io_uring passthrough blockers

[enterJazz]

Here is a short description of why we abandoned io_uring for cvm-io.

In short, io_uring is too insecure for passthrough ; most is explained in https://lore.kernel.org/all/[email protected]/T/

1. io_uring for Qemu VMs does not isolate VMs

• w/ current io_uring, VMs inherit all permissions of Qemu regarding reading / writing files. Hence, VMs would not be isolated
• [1] is a corresponding RFC to restrict the permissions of VMs using io_uring

2. no io_uring passthrough implementation currently exists

• although an existing prototype was pitched [2], no such prototype is publically available
• as mentioned in [1], the main developers first wish to resolve (1.) before continuing their prototype

3. notable: io_uring is still currently considered unsafe and buggy ( see [3] )

• its use would definitely decrease the security of CVMs TCB
• however, we expect io_uring to become safer in the future

[1] https://lore.kernel.org/all/[email protected]/T/
[2] https://static.sched.com/hosted_files/kvmforum2020/9c/KVMForum_2020_io_uring_passthrough_Stefano_Garzarella.pdf
[3] https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html

[enterJazz]

@qafy this may interest you