On Thu, Sep 03, 2020 at 05:46:39PM +0200, Paolo Bonzini wrote: > On 03/09/20 16:24, Edgar E. Iglesias wrote: > >> [*] I do wonder about hardware-device-passthrough setups; I > >> don't think I would care to pass through an arbitrary device > >> to an untrusted guest... > > Hmm, I guess it would make sense to have a configurable option in KVM > > to isolate passthrough devices so they only can DMA to guest RAM... > > Passthrough devices are always protected by the IOMMU, anything else > would be obviously insane^H^H^Hecure. :)
Really? To always do that blindly seems wrong. I'm refering to the passthrough device not being able to reach registers of other passthrough devices within the same guest. Obviously the IOMMU should be setup so that passthrough devices don't reach\ other guests or the host. Cheers, Edgar
