4 ms·
Be careful with GPU passthrough in general; you are giving Windows in that VM direct memory access. [1] In the last year or so, a group was able to overwrite X
by scrupulusalbion 11y ago
Be careful with GPU passthrough in general; you are giving Windows in that VM direct memory access. [1] In the last year or so, a group was able to overwrite Xen (in order to get additional privileges outside the VM) by merely being given GPU passthrough. [2] Even if you aren't using Xen, PCI passthrough necessarily entails the in-VM OS getting direct memory access which more or less spoils any security separation between the in-VM OS and the host OS.
To be clear, I don't think very many people are likely to have to deal with this as a security problem. I just think its appropriate to be aware of the power/danger inherent in the seemingly benign nature of GPU/PCI passthrough.
[1] = "you can use PCI passthrough to assign a PCI device (NIC, disk controller, HBA, USB controller, firewire controller, soundcard, etc) to a virtual machine guest, giving it full and direct access to the PCI device" (http://wiki.xenproject.org/wiki/XenPCIpassthrough http://wiki.xenproject.org/wiki/XenPCIpassthrough)
[2] Sorry, I can't find a link.
- blibble 11y agothis is not true in general. my setup passes through a discrete PCI-Express graphics card to Windows running under KVM, and the card is restricted to address space allocated to the VM using the motherboard's IOMMU.
- scrupulusalbion 11y agoYou are correct that it is dependent upon whether your motherboard has IOMMU [1]. Nevertheless, given the following paragraph, then it seems to be the reverse: it is generally unwise to willy-nilly give out PCI pass-through, unless you have confirmed that your hardware has IOMMU. Xen documentation explicitly states how to determine whether you have IOMMU on your hardware.[2] The hardware listed here [3], while out of date, conspicuously notes, for example, that "Core i7...most "K" versions don't support VT-d", which, according to Intel [4], means that the i7-4770K, for example, does not support IOMMU (VT-d). This tells me that if you are concerned about this issue, then you must check your hardware, even if it is new hardware. [1] = https://en.wikipedia.org/wiki/IOMMU https://en.wikipedia.org/wiki/IOMMU [2] = http://wiki.xenproject.org/wiki/Xen_PCI_Passthrough#How_can_I_tell_if_I_have_IOMMU_.2F_VT-D_support.3F http://wiki.xenproject.org/wiki/Xen_PCI_Passthrough#How_can_... [3] = http://wiki.xenproject.org/wiki/VTdHowTo http://wiki.xenproject.org/wiki/VTdHowTo [4] the i7-4770K probably lacks IOMMU because it would negatively affect performance on a CPU that is sold as a near top-of-the-line CPU for gaming, which generally excludes most virtualization use cases. edit: formatting