From: Andrea Arcangeli <andrea@qumranet.com>
To: "Daniel P. Berrange" <berrange@redhat.com>
Cc: kvm-devel@lists.sourceforge.net, allen.m.kay@intel.com,
Avi Kivity <avi@qumranet.com>,
benami@il.ibm.com
Subject: Re: [PATCH 1/1] direct mmio for passthrough - kernel part
Date: Tue, 1 Apr 2008 20:10:31 +0200 [thread overview]
Message-ID: <20080401181031.GA19189@duo.random> (raw)
In-Reply-To: <20080401171807.GA31765@redhat.com>
On Tue, Apr 01, 2008 at 06:18:07PM +0100, Daniel P. Berrange wrote:
> and very few application domains are allowed to access them. THe KVM/QEMU
> policy will not allow this for example. Basically on the X server, HAL and
> dmidecode have access in current policy. It would be undesirable to have to
> all KVM guests full access to /dev/mem, so a more fine grained access method
> would have benefits here.
But pci-passthrough can give a root on the host even to the ring0
guest, just like /dev/mem without VT-d, so there's no muchx difference
with using /dev/mem as far as security is concerned. Only on the CPUs
including VT-d it's possible to retain a mostly equivalent security
level despite pci-passthrough.
-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
next prev parent reply other threads:[~2008-04-01 18:10 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-04-01 11:52 [RFC] direct mmio for passthrough benami
2008-04-01 11:52 ` [PATCH 1/1] direct mmio for passthrough - kernel part benami
2008-04-01 13:30 ` Avi Kivity
2008-04-01 14:42 ` Anthony Liguori
2008-04-01 15:20 ` Anthony Liguori
2008-04-01 17:05 ` Avi Kivity
2008-04-01 18:18 ` Andrea Arcangeli
2008-04-01 18:28 ` Anthony Liguori
2008-04-01 17:03 ` Avi Kivity
2008-04-01 17:18 ` Daniel P. Berrange
2008-04-01 18:10 ` Andrea Arcangeli [this message]
2008-04-01 18:18 ` Daniel P. Berrange
2008-04-01 18:23 ` Anthony Liguori
2008-04-01 18:21 ` Anthony Liguori
2008-04-01 19:22 ` Avi Kivity
2008-04-01 22:38 ` Andrea Arcangeli
2008-04-01 22:22 ` Andrea Arcangeli
2008-04-01 22:29 ` Anthony Liguori
2008-04-02 4:00 ` Avi Kivity
2008-04-01 19:28 ` Ben-Ami Yassour1
2008-04-01 19:43 ` Avi Kivity
2008-04-01 20:04 ` Anthony Liguori
2008-04-02 4:32 ` Avi Kivity
2008-04-02 7:03 ` Andrea Arcangeli
2008-04-02 9:50 ` Avi Kivity
2008-04-02 10:28 ` Andrea Arcangeli
2008-04-02 10:59 ` Avi Kivity
2008-04-02 11:16 ` Avi Kivity
2008-04-02 11:50 ` Andrea Arcangeli
2008-04-02 11:53 ` Andrea Arcangeli
2008-04-03 8:51 ` Avi Kivity
2008-04-02 14:59 ` Anthony Liguori
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080401181031.GA19189@duo.random \
--to=andrea@qumranet.com \
--cc=allen.m.kay@intel.com \
--cc=avi@qumranet.com \
--cc=benami@il.ibm.com \
--cc=berrange@redhat.com \
--cc=kvm-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.