From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-1?Q?Roger_Pau_Monn=E9?= Subject: Re: Questions about PVH in Xen 4.3 unstable Date: Wed, 30 Jan 2013 11:11:00 +0000 Message-ID: <5108FFC4.3030608@citrix.com> References: <20130130104727.GI6193@type.bordeaux.inria.fr> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: George Dunlap Cc: tech mailinglists , Samuel Thibault , xen-users , "xen-devel@lists.xen.org" List-Id: xen-devel@lists.xenproject.org On 30/01/13 11:04, George Dunlap wrote: > On Wed, Jan 30, 2013 at 10:52 AM, tech mailinglists > > wrote: > > I thought that stubdoms for HVMs are great for security. Can it > still be used for PV-on-HVM for security? Can only Linux run as PVH > and Windows and so on still run as HVM? > > > Stubdoms increase security by isolating the qemu process, so that it's > not running in domain 0. PV domains (and by extension PVH domains) > don't have a qemu process, and are therefore are secure without needing > a stubdom. > > Yes, PVH is an extension of PV; so only operating systems which can be > ported to PV will support PVH. Isn't it probably easier to port a system with PVHVM support to PVH?