Re: [Xen-devel] [PATCH RFC 0/5] Grant table for console, xenstore pages

["Derek Murray" <Derek.Murray@xxxxxxxxxxxx>]

On Mon, Jul 14, 2008 at 3:37 PM, Diego Ongaro <diego.ongaro@xxxxxxxxxx> wrote:
> Derek Murray wrote:
>> I imagine you've already ready seen this, but the thread beginning
>> here has some historical context:
>>
>> http://lists.xensource.com/archives/html/xense-devel/2007-05/msg00004.html
>
> No, I didn't know about that thread. It's disappointing to see that I've
> duplicated your efforts in patches 1-3 of my series.

On the contrary, I think this is a much nicer approach - especially as
it doesn't require any modifications to the hypervisor. Therefore I
think it will be a better fit for the mainline repository.

> Did you ever finish polishing those patches? Based on the discussion,
> there were just a couple things left to clean up.

If I remember correctly, I did do some more work on those patches to
make the use of gntdev optional, but I don't think they were ready for
prime-time. I'll look them out and send them to you off list, in case
they might be of any use.

>>> I'm working on moving xenstored into a dedicated, unprivileged domain.
>
> Have you also worked on this, Derek? I wouldn't want to keep working on
> something you've already done...

I haven't worked on this myself, but I vaguely recall hearing of
efforts to disaggregate XenStore - I don't think any of these are
publicly available. Is the main aim of this work to enhance security
or performance? If the former, how do you plan to launch the XenStore
domain? From Dom0, or using another mechanism?

My personal inclination is to enhance Xen so that the tools no longer
run as root (a conventional Unix-based privilege separation), which
provides a low-cost improvement in Dom0 security. This would build on
your patches to use gntdev for console and XenStore access, and use
modifications to gntdev that allow non-root users to map certain
explicitly-specified grants. This would provide a route to
disaggregating all necessarily-trusted functionality on systems that
would benefit from it (i.e. IOMMU-equipped systems). If you'd like, we
could discuss this approach further.

Regards,

Derek Murray.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel