From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
To: Jan Beulich <JBeulich@suse.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>,
xen-devel@lists.xenproject.org,
Roger Pau Monne <roger.pau@citrix.com>
Subject: Re: [PATCH v3 2/3] xen/pvh: check permissions when adding MMIO regions
Date: Fri, 23 Jan 2015 10:04:45 -0500 [thread overview]
Message-ID: <20150123150445.GJ7365@l.oracle.com> (raw)
In-Reply-To: <54C23CB70200007800058B17@mail.emea.novell.com>
On Fri, Jan 23, 2015 at 11:21:11AM +0000, Jan Beulich wrote:
> >>> On 22.01.15 at 21:28, <konrad.wilk@oracle.com> wrote:
> > On Thu, Jan 22, 2015 at 04:19:22PM +0100, Roger Pau Monne wrote:
> >> Check that MMIO regions added to PVH Dom0 are allowed. Previously a PVH Dom0
> >> would have access to the full MMIO range.
> >
> > How do we do this for normal PV dom0? Do we enforce the same
> > restriction?
>
> We do, at the MMU level at least. Thing is (see an earlier
> reply, maybe on Elena's thread) that we may still be too lax.
Looking at vtd_set_hwdom_mapping looks to be having quite simplified
mechanism for PV. This is of course for those weird devices that
do DMA operations behind the OS'es back.
If we go that route we would probablly need logic in there to change
too - otherwise we have .. Ah, this is where Tim's idea of having
a guest just having an flag of 'I_need_IOMMU' would be so nice and
having only one code-path that could be used for both PV and PVH.
>
> Jan
>
next prev parent reply other threads:[~2015-01-23 15:04 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-22 15:19 [PATCH v3 0/3] xen/pvh: prevent Dom0 from accessing reserved MMIO regions Roger Pau Monne
2015-01-22 15:19 ` [PATCH v3 1/3] xen: allow set_mmio_p2m_entry to specify access type Roger Pau Monne
2015-01-22 15:25 ` Tim Deegan
2015-01-22 15:19 ` [PATCH v3 2/3] xen/pvh: check permissions when adding MMIO regions Roger Pau Monne
2015-01-22 15:43 ` Jan Beulich
2015-01-23 11:29 ` Roger Pau Monné
2015-01-23 11:44 ` Jan Beulich
2015-01-22 20:28 ` Konrad Rzeszutek Wilk
2015-01-23 11:21 ` Jan Beulich
2015-01-23 15:04 ` Konrad Rzeszutek Wilk [this message]
2015-01-22 15:19 ` [PATCH v3 3/3] xen: prevent access to HPET from Dom0 Roger Pau Monne
2015-01-22 15:47 ` Jan Beulich
2015-01-23 11:46 ` Roger Pau Monné
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150123150445.GJ7365@l.oracle.com \
--to=konrad.wilk@oracle.com \
--cc=JBeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.