Re: Fw: [Xen-devel] Xen on /. again

[Mark Williamson <Mark.Williamson@xxxxxxxxxxxx>]

> Is there any reason to allow communication between VMs, other than
> driver access? It seems to me you can just use network communication
> (potentially signed or encrypted) when you need to communicate, and that
> anything else would violate the fundamental 'virtual machine' abstraction?

You might want to have two domU's shared memory to implement a "direct 
point-to-point" ethernet link, to avoid the overheads of going through dom0.  
For most people this might not matter but it's nice to have the option for 
maximal performance.

> Also, I suppose you will wish to prevent covert channels between
> domains, e.g. domains communicating using various timing attacks (I move
> the disk head to the other end of the disk if I wish to tell you
> something), or by allocating/freeing certains parts of memory.
>
> How much will you need to dumb down the VMs view of what is going on in
> the machine to achieve this (not expose real time information, not
> expose real page tables), and how much of a VMM will there be left when
> you are done?

Well domains are not aware of each other's memory usage, so I wouldn't have 
thought that allocation / exposing real page tables would matter.  (Except 
dom0 can of course see everything if it wants).

Timing related attacks are somewhat trickier to eliminate covert channels in, 
although some randomisation can limit the bandwidth.

Cheers,
Mark


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel