virtio-pmem: PMEM device spec
PATCH v5 1/1 virtio-pmem: PMEM device spec
Posting virtio specification for virtio pmem device. Virtio pmem is a paravirtualized device which allows the guest to bypass page cache. Virtio pmem kernel driver is merged in Upstream Kernel 5.3. Also, Qemu device is merged in Qemu 4.1.
---
Incorporated all the suggestions during the review. Request for merging the spec.
v3 -> v4
Text format changes in security implication section - Stefan Minor text/while space change - Cornelia
conformance.tex | 16 +++++- content.tex | 1 + virtio-pmem.tex | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 virtio-pmem.tex
conformance.tex +14 -2
@@ -31,7 +31,8 @@ \section{Conformance Targets}\label{sec:Conformance / Conformance Targets} \ref{sec:Conformance / Driver Conformance / Sound Driver Conformance}, \ref{sec:Conformance / Driver Conformance / Memory Driver Conformance}, \ref{sec:Conformance / Driver Conformance / I2C Adapter Driver Conformance} or -\ref{sec:Conformance / Driver Conformance / SCMI Driver Conformance}. +\ref{sec:Conformance / Driver Conformance / SCMI Driver Conformance}, +\ref{sec:Conformance / Driver Conformance / PMEM Driver Conformance}. \item Clause \ref{sec:Conformance / Legacy Interface: Transitional Device and Transitional Driver Conformance}. \end{itemize}
@@ -55,7 +56,8 @@ \section{Conformance Targets}\label{sec:Conformance / Conformance Targets} \ref{sec:Conformance / Device Conformance / Sound Device Conformance}, \ref{sec:Conformance / Device Conformance / Memory Device Conformance}, \ref{sec:Conformance / Device Conformance / I2C Adapter Device Conformance} or -\ref{sec:Conformance / Device Conformance / SCMI Device Conformance}. +\ref{sec:Conformance / Device Conformance / SCMI Device Conformance}, +\ref{sec:Conformance / Device Conformance / PMEM Driver Conformance}. \item Clause \ref{sec:Conformance / Legacy Interface: Transitional Device and Transitional Driver Conformance}. \end{itemize}
@@ -301,6 +303,16 @@ \section{Conformance Targets}\label{sec:Conformance / Conformance Targets} \item \ref{drivernormative:Device Types / SCMI Device / Device Operation / Setting Up eventq Buffers} \end{itemize} +\conformance{\subsection}{PMEM Driver Conformance}\label{sec:Conformance / Driver Conformance / PMEM Driver Conformance} + +A PMEM driver MUST conform to the following normative statements: + +\begin{itemize} +\item \ref{devicenormative:Device Types / PMEM Device / Device Initialization} +\item \ref{devicenormative:Device Types / PMEM Device / Device Operation / Virtqueue flush} +\item \ref{devicenormative:Device Types / PMEM Device / Device Operation / Virtqueue return} +\end{itemize} + \conformance{\section}{Device Conformance}\label{sec:Conformance / Device Conformance} A device MUST conform to the following normative statements:
content.tex +1 -0
@@ -6583,6 +6583,7 @@ \subsubsection{Legacy Interface: Framing Requirements}\label{sec:Device \input{virtio-mem.tex} \input{virtio-i2c.tex} \input{virtio-scmi.tex} +\input{virtio-pmem.tex} \chapter{Reserved Feature Bits}\label{sec:Reserved Feature Bits}
virtio-pmem.tex new file +128 -0
128 lines not on this page · raw message
Signature · 1 line
2.25.1
Quoted 21 lines · Pankaj Gupta
Posting virtio specification for virtio pmem device. Virtio pmem is a paravirtualized device which allows the guest to bypass page cache. Virtio pmem kernel driver is merged in Upstream Kernel 5.3. Also, Qemu device is merged in Qemu 4.1.
Signed-off-by Pankaj Gupta <[email protected]>---
Incorporated all the suggestions during the review. Request for merging the spec.
v3 -> v4
Text format changes in security implication section - Stefan Minor text/while space change - Corneliaconformance.tex | 16 +++++- content.tex | 1 + virtio-pmem.tex | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 virtio-pmem.tex
(...)
