From mboxrd@z Thu Jan 1 00:00:00 1970 From: Hollis Blanchard Subject: Re: xend leaks/bugs/etc Date: Mon, 18 Apr 2005 10:27:35 -0500 Message-ID: <1113838055.7546.6.camel@localhost.localdomain> References: <1113804011.9189.46.camel@multivac> <1113834723.7086.87.camel@localhost> <4263CF05.2030906@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4263CF05.2030906@us.ibm.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Anthony Liguori Cc: Xen-devel List-Id: xen-devel@lists.xenproject.org On Mon, 2005-04-18 at 10:15 -0500, Anthony Liguori wrote: > >Finally, the xend code seems to trust input it receives from domains > >which is incompatible with the architectural goal of VM isolation. > > > This is a very big problem. One very difficult issue to address is > how to deal with very hostile domains that may attempt DoS attacks by > flooding their own console. This isn't really a xend issue. I'm not sure this *can* be addressed, and I believe other hypervisors have this problem as well. At some point, you have to acknowledge there will be *some* resource sharing among otherwise isolated domains. Switching domains on a single CPU will increase cache misses; domains doing lots of (valid and allowed) IO will reduce shared bus bandwidth for other domains; etc... -- Hollis Blanchard IBM Linux Technology Center