan Gilbert" <dgilbert@...hat.com>
To:     Dan Williams <dan.j.williams@...el.com>
Cc:     vgoyal@...hat.com, linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        KVM list <kvm@...r.kernel.org>,
        Miklos Szeredi <miklos@...redi.hu>, stefanha@...hat.com,
        sweil@...hat.com, swhiteho@...hat.com
Subject: Re: [PATCH 15/52] fuse: map virtio_fs DAX window BAR

* Dan Williams (dan.j.williams@...el.com) wrote:
> On Mon, Dec 10, 2018 at 9:22 AM Vivek Goyal <vgoyal@...hat.com> wrote:
> >
> > From: Stefan Hajnoczi <stefanha@...hat.com>
> >
> > Experimental QEMU code introduces an MMIO BAR for mapping portions of
> > files in the virtio-fs device.  Map this BAR so that FUSE DAX can access
> > file contents from the host page cache.
> 
> FUSE DAX sounds terrifying, can you explain a bit more about what this is?

We've got a guest running in QEMU, it sees an emulated PCI device;
that runs a FUSE protocol over virtio on that PCI device, but also has
a trick where via commands sent over the virtio queue associated with that device,
(fragments of) host files get mmap'd into the qemu virtual memory that corresponds
to the kvm slot exposed to the guest for that bar.

The guest sees those chunks in that BAR, and thus you can read/write
to the host file by directly writing into that BAR.

> > The DAX window is accessed by the fs/dax.c infrastructure and must have
> > struct pages (at least on x86).  Use devm_memremap_pages() to map the
> > DAX window PCI BAR and allocate struct page.
> 
> PCI BAR space is not cache coherent,

Note that no real PCI infrastructure is involved - this is all emulated
devices, backed by mmap'd files on the host qemu process.

Dave

> what prevents these pages from
> being used in paths that would do:
> 
>    object = page_address(pfn_to_page(virtio_fs_pfn));
> 
> ...?
--
Dr. David Alan Gilbert / dgilbert@...hat.com / Manchester, UK