search for: deprivileg

This patch enables PCI passthrough with stub domain. PCI passthrough with stub domain has failed in the past. The primary reason is that hypercalls from qemu in stub domain are rejected. This patch allows qemu in stub domain to call the hypercalls which is needed for PCI passthrough. For security, if target domain of hypercall is different from that of stub domain, it rejects hypercall. To use

On Sat, Sep 12, 2015 at 01:35:48AM +0200, Karel Hendrych wrote: > Comparing simple dd bs=1M count=10000 on dom0 vs domU. Qemu driver > is achieving pretty much the same like dom0. > So you're measuring buffered speed. Try measuring non-buffered (iflag=direct or oflag=direct, depending if you're reading or writing). -- Pasi > Thanks > -- > Karel > > On 7.9.2015

...exists to explicitly override defaults which would otherwise be put in | place. While not exposed to the affected guests themselves, the | interface specifically exists for domains controlling such guests. | This interface may therefore be used by not fully privileged entities, | e.g. qemu running deprivileged in Dom0 or qemu running in a so called | stub-domain. With this exposure it is an issue that - the number of | the such controlled regions was unbounded (CVE-2022-42333), - | installation and removal of such regions was not properly serialized | (CVE-2022-42334). CVE-2022-42334[3]: | x86/HVM pi...

> A better solution would be to have a kernel module that > provides services to the X server, but this would require > more code per platform, which is partly why it wasn''t done > like this... *sigh* Isn''t this what the kernel /dev/fbdev driver does? If you''re running an fbdev Xserver you shouldn''t need to give the Xserver io or mmio

I''ve been trying to virtualize SCO OpenServer 5.0.6 for various reasons, and found that the Xensource 4.x doesn''t support it, nor does the open source Xen 3.x in any of the environments I''ve tried. It works on VMware, but for various reasons I prefer to use Xen on my Dom0. (I like open source, and the base OS for the commercial reasons is much, much more recent, and