Quoted 6 lines
+\subsection{Possible security implications}\label{sec:Device Types / PMEM Device / Possible Security Implications}
virtio-pmem.tex new file +5
-0+ +There could be potential security implications depending on how +memory mapped backing device is used. By default device emulation +is done with SHARED memory mapping. There is a contract between driver +and device to access shared memory region for read or write operations.
virtio-pmem.tex line 106
Quoted 10 lines
virtio-pmem.tex new file +10
-0+ +If a malicious driver or device maps the same memory region, the attacker +can make use of known side channel attacks to predict the current state of data. +If both attacker and victim somehow execute same shared code after a flush +or evict operation, with difference in execution timing attacker could infer +another device's data. + +\subsection{Countermeasures}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures} + +\subsubsection{ With SHARED mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / SHARED}
Nit: drop the space after the opening bracket (also below.)
Quoted 4 lines
virtio-pmem.tex new file +4
-0+ +If a device's backing region is shared between multiple devices, this may act +as a metric for side channel attacks. As a counter measure every device +should have its own (not shared with another driver) SHARED backing memory.
virtio-pmem.tex line 120
Quoted 10 lines
virtio-pmem.tex new file +10
-0+ +\subsubsection{ With PRIVATE mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / PRIVATE} +There maybe be chances of side channels attack with PRIVATE +memory mapping similar to SHARED with read-only shared mappings. +PRIVATE is not used for virtio pmem making this usecase +irrelevant. + +\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload} +For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharing
Sorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
virtio-pmem.tex line 128
Quoted 8 lines
virtio-pmem.tex new file +8
-0+same backing region with SHARED mapping can be used as a valid configuration. + +\subsubsection{ Prevent cache eviction}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Cache eviction} +Don't allow device shared region eviction from driver filesystem trim or discard +like commands with virtio pmem. This rules out any possibility of evict-reload +cache side channel attacks if backing region is shared (SHARED) +between mutliple devices. Though if we use per device backing file with +shared mapping this countermeasure is not required.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Quoted 34 lines
Quoted 21 lines
Posting virtio specification for virtio pmem device. Virtio pmem is a paravirtualized device which allows the guest to bypass page cache. Virtio pmem kernel driver is merged in Upstream Kernel 5.3. Also, Qemu device is merged in Qemu 4.1.
Signed-off-by Pankaj Gupta <[email protected]>---
Incorporated all the suggestions during the review. Request for merging the spec.
v3 -> v4
Text format changes in security implication section - Stefan Minor text/while space change - Corneliaconformance.tex | 16 +++++- content.tex | 1 + virtio-pmem.tex | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 virtio-pmem.tex(...)
Quoted 10 lines
+\subsection{Possible security implications}\label{sec:Device Types / PMEM Device / Possible Security Implications}
virtio-pmem.tex new file +9
-0+ +There could be potential security implications depending on how +memory mapped backing device is used. By default device emulation +is done with SHARED memory mapping. There is a contract between driver +and device to access shared memory region for read or write operations. + +If a malicious driver or device maps the same memory region, the attacker +can make use of known side channel attacks to predict the current state of data. +If both attacker and victim somehow execute same shared code after a flush
Quoted 8 lines
virtio-pmem.tex line 106
Quoted 6 lines
virtio-pmem.tex new file +6
-0+or evict operation, with difference in execution timing attacker could infer +another device's data. + +\subsection{Countermeasures}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures} + +\subsubsection{ With SHARED mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / SHARED}Nit: drop the space after the opening bracket (also below.)
o.k
Quoted 11 lines
Quoted 11 lines
virtio-pmem.tex new file +10
-0+ +If a device's backing region is shared between multiple devices, this may act +as a metric for side channel attacks. As a counter measure every device +should have its own (not shared with another driver) SHARED backing memory. + +\subsubsection{ With PRIVATE mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / PRIVATE} +There maybe be chances of side channels attack with PRIVATE +memory mapping similar to SHARED with read-only shared mappings. +PRIVATE is not used for virtio pmem making this usecase +irrelevant.
Quoted 8 lines
virtio-pmem.tex line 120
Quoted 4 lines
virtio-pmem.tex new file +4
-0+ +\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload} +For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
yes and if risk in sharing data is very less or acceptable.
