diff options
Diffstat (limited to 'virtio-fs.tex')
| -rw-r--r-- | virtio-fs.tex | 66 |
1 files changed, 66 insertions, 0 deletions
diff --git a/virtio-fs.tex b/virtio-fs.tex index 1ae17f8..158d066 100644 --- a/virtio-fs.tex +++ b/virtio-fs.tex @@ -179,6 +179,62 @@ The driver MUST not submit normal requests on the hiprio queue. The driver MUST anticipate that request queues are processed concurrently with the hiprio queue. +\subsubsection{Device Operation: DAX Window}\label{sec:Device Types / File System Device / Device Operation / Device Operation: DAX Window} + +FUSE\_READ and FUSE\_WRITE requests transfer file contents between the +driver-provided buffer and the device. In cases where data transfer is +undesirable, the device can map file contents into the DAX window shared memory +region. The driver then accesses file contents directly in device-owned memory +without a data transfer. + +The DAX Window is an alternative mechanism for accessing file contents. +FUSE\_READ/FUSE\_WRITE requests and DAX Window accesses are possible at the +same time. Providing the DAX Window is optional for devices. Using the DAX +Window is optional for drivers. + +Shared memory region ID 0 is called the DAX window. Drivers map this shared +memory region with writeback caching as if it were regular RAM. The contents +of the DAX window are undefined unless a mapping exists for that range. + +The driver maps a file range into the DAX window using the FUSE\_SETUPMAPPING +request. Alignment constraints for FUSE\_SETUPMAPPING and FUSE\_REMOVEMAPPING +requests are communicated during FUSE\_INIT negotiation. + +When a FUSE\_SETUPMAPPING request perfectly overlaps a previous mapping, the +previous mapping is replaced. When a mapping partially overlaps a previous +mapping, the previous mapping is split into one or two smaller mappings. When +a mapping is partially unmapped it is also split into one or two smaller +mappings. + +Establishing new mappings or splitting existing mappings consumes resources. +If the device runs out of resources the FUSE\_SETUPMAPPING request fails until +resources are available again following FUSE\_REMOVEMAPPING. + +After FUSE\_SETUPMAPPING has completed successfully the file range is +accessible from the DAX window at the offset provided by the driver in the +request. A mapping is removed using the FUSE\_REMOVEMAPPING request. + +Data is only guaranteed to be persistent when a FUSE\_FSYNC request is used by +the device after having been made available by the driver following the write. + +\devicenormative{\paragraph}{Device Operation: DAX Window}{Device Types / File System Device / Device Operation / Device Operation: DAX Window} + +The device MAY provide the DAX Window to memory-mapped access to file contents. If present, the DAX Window MUST be shared memory region ID 0. + +The device MUST support FUSE\_READ and FUSE\_WRITE requests regardless of whether the DAX Window is being used or not. + +The device MUST allow mappings that completely or partially overlap existing mappings within the DAX window. + +The device MUST reject mappings that would go beyond the end of the DAX window. + +\drivernormative{\paragraph}{Device Operation: DAX Window}{Device Types / File System Device / Device Operation / Device Operation: DAX Window} + +The driver SHOULD be prepared to find shared memory region ID 0 absent and fall back to FUSE\_READ and FUSE\_WRITE requests. + +The driver MAY use both FUSE\_READ/FUSE\_WRITE requests and the DAX Window to access file contents. + +The driver MUST NOT access DAX window areas that have not been mapped. + \subsubsection{Security Considerations}\label{sec:Device Types / File System Device / Security Considerations} The device provides access to a file system containing files owned by one or @@ -207,6 +263,16 @@ issues have a long history in multi-user operating systems and also apply to virtio-fs. They are typically managed at the file system administration level by providing shared access only to mutually trusted users. +Multiple machines sharing access to a file system are susceptible to timing +side-channel attacks. By measuring the latency of accesses to file contents or +file system metadata it is possible to infer whether other machines also +accessed the same information. Short latencies indicate that the information +was cached due to a previous access. This can reveal sensitive information, +such as whether certain code paths were taken. The DAX Window provides direct +access to file contents and is therefore a likely target of such attacks. +These attacks are also possible with traditional FUSE requests. The safest +approach is to avoid sharing file systems between untrusted machines. + \subsubsection{Live migration considerations}\label{sec:Device Types / File System Device / Live Migration Considerations} When a driver is migrated to a new device it is necessary to consider the FUSE |