This is a followup of a discussion on IRC: The main question of the discussion was: "Should frontend drivers trust their backends not doing malicious actions?"
This IMO includes: 1. The data put by the backend on the ring page(s) is sane and consistent, meaning that e.g. the response producer index is always ahead of the consumer index. 2. Response data won't be modified by the backend after the producer index has been incremented signaling the response is valid. 3. Response data is sane, e.g. an I/O data length is not larger than the buffer originally was. 4. When a response has been sent all grants belonging to the request have been unmapped again by the backend, meaning that the frontend can assume the grants can be removed without conflict. Today most frontend drivers (at least in the Linux kernel) seem to assume all of the above is true (there are some exceptions, but never for all items): - they don't check sanity of ring index values - they don't copy response data into local memory before looking at it - they don't verify returned data length (or do so via BUG_ON()) - they BUG() in case of a conflict when trying to remove a grant So the basic question is: should all Linux frontend drivers be modified in order to be able to tolerate buggy or malicious backends? Or is the list of trust above fine? IMO even in case the frontends do trust the backends to behave sane this doesn't mean driver domains don't make sense. Driver domains still make a Xen host more robust as they e.g. protect the host against driver failures normally leading to a crash of dom0. Juergen _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