Quoted 10 lines
Quoted 9 lines
virtio-pmem.tex new file +8
-0+same backing region with SHARED mapping can be used as a valid configuration. + +\subsubsection{ Prevent cache eviction}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Cache eviction} +Don't allow device shared region eviction from driver filesystem trim or discard +like commands with virtio pmem. This rules out any possibility of evict-reload +cache side channel attacks if backing region is shared (SHARED) +between mutliple devices. Though if we use per device backing file with +shared mapping this countermeasure is not required.
Quoted 34 lines
Quoted 21 lines
Posting virtio specification for virtio pmem device. Virtio pmem is a paravirtualized device which allows the guest to bypass page cache. Virtio pmem kernel driver is merged in Upstream Kernel 5.3. Also, Qemu device is merged in Qemu 4.1.
Signed-off-by Pankaj Gupta <[email protected]>---
Incorporated all the suggestions during the review. Request for merging the spec.
v3 -> v4
Text format changes in security implication section - Stefan Minor text/while space change - Corneliaconformance.tex | 16 +++++- content.tex | 1 + virtio-pmem.tex | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 virtio-pmem.tex(...)
Quoted 10 lines
+\subsection{Possible security implications}\label{sec:Device Types / PMEM Device / Possible Security Implications}
virtio-pmem.tex new file +9
-0+ +There could be potential security implications depending on how +memory mapped backing device is used. By default device emulation +is done with SHARED memory mapping. There is a contract between driver +and device to access shared memory region for read or write operations. + +If a malicious driver or device maps the same memory region, the attacker +can make use of known side channel attacks to predict the current state of data. +If both attacker and victim somehow execute same shared code after a flush
Quoted 8 lines
virtio-pmem.tex line 106
Quoted 6 lines
virtio-pmem.tex new file +6
-0+or evict operation, with difference in execution timing attacker could infer +another device's data. + +\subsection{Countermeasures}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures} + +\subsubsection{ With SHARED mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / SHARED}Nit: drop the space after the opening bracket (also below.)
o.k. Sure
Quoted 33 lines
Quoted 5 lines
virtio-pmem.tex new file +4
-0+ +If a device's backing region is shared between multiple devices, this may act +as a metric for side channel attacks. As a counter measure every device +should have its own (not shared with another driver) SHARED backing memory.virtio-pmem.tex line 120
Quoted 10 lines
virtio-pmem.tex new file +10
-0+ +\subsubsection{ With PRIVATE mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / PRIVATE} +There maybe be chances of side channels attack with PRIVATE +memory mapping similar to SHARED with read-only shared mappings. +PRIVATE is not used for virtio pmem making this usecase +irrelevant. + +\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload} +For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
Quoted 10 lines
virtio-pmem.tex new file +10
-0+ +If a device's backing region is shared between multiple devices, this may act +as a metric for side channel attacks. As a counter measure every device +should have its own (not shared with another driver) SHARED backing memory. + +\subsubsection{ With PRIVATE mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / PRIVATE} +There maybe be chances of side channels attack with PRIVATE +memory mapping similar to SHARED with read-only shared mappings. +PRIVATE is not used for virtio pmem making this usecase +irrelevant.
Quoted 8 lines
virtio-pmem.tex line 120
Quoted 4 lines
virtio-pmem.tex new file +4
-0+ +\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload} +For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
yes and if risk in sharing data is very less or acceptable.
Quoted 10 lines
Quoted 9 lines
virtio-pmem.tex new file +8
-0+same backing region with SHARED mapping can be used as a valid configuration. + +\subsubsection{ Prevent cache eviction}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Cache eviction} +Don't allow device shared region eviction from driver filesystem trim or discard +like commands with virtio pmem. This rules out any possibility of evict-reload +cache side channel attacks if backing region is shared (SHARED) +between mutliple devices. Though if we use per device backing file with +shared mapping this countermeasure is not required.
Quoted 8 lines · Pankaj Gupta
Quoted 7 lines
virtio-pmem.tex line 120
Quoted 3 lines
+\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload}
virtio-pmem.tex new file +2
-0+For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
Quoted 4 lines
yes and if risk in sharing data is very less or acceptable.
