Windows 10 Review

Re:Windows 10 Review by scrupulusalbion on Thursday August 27, 2015 @09:39AM (#10129253)

Be careful with GPU passthrough in general; you are giving Windows in that VM direct memory access. [1] In the last year or so, a group was able to overwrite Xen (in order to get additional privileges outside the VM) by merely being given GPU passthrough. [2] Even if you aren't using Xen, PCI passthrough necessarily entails the in-VM OS getting direct memory access which more or less spoils any security separation between the in-VM OS and the host OS.

To be clear, I don't think very many people are likely to have to deal with this as a security problem. I just think its appropriate to be aware of the power/danger inherent in the seemingly benign nature of GPU/PCI passthrough.

[1] = "you can use PCI passthrough to assign a PCI device (NIC, disk controller, HBA, USB controller, firewire controller, soundcard, etc) to a virtual machine guest, giving it full and direct access to the PCI device" (http://wiki.xenproject.org/wiki/XenPCIpassthrough) [2] Sorry, I can't find a link.

[ Parent | on HN ]

Re:Windows 10 Review by blibble on Thursday August 27, 2015 @10:54AM (#10129759)

this is not true in general.

my setup passes through a discrete PCI-Express graphics card to Windows running under KVM, and the card is restricted to address space allocated to the VM using the motherboard's IOMMU.

[ Parent | on HN ]

Re:Windows 10 Review by scrupulusalbion on Thursday August 27, 2015 @11:54AM (#10130149)

You are correct that it is dependent upon whether your motherboard has IOMMU [1]. Nevertheless, given the following paragraph, then it seems to be the reverse: it is generally unwise to willy-nilly give out PCI pass-through, unless you have confirmed that your hardware has IOMMU.

Xen documentation explicitly states how to determine whether you have IOMMU on your hardware.[2] The hardware listed here [3], while out of date, conspicuously notes, for example, that "Core i7...most "K" versions don't support VT-d", which, according to Intel [4], means that the i7-4770K, for example, does not support IOMMU (VT-d). This tells me that if you are concerned about this issue, then you must check your hardware, even if it is new hardware.

[1] = https://en.wikipedia.org/wiki/IOMMU

[2] = http://wiki.xenproject.org/wiki/Xen_PCI_Passthrough#How_can_...

[3] = http://wiki.xenproject.org/wiki/VTdHowTo

[4] the i7-4770K probably lacks IOMMU because it would negatively affect performance on a CPU that is sold as a near top-of-the-line CPU for gaming, which generally excludes most virtualization use cases.

edit: formatting

[ Parent | on HN ]