Re: PCI passthrough resource remapping

["Ryan C. Underwood" <nemesis@icequake.net>]

On Thu, Jan 14, 2010 at 09:09:32PM +0200, Avi Kivity wrote:
> 
> PCI cards can access system memory directly.  If you assign a card
> to a guest, the guest will program the card to transfer data to
> system memory using guest addresses; since guest addresses don't
> correspond to host addresses, memory corruption will ensue.

I see, so the only way to fix this would be either with a special guest
driver for the device that does not perform DMA, or if that is
impossible (due to no docs), to trap and rewrite any command writes to
the device's MMIO region that reference a DMA write target buffer.

Forgive my ignorance, but is it possible that the latter is already
possible with qemu-kvm (somewhat like hardware memory breakpoints in
Soft-ICE)?

If qemu-kvm can be made to break and log on PCI memory accesses, I would
then hack around the safety limitations, assuming that's all they are,
and analyze the PCI writes one by one to find the cases where a physical
address is passed to the card.

Then I would perform the IOMMU translation myself in software whenever a
physmem address shows up in the command stream.  (Somewhat like the
security validation of a 3D graphics card command stream in the DRM.)

> Not sure about your experience with DOSEMU; maybe these devices were
> not dma capable.

Well, more likely the MS-DOS drivers were simply not using PCI DMA
transfers, since there is very little point to add such complexity to
the driver in a non-multitasking OS.  Of course that makes perfect sense
now!

-- 
Ryan C. Underwood, <nemesis@icequake.net>