From mboxrd@z Thu Jan 1 00:00:00 1970 From: Anthony Liguori Subject: Re: xend leaks/bugs/etc Date: Mon, 18 Apr 2005 10:45:40 -0500 Message-ID: <4263D624.4040906@us.ibm.com> References: <1113804011.9189.46.camel@multivac> <1113834723.7086.87.camel@localhost> <4263CF05.2030906@us.ibm.com> <1113838055.7546.6.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1113838055.7546.6.camel@localhost.localdomain> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Hollis Blanchard Cc: Xen-devel List-Id: xen-devel@lists.xenproject.org Hollis Blanchard wrote: >On Mon, 2005-04-18 at 10:15 -0500, Anthony Liguori wrote: > > >>>Finally, the xend code seems to trust input it receives from domains >>>which is incompatible with the architectural goal of VM isolation. >>> >>> >>> >>This is a very big problem. One very difficult issue to address is >>how to deal with very hostile domains that may attempt DoS attacks by >>flooding their own console. >> >> > >This isn't really a xend issue. I'm not sure this *can* be addressed, >and I believe other hypervisors have this problem as well. > > I'm not sure I agree. Since Xen only provides shared-memory and event channels, the tools control how frequently they look at shared-memory (so a tool can throttle itself). The only possible DoS venue should be the event channels. The tools should simply be able to unbind from event channels that are considered hostile. >At some point, you have to acknowledge there will be *some* resource >sharing among otherwise isolated domains. Switching domains on a single >CPU will increase cache misses; domains doing lots of (valid and >allowed) IO will reduce shared bus bandwidth for other domains; etc... > > There are certainly going to be things that you cannot prevent but that does not mean we shouldn't try to prevent everything we can prevent. Regards, Anthony Liguori