From: Jan Beulich Date: Tue, 13 Aug 2024 14:51:14 +0000 (+0200) Subject: x86/pass-through: documents as security-unsupported when sharing resources X-Git-Tag: RELEASE-4.17.5~1 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=f95a6b010b9a2633d5186f7a53e4607bbe56f618;p=xen.git x86/pass-through: documents as security-unsupported when sharing resources When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be guaranteed without knowing internals of any of the involved guests. Therefore such a configuration cannot really be security-supported, yet making that explicit was so far missing. This is XSA-461 / CVE-2024-31146. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross master commit: 9c94eda1e3790820699a6de3f6a7c959ecf30600 master date: 2024-08-13 16:37:25 +0200 --- diff --git a/SUPPORT.md b/SUPPORT.md index c94c9cfe8f..f039d12352 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -775,6 +775,11 @@ This feature is not security supported: see https://xenbits.xen.org/xsa/advisory Only systems using IOMMUs are supported. +Passing through of devices sharing resources with another device is not +security supported. Such sharing could e.g. be the same line interrupt being +used by multiple devices, one of which is to be passed through, or two such +devices having memory BARs within the same 4k page. + Not compatible with migration, populate-on-demand, altp2m, introspection, memory sharing, or memory paging.