| |
|
 |
|
 |
|
|
|
| |
|
|
xen-devel
Re: [Xen-devel] protecting xen startup
are you hinting at the allocation of device drivers across domains?
e.g. having one domain do the hardware side and securely
proxy-forwarding the access to that device over to another domain?
Well, this is really already done. e.g. net and block devices are
securely shared. Domain 0 runs the real physical device driver and the
unprivileged domain uses a virtual device driver to communicate its
requests to dom0. These are requests are validated before being accepted.
Setting up these "device channels" is reasonably involved. A protocol
using the control message framework is used to communicate to the
"backend" (runs in dom0 and co-ordinates sharing) and "frontend" (runs in
guest and provides virtual devices to the guest) about what virtual
devices exist. The protocol is then used to establish a shared-memory
connection between the two.
One problem here is that domain 0's control interface (used to communicate
with the backend drivers) can only have one writer. Hence it's necessary
to ensure mutual exclusion - we let Xend control writing requests to this
interface.
As well as keeping track of various forms of state, you also need to
ensure that the control interface is dealt with correctly, which could be
quite a bit of work.
... but i have to point out that i'm more concerned about leveraging
what is available - right now - than i am about future versions.
Sure thing. We're planning to add mandatory access control features at
some stage but that's still on the drawing board at the moment. In the
meantime, there should be plenty of other fun to be had...
Cheers,
Mark
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel
|
|
|
| |
|
Home