From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joanna Rutkowska Subject: Re: feature suggestion: DMAR table emulation for Xen Date: Fri, 14 May 2010 12:58:29 +0200 Message-ID: <4BED2CD5.4060900@invisiblethingslab.com> References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0077588724==" Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Keir Fraser Cc: "Han, Weidong" , "Cihula, Joseph" , "Kay, Allen M" , "xen-devel@lists.xensource.com" List-Id: xen-devel@lists.xenproject.org This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --===============0077588724== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig6D4344EC4B9012F264E050F4" This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig6D4344EC4B9012F264E050F4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 05/14/2010 12:48 PM, Keir Fraser wrote: > On 14/05/2010 11:15, "Joanna Rutkowska" = > wrote: >=20 >>> Yeah, actually the integrated graphics can implement all sorts of dir= ty >>> tricks between OS driver, video BIOS, and SMM. This can rely on fixed= memory >>> areas for communication -- both for host accesses and DMA, the latter= >>> requiring RMRR setup. Maybe the RMRRs are static per-chipset, but I w= ouldn't >>> be too sure of it. >>> >> Hmmm... Shouldn't this affect only (and potentially) the text mode >> display? I would expect that once Dom0 Linux takes over, it would be >> using its own IGD driver that is VT-d aware and is not on the mercy of= >> the evil BIOS? >=20 > Well, if you do not pass through the IGD to a domU then the issue is mo= ot. > Dom0 gets an all-inclusive mapping below 4GB, which should be a superse= t of > anything the RMRRs would specify. It's when passing through to a domU t= hat > the RMRRs matter, especially if you pass through as the primary adaptor= and > hence re-execute the video BIOS in domU context. >=20 Well, we don't do graphics passthrough in Qubes, mostly for two reasons: 1) We believe users prefer seamless integration of all apps onto one desktop (and that requires only one domain, e.g. Dom0, to have access to the graphics card), 2) Giving a potentially untrusted domain full access to the graphics device creates a potential security risk. In fact, you cannot make such an architecture secure without using TXT (yes, TXT in addition to VT-d). Do you do IGD passthrough in Xen Client? joanna. --------------enig6D4344EC4B9012F264E050F4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkvtLNUACgkQORdkotfEW87PKACg9Y5E/IZS8e8O8ccr6EUmqdDm fLsAoLWe+I7aOHCF+fAVdLjktTmH6mxd =FItx -----END PGP SIGNATURE----- --------------enig6D4344EC4B9012F264E050F4-- --===============0077588724== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --===============0077588724==--