From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: Other PCI devices to mark mark as read-only for dom0 Date: Fri, 22 Jun 2012 13:06:43 +0100 Message-ID: <4FE45FD3.3060300@citrix.com> References: <4FE43518.9070106@citrix.com> <4FE45A64020000780008B570@nat28.tlf.novell.com> <4FE44404.2020702@citrix.com> <4FE471C4020000780008B5FA@nat28.tlf.novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4FE471C4020000780008B5FA@nat28.tlf.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Jan Beulich Cc: Andre Przywara , Christoph Egger , "Keir (Xen.org)" , Eddie Dong , "xen-devel@lists.xen.org" , Wei Wang , "xiantao.zhang@intel.com" List-Id: xen-devel@lists.xenproject.org On 22/06/12 12:23, Jan Beulich wrote: >>>> On 22.06.12 at 12:08, Andrew Cooper wrote: >> On 22/06/12 10:43, Jan Beulich wrote: >>>>>> On 22.06.12 at 11:04, Andrew Cooper wrote: >>>> Following Jan's infrastructure to mark certain PCI devices as read only, >>>> I think it wise to now consider what other PCI devices should really be >>>> read only to dom0. >>>> >>>> My preliminary thoughts include: >>>> >>>> * PCI serial devices which Xen is configured to use >>> But only if they're single-function. >> Why only single function? Should Xen not turn all the functions it is >> using to read-only ? > Because, just like for normal, non-PCI based serial ones, ports > that Xen doesn't use should remain usable by Dom0. For > example, I have a PCI card with two serial and one parallel > ports, so with Xen using one serial port for itself, there's no > reason not to allow Dom0 to use the other or the parallel one. I apologize. I originally used the term 'device' when I intended to use 'function', so I think we are arguing for the same point. > >>>> * Chipset devices (AMD IOMMU covered by previous patch) >>>> * Cpu information >>> What are you thinking of here specifically. >> See attached lspci from a new sandybridge machine we have gained. Quite >> a lot of that looks rather dangerous for dom0 to play around with. > But that can't be easily qualified into some rule, the more that > some of these - iirc - are needed e.g. by the EDAC drivers. > > Jan > Which is why I am asking here, to see if there are some rules which could help. I agree that it is a sticky situation. -- Andrew Cooper - Dom0 Kernel Engineer, Citrix XenServer T: +44 (0)1223 225 900, http://www.citrix.com