From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joanna Rutkowska Subject: Re: pciback: question about the permissive flag Date: Wed, 07 Jul 2010 23:23:38 +0200 Message-ID: <4C34F05A.20407@invisiblethingslab.com> References: <4C33A217.3050006@invisiblethingslab.com> <20100707151851.GA12092@phenom.dumpdata.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2041067412==" Return-path: In-Reply-To: <20100707151851.GA12092@phenom.dumpdata.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Konrad Rzeszutek Wilk Cc: "xen-devel@lists.xensource.com" List-Id: xen-devel@lists.xenproject.org This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --===============2041067412== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig72273A1898C40540A4190883" This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig72273A1898C40540A4190883 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 07/07/10 17:18, Konrad Rzeszutek Wilk wrote: > On Tue, Jul 06, 2010 at 11:37:27PM +0200, Joanna Rutkowska wrote: >> I'm trying to understand the purpose of the permissive flag in the Xen= >> pciback driver. The comments in the code suggest that setting >> permissive=3D1 is "potentially unsafe", and I've been wondering why? >> >> My thinking goes this way -- we either: >> >> 1) have IOMMU/VT-d in the system, and use it to isolate the device >> assigned to a DomU, in which case allowing the DomU to fully control t= he >> assigned device's config space should not be a problem because VT-d >=20 > But that is not the case. The PCI config writes are actually done by > Dom0. The Xen PCI frontend redirects all config space reads/writes to > the Xen PCI backend that does them on the guest behalf. >=20 Hmm, not sure if I understand why you wrote "this is not the case" above? Of course DomU cannot directly change anything in PCI config space of any device, because its kernel code executes in Ring 3 or 1, and cannot do IO to 0xcf8/cfc. But I was under impression that once we assign a PCI device to the DomU, and once we set permissive=3D1, then thi= s would effectively allow DomU to fully control the device config space. Is this not correct? > There are some backend-backend config space libs that deal with > different regions (power, MSI), and for those that are not present > the permissive flag is used to figure out whether the guest is allowed > to write to that region. >=20 What do you mean by a "backend-backend" lib? joanna. --------------enig72273A1898C40540A4190883 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkw08FoACgkQORdkotfEW85aVwCfbhJnUgBckEjIZ/z/5FmFHnHu ZYcAoMyKi/gks2FjKVyaDjswmTUONg9w =K66O -----END PGP SIGNATURE----- --------------enig72273A1898C40540A4190883-- --===============2041067412== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --===============2041067412==--