Re: [XEN-IOMMU] Proposal of DMA protection/isolation support

["Wei Wang2" <wei.wang2@amd.com>]

Keir, 
After looking into the grant mapping code (use block device as an
example), I got some ideas to share with you and the list.  Please
correct me if I missed something. There might be 2 places to trigger
iommu mapping:

1) Before submitting io request to generic block layer, block backend
driver will invoke GNTTABOPs to map granted remote pages .  However
creating iommu mapping only in GNTTABOP not very enough because local
pages will also be submitted to block layer and they should also be
translated by iommu. 

2) When dma layer is invoked to prepare a bus address for native block
device driver. It would be better to have a "hypervisor-aware" dma layer
which always maps virtual address to bus address via hypercall.
__gnttab_dma_map_page() might be a good place to trigger this new
hypercall. Both remote and local pages can be mapped by this way.

-Wei
 
On Thu, 2008-01-10 at 17:58 +0100, Keir Fraser wrote:
> Grant mappings will only be triggered for I/O to/from foreign domains.
> I'm
> not really convinced that protecting a driver domain's own memory
> against
> errant DMAs is that important anyway. Firstly, there are many other
> ways
> that a buggy driver can screw its domain, other than errant DMA.
> Secondly,
> any driver that haflway works will request a DMA mapping from the OS
> before
> it initiates any DMA (otherwise the driver would *never* work) and
> that
> would probably be the point at which the OS would set up the iommu
> mapping.
> That's the problem -- the OS will be trusting the driver to tell it
> when a
> mapping should be set up, and that request will usually be co-located
> in the
> driver code with the actual DMA initiation. So if the driver is
> issuing
> errant DMAs, the OS is rather likely to let them happen!
> 
>  -- Keir
> 
> 
> On 10/1/08 16:52, "Wei Wang2" <wei.wang2@amd.com> wrote:
> 
> > On Thu, 2008-01-10 at 15:54 +0000, Keir Fraser wrote:
> >> Grant table mappings/unmappings are an obvious place where we
> already trap
> >> to the hypervisor and could make correspodning changes to iommu
> mappings?
> > Can grant mapping cover the situation in which a device only be
> accessed
> > by a driver domain other than be shared with any remote domain? In
> other
> > word, when a device is only access by a driver domain, does grant
> table
> > mapping still happen? If yes, it is the best way to go.
> >
> >> It depends if we want the iommu to do any more than prevent
> arbitrary DMA
> >> access to foreign pages. What's the threat model you are wanting to
> use the
> >> iommu to protect against?
> > I think IOMMU can help to prevent buggy driver from destroying
> memory content
> > of both
> > driver domain itself and foreign domain. Proper IO address which is
> > requested by device driver should only be provided by some
> pre-defined
> > interfaces/hypercalls.  Arbitrary dma addresses written to a device
> by a
> > buggy driver will not trigger address translations.
> 
> 
> 
> 
> 
>