linux-kernel - Re: [RFC PATCH 05/13] iommufd: Serialise persisted iommufds and ioas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e458d48a797043b7efc853fc65b9c4d043b12ed4.camel@infradead.org>
Date: Mon, 07 Oct 2024 09:47:53 +0100
From: David Woodhouse <dwmw2@...radead.org>
To: "Gowans, James" <jgowans@...zon.com>, "jgg@...pe.ca" <jgg@...pe.ca>
Cc: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "rppt@...nel.org"
 <rppt@...nel.org>, "kw@...ux.com" <kw@...ux.com>, "iommu@...ts.linux.dev"
 <iommu@...ts.linux.dev>, "madvenka@...ux.microsoft.com"
 <madvenka@...ux.microsoft.com>, "anthony.yznaga@...cle.com"
 <anthony.yznaga@...cle.com>, "robin.murphy@....com" <robin.murphy@....com>,
  "baolu.lu@...ux.intel.com" <baolu.lu@...ux.intel.com>,
 "nh-open-source@...zon.com" <nh-open-source@...zon.com>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "seanjc@...gle.com" <seanjc@...gle.com>,  "Saenz Julienne, Nicolas"
 <nsaenz@...zon.es>, "pbonzini@...hat.com" <pbonzini@...hat.com>, 
 "kevin.tian@...el.com" <kevin.tian@...el.com>, "steven.sistare@...cle.com"
 <steven.sistare@...cle.com>,  "Graf (AWS), Alexander" <graf@...zon.de>,
 "will@...nel.org" <will@...nel.org>, "joro@...tes.org" <joro@...tes.org>
Subject: Re: [RFC PATCH 05/13] iommufd: Serialise persisted iommufds and ioas

On Mon, 2024-10-07 at 08:39 +0000, Gowans, James wrote:
> 
> I think we have two other possible approaches here:
> 
> 1. What this RFC is sketching out, serialising fields from the structs
> and setting those fields again on deserialise. As you point out this
> will be complicated.
> 
> 2. Get userspace to do the work: userspace needs to re-do the ioctls
> after kexec to reconstruct the objects. My main issue with this approach
> is that the kernel needs to do some sort of trust but verify approach to
> ensure that userspace constructs everything the same way after kexec as
> it was before kexec. We don't want to end up in a state where the
> iommufd objects don't match the persisted page tables.

To what extent does the kernel really need to trust or verify? At LPC
we seemed to speak of a model where userspace builds a "new" address
space for each device and then atomically switches to the new page
tables instead of the original ones inherited from the previous kernel.

That does involve having space for another set of page tables, of
course, but that's not impossible.

> 3. Serialise and reply the ioctls. Ioctl APIs and payloads should
> (must?) be stable across kernel versions. If IOMMUFD records the ioctls
> executed by userspace then it could replay them as part of deserialise
> and give userspace a handle to the resulting objects after kexec. This
> way we are guaranteed consistent iommufd / IOAS objects. By "consistent"
> I mean they are the same as before kexec and match the persisted page
> tables. By having the kernel do this it means it doesn't need to depend
> on userspace doing the correct thing.
> 
> What do you think of this 3rd approach? I can try to sketch it out and
> send another RFC if you think it sounds reasonable.


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5965 bytes)