[Rust-VMM] Requirements for out-of-process device emulation

[Alex Bennée]

Stefan Hajnoczi <stefanha at redhat.com> writes:

> I just posted the following on my blog to outline the requirements that
> have been discussed over the past few months around out-of-process
> device emulation (vhost-user, vfio-user, etc). I hope it's helpful for
> covering various angles of out-of-process device emulation.
>
> It's long, so no worries if you don't want to join the discussion.
>

Nice post.

> Security
> --------
> The trust model
> ```````````````
> The VMM must not trust the device emulation program. This is key to
> implementing privilege separation and the principle of least privilege.
> If a compromised device emulation program is able to gain control of the
> VMM then out-of-process device emulation has failed to provide isolation
> between devices.
>
> The device emulation program must not trust the VMM to the extent that
> this is possible. For example, it must validate inputs so that the VMM
> cannot gain control of the device emulation process through memory
> corruptions or other bugs. This makes it so that even if the VMM has
> been compromised, access to device resources and associated system calls
> still requires further compromising the device emulation process.

However in this model the guest intrinsically trusts device emulation
because it currently has full access to the guest's address space. It
would probably be worth making that explicit.

There are security models where the guest doesn't need to trust the VMM
or particular device emulations.


> Conclusion
> ----------
> This was largely a brain dump but I hope it is useful food for thought
> as out-of-process device emulation interfaces are designed and
> developed. There is a lot more to it than simply implementing a protocol
> for device register accesses and guest RAM DMA. Developing open source
> libraries in Rust and C that can be used as needed will ensure that
> out-of-process devices are high-quality and easy for users to deploy.

A useful exercise ;-)

-- 
Alex Bennée