On 3/18/20 7:07 PM, David Hobach wrote:
On 3/18/20 5:47 PM, Andrew David Wong wrote:Dear Qubes Community, A new article has just been published on the Qubes website: "Qubes Architecture Next Steps: The GUI Domain" by Marek Marczykowski-Górecki & Marta Marczykowska-Górecka https://www.qubes-os.org/news/2020/03/18/gui-domain/That's great, finally some good news these days, thank you! @VNC server architecture:There might be an option there for the Qubes OS organisation to sell a _small_ piece of hardware which allows to plug in a GPU and accepts graphical input from a Qubes installation running without GPU. It would need to remain totally untrusted as it would have to run some stock Linux for drivers etc.I'm not sure whether using the network interface is the best pick for that though (not really a dedicated line in most setups), but I don't see many other options either.
Another thought:Ideally, GPU routing should work similar to NetVMs: Each VM could have an assignable GUI VM, possibly running on a totally different machine (Qubes Air). This way, less trusted applications could deploy more powerful external GPUs/GUI VMs or even full machines (if one doesn't care much about what an attacker could see) and more trusted applications would remain with the more trusted internal GUI VM/GPU (if one cares more about what an attacker could see), which would still require some IOMMU jailing.
For implementation, one would need a mostly one-way protocol to send commands to GPUs. I fear however that neither OpenGL nor DirectX are one-way... -_-
Anyway, Qubes OS remains one of the most exciting security projects. :-) -- You received this message because you are subscribed to the Google Groups "qubes-devel" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/1b9a53eb-8aac-8ace-72d9-776491aa23a4%40hackingthe.net.
smime.p7s
Description: S/MIME Cryptographic Signature
