Tell that to every crypto downgrade attack ever.
That's exactly what this patch addresses.
I see two credible solutions:
1. Actually harden the virtio driver.
That's exactly what this patchkit, and the alternative approaches, like
Jason's, are doing.
2. Have a new virtio-modern driver and use it for modern use cases. Maybe
rename the old driver virtio-legacy or virtio-insecure. They can share code.
In most use cases the legacy driver is not insecure because there is no
memory protection anyways.
Yes maybe such a split would be a good idea for maintenance and maybe
performance reasons, but at least from the security perspective I don't
see any need for it.
Another snag you may hit: virtio’s heuristic for whether to use proper DMA ops
or to bypass them is a giant kludge. I’m very slightly optimistic that getting
the heuristic wrong will make the driver fail to operate but won’t allow the
host to take over the guest, but I’m not really convinced. And I wrote that
code! A virtio-modern mode probably should not have a heuristic, and the
various iommu-bypassing modes should be fixed to work at the bus level, not the
device level
TDX and SEV use the arch hook to enforce DMA API, so that part is also
solved.
-Andi
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
