From: Petr Tesarik <ptesarik@suse.cz>
To: xen-devel@lists.xenproject.org
Subject: Re: Should PV frontend drivers trust the backends?
Date: Thu, 26 Apr 2018 10:46:15 +0200 [thread overview]
Message-ID: <20180426104615.104ec756@ezekiel.suse.cz> (raw)
In-Reply-To: <eebeb6d29e8e4b8d84c842439ffd7b8f@AMSPEX02CL03.citrite.net>
On Wed, 25 Apr 2018 13:47:09 +0000
Paul Durrant <Paul.Durrant@citrix.com> wrote:
> > -----Original Message-----
> > From: Xen-devel [mailto:xen-devel-bounces@lists.xenproject.org] On
> > Behalf Of Juergen Gross
> > Sent: 25 April 2018 13:43
> > To: xen-devel <xen-devel@lists.xenproject.org>
> > Subject: [Xen-devel] Should PV frontend drivers trust the backends?
> >
> > This is a followup of a discussion on IRC:
> >
> > The main question of the discussion was: "Should frontend drivers
> > trust their backends not doing malicious actions?"
> >
>[...]
> I see the general question as being analogous to 'should a Linux
> device driver trust its hardware' and I think the answer for a
> general purpose OS like linux is 'yes'.
I can see how this is analogous, but it's not identical. Traditionally,
hardware has full control of the system anyway, so it makes little
sense to distrust it. It does make sense to validate the data and retry
an invalid operation (if possible) or crash the system (if technically
impossible).
However, a backend driver runs in a domain that is not much different
from the domain running the frontend driver, so it is theoretically
possible to implement some support in Xen itself. Now, if you're asking
whether Xen _should_ add complex handling of resilient domain-to-domain
communication, that's purely a matter of taste.
FWIW my vote is: Do nothing. Keep Xen architecture simple.
Petr T
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
prev parent reply other threads:[~2018-04-26 8:46 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-25 12:42 Should PV frontend drivers trust the backends? Juergen Gross
2018-04-25 13:36 ` Andrew Cooper
2018-04-25 13:47 ` Paul Durrant
2018-04-26 5:59 ` Oleksandr Andrushchenko
2018-04-26 8:16 ` Paul Durrant
2018-04-26 8:47 ` Oleksandr Andrushchenko
2018-04-30 17:32 ` Marek Marczykowski-Górecki
2018-05-01 7:55 ` Paul Durrant
2018-05-01 15:00 ` 'Marek Marczykowski-Górecki'
2018-05-01 15:32 ` Paul Durrant
2018-04-26 8:46 ` Petr Tesarik [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180426104615.104ec756@ezekiel.suse.cz \
--to=ptesarik@suse.cz \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.