Quoted 2 lines
Quoted 2 lines
+same backing region with SHARED mapping can be used as a valid configuration.
Hm... maybe rephrase this paragraph as:
"When using SHARED mappings with a workload that is a single application inside the driver where the risk in sharing data is very low or nonexisting, the device sharing the same backing region with a SHARED mapping can be used as a valid configuration."
(I hope I caught the intention correctly!)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Quoted 11 lines
Quoted 11 lines
Quoted 7 lines
virtio-pmem.tex line 120
Quoted 3 lines
+\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload}
virtio-pmem.tex new file +2
-0+For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
yes and if risk in sharing data is very less or acceptable.
Quoted 1 line
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
+same backing region with SHARED mapping can be used as a valid configuration.
Hm... maybe rephrase this paragraph as:
"When using SHARED mappings with a workload that is a single application inside the driver where the risk in sharing data is very low or nonexisting, the device sharing the same backing region with a SHARED mapping can be used as a valid configuration."
Thank you Cornelia!
I tried to reread my initial statement and I think that also precisely conveys the use-case.
If you are okay, I will respin v6 with only space with bracket change and Stefan r-o-b?
Quoted 2 lines
(I hope I caught the intention correctly!)
Yes, you did.
Best regards,
Pankaj
Quoted 1 line
Quoted 20 lines · Pankaj Gupta
Quoted 11 lines
Quoted 11 lines
Quoted 7 lines
virtio-pmem.tex line 120
Quoted 3 lines
+\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload}
virtio-pmem.tex new file +2
-0+For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
yes and if risk in sharing data is very less or acceptable.
Quoted 1 line
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
+same backing region with SHARED mapping can be used as a valid configuration.
Hm... maybe rephrase this paragraph as:
"When using SHARED mappings with a workload that is a single application inside the driver where the risk in sharing data is very low or nonexisting, the device sharing the same backing region with a SHARED mapping can be used as a valid configuration."
Quoted 6 lines
Thank you Cornelia!
I tried to reread my initial statement and I think that also precisely conveys the use-case.If you are okay, I will respin v6 with only space with bracket change and Stefan r-o-b?
And my proposed change? If nobody else has a comment, I think we could start voting on that.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Quoted 24 lines
Quoted 24 lines
Quoted 11 lines
Quoted 11 lines
Quoted 7 lines
virtio-pmem.tex line 120
Quoted 3 lines
+\subsubsection{ Workload specific mapping}\label{sec:Device Types / PMEM Device / Possible Security Implications / Countermeasures / Workload}
virtio-pmem.tex new file +2
-0+For SHARED mappings, for the workload is a single application inside +the driver and there is no risk in sharing data. Device sharingSorry for noticing this only now, but I have trouble parsing this sentence. Does it mean that you can use SHARED mapping if the workload is a single application?
yes and if risk in sharing data is very less or acceptable.
Quoted 1 line
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
+same backing region with SHARED mapping can be used as a valid configuration.
Hm... maybe rephrase this paragraph as:
"When using SHARED mappings with a workload that is a single application inside the driver where the risk in sharing data is very low or nonexisting, the device sharing the same backing region with a SHARED mapping can be used as a valid configuration."
Thank you Cornelia!
I tried to reread my initial statement and I think that also precisely conveys the use-case.
Quoted 5 lines
Quoted 2 lines
If you are okay, I will respin v6 with only space with bracket change and Stefan r-o-b?
And my proposed change? If nobody else has a comment, I think we could start voting on that.
Sure.
Thanks,
Pankaj
Quoted 1 line
Quoted 15 lines · Pankaj Gupta
Posting virtio specification for virtio pmem device. Virtio pmem is a paravirtualized device which allows the guest to bypass page cache. Virtio pmem kernel driver is merged in Upstream Kernel 5.3. Also, Qemu device is merged in Qemu 4.1.
Signed-off-by Pankaj Gupta <[email protected]>---
Incorporated all the suggestions during the review. Request for merging the spec.
v3 -> v4
Text format changes in security implication section - Stefan Minor text/while space change - Cornelia
Quoted 5 lines
conformance.tex | 16 +++++- content.tex | 1 + virtio-pmem.tex | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 virtio-pmem.tex