From: Jan Beulich <jbeulich@suse.com>
To: "Tian, Kevin" <kevin.tian@intel.com>
Cc: "xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>,
Paul Durrant <paul@xen.org>,
Andrew Cooper <andrew.cooper3@citrix.com>
Subject: Re: [Xen-devel] [PATCH v3] IOMMU: make DMA containment of quarantined devices optional
Date: Tue, 10 Mar 2020 11:31:18 +0100 [thread overview]
Message-ID: <12464780-0ce3-0331-9f78-b026025607fb@suse.com> (raw)
In-Reply-To: <AADFC41AFE54684AB9EE6CBC0274A5D19D7C5DEC@SHSMSX104.ccr.corp.intel.com>
On 10.03.2020 06:30, Tian, Kevin wrote:
>> From: Jan Beulich <jbeulich@suse.com>
>> Sent: Monday, March 9, 2020 7:09 PM
>>
>> Containing still in flight DMA was introduced to work around certain
>> devices / systems hanging hard upon hitting a "not-present" IOMMU fault.
>> Passing through (such) devices (on such systems) is inherently insecure
>> (as guests could easily arrange for IOMMU faults of any kind to occur).
>> Defaulting to a mode where admins may not even become aware of issues
>> with devices can be considered undesirable. Therefore convert this mode
>> of operation to an optional one, not one enabled by default.
>
> Here is another thought. The whole point of quarantine is to contain
> the device after it is deassigned from untrusted guest.
I'd question the "untrusted" here. Assigning devices to untrusted
guests is problematic anyway, unless you're the device manufacturer
and device firmware writer, and hence you can guarantee the device
to not offer any backdoors or alike. Therefore I view quarantining
more as a protection of the host against bad device behavior, and
less against malicious guest behavior (while the driver in the
guest surely has some influence, consider the guest getting crashed
and even a well-behaved driver hence not getting any chance to
silence the device).
Jan
> However, the
> passthrough of such device is already insecure, as you mentioned.
> Then why do we care about making deassignment of such device
> secure without doing anything to secure it when it is assigned and being
> used by untrusted guest? I feel that one should simply put such device
> out of the quarantine list in the first place, i.e. set quarantine=false and
> then use tool to quarantine a whitelist of devices by skipping the bad one.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2020-03-10 10:31 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-09 11:09 [Xen-devel] [PATCH v3] IOMMU: make DMA containment of quarantined devices optional Jan Beulich
2020-03-10 3:43 ` Tian, Kevin
2020-03-10 10:26 ` Jan Beulich
2020-03-10 12:30 ` Paul Durrant
2020-03-10 15:04 ` Jan Beulich
2020-03-10 15:13 ` Paul Durrant
2020-03-10 15:44 ` Jan Beulich
2020-03-10 16:05 ` Paul Durrant
2020-03-10 16:46 ` Jan Beulich
2020-03-13 3:22 ` Tian, Kevin
2020-03-13 9:26 ` Paul Durrant
2020-03-17 6:10 ` Tian, Kevin
2020-03-13 2:28 ` Tian, Kevin
2020-03-10 5:30 ` Tian, Kevin
2020-03-10 10:31 ` Jan Beulich [this message]
2020-03-13 3:05 ` Tian, Kevin
2020-03-13 8:10 ` Jan Beulich
2020-03-13 9:26 ` Paul Durrant
2020-03-17 6:20 ` Tian, Kevin
2020-03-10 8:58 ` Paul Durrant
2020-03-10 10:10 ` Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=12464780-0ce3-0331-9f78-b026025607fb@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=kevin.tian@intel.com \
--cc=paul@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.