microVM: refuse device buffers outside the e820 RAM ranges #554

Summary

The microVM memory layout requires that loader writes and DMA ranges fit wholly inside a RAM range and never cross the MMIO aperture or a reserved boot structure (section 2.3 of the architecture guide in doc/design/). The Linux direct loader meets this for its own writes. Device DMA does not: OpenVMM gives each microVM virtio device the whole guest memory, so a descriptor fails only when its buffer leaves guest RAM, for example in the MMIO aperture. A guest can point a device buffer at a range that the e820 map reserves inside RAM, such as the shared virtio interrupt-status page at 0x30000, which the devices themselves update, or the ISA hole.

The guest can already write those pages directly, so this does not weaken isolation between the guest and the host. The devices only enforce less than the layout states.

Intended behavior

Every buffer of a microVM virtio device lies wholly inside a RAM range of the e820 map. The device refuses a descriptor whose buffer crosses the MMIO aperture or a reserved range, such as the shared interrupt-status page, instead of reading or writing it.

Tasks

• Give the microVM virtio devices a guest-memory view, or a descriptor check in the virtio queue, that admits only the e820 RAM ranges, in OpenVMM in the nanvix/openvmm submodule, and promote the pin.
• Define how a device reports a refused buffer: an error completion where its protocol has one, or marking the device as needing reset.
• Add OpenVMM coverage for buffers in the interrupt-status page, in the ISA hole, and across the aperture.
• Note the enforcement in section 2.3 of the architecture guide.