On Thu, Jun 3, 2021, at 11:00 AM, Andi Kleen wrote:
On 6/3/2021 10:33 AM, Andy Lutomirski wrote:Tell that to every crypto downgrade attack ever.
On 6/2/21 5:41 PM, Andi Kleen wrote:My understanding is most of the other modes (except for split with
Only allow split mode when in a protected guest. FollowonI read this as "the virtio driver is buggy. Let's disable most of the
patches harden the split mode code paths, and we don't want
an malicious host to force anything else. Also disallow
indirect mode for similar reasons.
buggy code in one special case in which we need a driver without bugs.
In all the other cases (e.g. hardware virtio device connected over
USB-C), driver bugs are still allowed."
separate descriptors) are obsolete and just there for compatibility. As
long as they're deprecated they won't harm anyone.
I see two credible solutions:
1. Actually harden the virtio driver.
2. Have a new virtio-modern driver and use it for modern use cases. Maybe rename the old driver virtio-legacy or virtio-insecure. They can share code.
Another snag you may hit: virtio’s heuristic for whether to use proper DMA ops or to bypass them is a giant kludge. I’m very slightly optimistic that getting the heuristic wrong will make the driver fail to operate but won’t allow the host to take over the guest, but I’m not really convinced. And I wrote that code! A virtio-modern mode probably should not have a heuristic, and the various iommu-bypassing modes should be fixed to work at the bus level, not the device level.