From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Beulich" Subject: Re: [TESTDAY] PV / HVM pass-through works when IOMMU present; weird failures when not Date: Mon, 01 Jul 2013 13:26:50 +0100 Message-ID: <51D191AA02000078000E1F24@nat28.tlf.novell.com> References: <51CDCF5302000078000E1A47@nat28.tlf.novell.com> <51D15F9E.4020309@eu.citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <51D15F9E.4020309@eu.citrix.com> Content-Disposition: inline List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: George Dunlap Cc: Ian Jackson , Ian Campbell , "xen-devel@lists.xen.org" List-Id: xen-devel@lists.xenproject.org >>> On 01.07.13 at 12:53, George Dunlap wrote: > On 28/06/13 17:00, Jan Beulich wrote: >>>>> On 28.06.13 at 17:37, George Dunlap wrote: >>> - For HVM guests, the only user-visible indication tha the IOMMU has >>> been disabled is the following error message on the command-line: >>> >>> # xl pci-attach h0 07:00.0 >>> libxl: error: libxl_pci.c:949:do_pci_add: xc_assign_device failed >>> >>> However, the device itself ends up passed-through to the guest anyway; >>> the guest seems to be able to see it and interact with it normally. >>> This is particularly scary, as in theory this should not be possible >>> without a working IOMMU. >>> >>> I don't think this is a blocker for 4.3, but we should definitely >>> release note it, and for 4.4 add a check to see if there is a >>> functioning IOMMU and only add a device if there's an override set. >> To me this very much looks like a security problem (which I >> think we should fix asap). > > Is it worth delaying the release (yet) another week for? I would say so, but I'm open to being convinced otherwise. > Probably the simplest solution at the moment, if there's an easy way for > the toolstack to figure out whether there is a working IOMMU or not, is > to simply not allow pass-through without an IOMMU unless there is an > override option. xend had no override option - pass-through to HVM without IOMMU should never be allowed imo. Adding proper error handling perhaps is indeed beyond what's reasonable for 4.3, but making use of xc_test_assign_device() should result in not too big a change. Jan