SHA256
2
0
forked from SLFO-pool/xen
xen/66bb6fa5-x86-pass-through-document-as-security-unsupported.patch

32 lines
1.2 KiB
Diff

Subject: x86/pass-through: documents as security-unsupported when sharing resources
From: Jan Beulich jbeulich@suse.com Tue Aug 13 16:37:25 2024 +0200
Date: Tue Aug 13 16:37:25 2024 +0200:
Git: 9c94eda1e3790820699a6de3f6a7c959ecf30600
When multiple devices share resources and one of them is to be passed
through to a guest, security of the entire system and of respective
guests individually cannot really be guaranteed without knowing
internals of any of the involved guests. Therefore such a configuration
cannot really be security-supported, yet making that explicit was so far
missing.
This is XSA-461 / CVE-2024-31146.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -841,6 +841,11 @@ This feature is not security supported:
Only systems using IOMMUs are supported.
+Passing through of devices sharing resources with another device is not
+security supported. Such sharing could e.g. be the same line interrupt being
+used by multiple devices, one of which is to be passed through, or two such
+devices having memory BARs within the same 4k page.
+
Not compatible with migration, populate-on-demand, altp2m,
introspection, memory sharing, or memory paging.