On 04/18/2012 01:02 PM, Tim Deegan wrote:
Hi,
Can you please set up your mail client to indent quoted text?
It's not
clear which parts of your email are quoted and which are your
replies.
Sorry about that.
At 13:53 +0100 on 11 Apr (1334152395), Francisco Rocha wrote:
> You can handle the second by using
> stub domains to run qemu in a different domain, or by
only usoing PV
> domUs.
>
> If I use the stub domain provided with xen the dom0 will
not perform the
> second mapping, right?
Yes; instead, the stub domain will perform it - so you'll need
to allow
that to happen. (Basically the stub domain's code lives
inside the
guest's protection boundary, like its BIOS code &c).
> The third is pretty much a requirement if the domU's
going to do
> any I/O via dom0, but at least with grant tables the ACL
is under domU's
> control. Or if you have an IOMMU you can give the domU
direct access to
> its own network card and disk controller.
>
> I only have one ethernet card but i can get an ethernet
expresscard.
>
> Can I do this in my the machine that gives me the output
that follows?
>
> (XEN) Intel VT-d Snoop Control not enabled.
> (XEN) Intel VT-d Dom0 DMA Passthrough not enabled.
> (XEN) Intel VT-d Queued Invalidation enabled.
> (XEN) Intel VT-d Interrupt Remapping enabled.
> (XEN) Intel VT-d Shared EPT tables not enabled.
Yes; you should be able to do it on this machine without
changing any
BIOS settings.
Tim.
Hi Tim,
I was thinking about changing my approach.
I think that for now I will leave those pages off because I am
mostly interested in protecting other areas.
Those accesses for now are inevitable to get the VM to properly
operate. Now, the question is if it is possible to use page table
entries to do what I want to do.
The objective would be to use a bit flag that would determine if
the pages are returned when a call to map_foreign_range is made.
So, my final objective would be that only pages used for the three
operations you describe are accessible to Dom0.
Everything that is not BIOS and related, Qemu or PV backend
drivers will not be returned.
From what I see in the header files you use 12-bits from a 24-bit
flag (x86_64). Can we do it? This would again take us to controlling
access at get_page_from_l1e(), right?
Thank you,
Francisco
|
