Re: [Xen-devel] [PATCH v3] IOMMU: make DMA containment of quarantined devices optional

[Jan Beulich <jbeulich@xxxxxxxx>]

On 10.03.2020 06:30, Tian, Kevin wrote:
>> From: Jan Beulich <jbeulich@xxxxxxxx>
>> Sent: Monday, March 9, 2020 7:09 PM
>>
>> Containing still in flight DMA was introduced to work around certain
>> devices / systems hanging hard upon hitting a "not-present" IOMMU fault.
>> Passing through (such) devices (on such systems) is inherently insecure
>> (as guests could easily arrange for IOMMU faults of any kind to occur).
>> Defaulting to a mode where admins may not even become aware of issues
>> with devices can be considered undesirable. Therefore convert this mode
>> of operation to an optional one, not one enabled by default.
> 
> Here is another thought. The whole point of quarantine is to contain
> the device after it is deassigned from untrusted guest.

I'd question the "untrusted" here. Assigning devices to untrusted
guests is problematic anyway, unless you're the device manufacturer
and device firmware writer, and hence you can guarantee the device
to not offer any backdoors or alike. Therefore I view quarantining
more as a protection of the host against bad device behavior, and
less against malicious guest behavior (while the driver in the
guest surely has some influence, consider the guest getting crashed
and even a well-behaved driver hence not getting any chance to
silence the device).

Jan

> However, the
> passthrough of such device is already insecure, as you mentioned. 
> Then why do we care about making deassignment of such device
> secure without doing anything to secure it when it is assigned and being
> used by untrusted guest? I feel that one should simply put such device
> out of the quarantine list in the first place, i.e. set quarantine=false and
> then use tool to quarantine a whitelist of devices by skipping the bad one.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel