Qubes OS 4.0 without IOMMU

[damm swing]

Hello,

 

Will it be possible to use the final version of Qubes OS 4.0 (at your own risk) on hardware without IOMMU (only with SLAT)?

 

Regards

[Yethal]

PCI assignment won't work without IOMMU so no sys-net and no sys-usb

[danns...@gmail.com]

Is there no way to force PV mode in PCI VMs?

[Tai...@gmx.com]

No it won't.

You can get a laptop (see my post in "Acer Aspire E15" thread for my
recommended choices) that has all the features you need for only
$100-200 so it isn't worth it for the developer team to make it possible
for qubes to work without one of the key security measures.

[damm swing]

I found some sentence about that: "The new Core Stack allows one to do this with the flip of a switchproperty"
https://www.qubes-os.org/news/2017/07/31/qubes-40-rc1/

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Yes, it is possible to switch sys-net and sys-usb to PV, but even for PV
IOMMU makes a great difference. See here:
https://www.qubes-os.org/doc/user-faq/#can-i-install-qubes-on-a-system-without-vt-d

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZvEnSAAoJENuP0xzK19csQ4EH/1feU2j6eYUvRN0WBlwDtYdb
8PvF3Qk/nXuYRIzBjQ2ykHc6MsX4YQdvRU1gI90JdHX+5y6PSrKGGm8O5AWxhRp6
Xl1Ev5Xs5vV8wCjcYp9FVpMmD+aGx06CtHaWkhQkMe7rhSxcoxASBZiMNvCl/kWC
D4wZ2Hvg5Fp3LqiEHfx3Kei8OSqnd/UaVRnLcMSkQ4B64ilkJbT036AbNNYCN0wW
saTSOxzEHzSrLvBvBm50n7v7f+jJCxnGPeeWxdW9dWXyXdAThTiKk/RtYp+0ZYv3
/FNdvNhJ24kjF7KE1NffHGVoYY4veoGISfV/TSeQ86GIjxF98yaV0ji0UonRYIo=
=aHth
-----END PGP SIGNATURE-----

[damm swing]

Thank you for your answer.
By the way, is it possible that some AppVM could compromise NetVM (e.g. by a hypothetical bug in Xen net backend) and then use the DMA attack?

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sat, Sep 16, 2017 at 12:46:35PM -0700, damm swing wrote:
> By the way, is it possible that some AppVM could compromise NetVM (e.g. by a hypothetical bug in Xen net backend) and then use the DMA attack?

Yes, it is theoretically possible. See for example here:
https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-023-2015.txt

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZwD1jAAoJENuP0xzK19cscIwH/AqpD+R6Ro2KWY2AVK1wfoSG
igZOQMYVwzwa4bRvisoYtd1xn1/1e4yL7BWwmwKjEr5RhkTa5hI3+qOCw7DW7znU
zkHNwh3yEYBr52d4RWWMtDYGC01Kv+66zvZlCsetbmbyn768ltpyndQzyUgVDBOw
Z5zD61r+kTxg4YsIZuwfbtsyyKgfC2gEjQRYjr417V/RYINgcOl8XSlcEBClWssM
tqZZcAQ4DCzFakyZZI2cgxgW4Wn/3u7UJbO7TS5TCe/qaUq0YVBc1FMus32v4BxN
vgZ+XX+ZFb64hJwotPLP3u4R8VSWyOL/2ichE/snID5VUbw5o2oEOMdXLs6EFdo=
=0CkL
-----END PGP SIGNATURE-----