On 2017-01-30 13:19, Markus Armbruster wrote: >>> Can you explain why not letting the guest map the shared memory into its >>> address space on its own just like any other piece of device memory is a >>> requirement? >> >> It requires reconfiguration of the sensitive 2nd level page tables >> during runtime of the guest. We are avoiding the neccessery checking and >> synchronization measures so far which reduces code complexity further. > > You mean the hypervisor needs to act when the guest maps BARs, and that > gives the guest an attack vector?
Possibly, at least correctness issue will arise. We need to add TLB flushes e.g., something that is not needed right now with the mappings remaining static while a guest is running. > > Don't you have to deal with that anyway, for other PCI devices? Physical devices are presented to the guest with their BARs programmed (as if the firmware did that already), and Jailhouse denies reprogramming (only for the purpose of size discovery). Linux is fine with that, and RTOSes ported to Jailhouse only become simpler. Virtualized regions are trapped-and-emulate anyway, so no need for reprogramming the mappings Jan
