This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] Is Xen affected by this x86 hardware security hole?

On 2 May 2006, at 14:10, Mark Williamson wrote:

* X running in dom0 can, in principle, subvert any domain you're running, if X
itself gets subverted.  A bug in X in dom0 could hang the machine in

Yes, although you are a little better off on Xen -- for example iopl==3 doesn't let you disable interrupts, as it does on native. However, the X server will still have access to most I/O ports and can certainly wreak havoc because of that.

For this specific problem, it would make sense to ensure that D_LCK is set during boot, so that noone can thereafter modify the SMM memory space. You need to know something about PCI space to do that, though, so it would make sense for us to leave that to domain0.

 -- Keir

Xen-devel mailing list