From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joanna Rutkowska Subject: pciback: question about the permissive flag Date: Tue, 06 Jul 2010 23:37:27 +0200 Message-ID: <4C33A217.3050006@invisiblethingslab.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2132372494==" Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: "xen-devel@lists.xensource.com" List-Id: xen-devel@lists.xenproject.org This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --===============2132372494== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig1F0844F9BBBAA03BDB56C93D" This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig1F0844F9BBBAA03BDB56C93D Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable I'm trying to understand the purpose of the permissive flag in the Xen pciback driver. The comments in the code suggest that setting permissive=3D1 is "potentially unsafe", and I've been wondering why? My thinking goes this way -- we either: 1) have IOMMU/VT-d in the system, and use it to isolate the device assigned to a DomU, in which case allowing the DomU to fully control the assigned device's config space should not be a problem because VT-d should do its job (we hope at least ;), or 2) we don't have IOMMU/VT-d, in which case assigning a device to anything other than Dom0 is simply insecure, no matter if we try to restrict access to config space (but still allow DMA engine to be programmed by DomU) or not. So, what am I missing here? joanna. --------------enig1F0844F9BBBAA03BDB56C93D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkwzohcACgkQORdkotfEW85HQgCfbBQQRQR1hRgtA/QUn36sb7RL HsgAoKcbJiwW4UVC1uz+5DT7wUkLy04X =1d8i -----END PGP SIGNATURE----- --------------enig1F0844F9BBBAA03BDB56C93D-- --===============2132372494== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --===============2132372494==--