mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
x86/pass-through: documents as security-unsupported when sharing resources
When multiple devices share resources and one of them is to be passed
through to a guest, security of the entire system and of respective
guests individually cannot really be guaranteed without knowing
internals of any of the involved guests. Therefore such a configuration
cannot really be security-supported, yet making that explicit was so far
missing.
This is XSA-461 / CVE-2024-31146.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
master commit: 9c94eda1e3
master date: 2024-08-13 16:37:25 +0200
This commit is contained in:
Jan Beulich committed
1 parent
10d6cba598
commit
638f21616a
1 file changed
+5
@@ -704,6 +704,11 @@ This feature is not security supported: see https://xenbits.xen.org/xsa/advisory
|
|||||||
|
|
||||||
Only systems using IOMMUs are supported.
|
Only systems using IOMMUs are supported.
|
||||||
|
|
||||||
|
Passing through of devices sharing resources with another device is not
|
||||||
|
security supported. Such sharing could e.g. be the same line interrupt being
|
||||||
|
used by multiple devices, one of which is to be passed through, or two such
|
||||||
|
devices having memory BARs within the same 4k page.
|
||||||
|
|
||||||
Not compatible with migration, populate-on-demand, altp2m,
|
Not compatible with migration, populate-on-demand, altp2m,
|
||||||
introspection, memory sharing, or memory paging.
|
introspection, memory sharing, or memory paging.
|
||||||
|
|
||||||
|
|||||||