4 ms·
That will still allow execution of kernel code you may not want executed (even though in a VM), and is thus strictly worse. Especially for the modem, which you
by megous 5y ago
That will still allow execution of kernel code you may not want executed (even though in a VM), and is thus strictly worse. Especially for the modem, which you need to run and interact with all the time on a phone, this sounds like overkill.
- rank0 5y agoNot sure I understand your comment. Of course kernel code is executed in the guest VM…what’s the problem with that? An adversary would have to break Xen security controls to gain access to your other domains.
- megous 5y agoVM has to have some communication bridge to the host, for all the features of the modem. That's still quite a lot of attack surface, once guest VM is compromised. It's better to not expose the needless attack surface rather than just attempting to isolate the attack into a leaky VM.
- rank0 5y agoMy understanding is that the paravirtualization provided by Xen is an effective control. The guest shouldn’t have direct access to the hardware device io right? What is the alternative? If you don’t use a VM you have to expose dom0 directly to device io. EDIT: ah I see we’re talking about a Linux phone! I agree with your point I’m not sure mobile devices have the resources to isolate every component into a VM. Overkill indeed!
- bpye 5y agoMobile devices could, if the SOC allowed every device to be isolated with an IOMMU. Apple does this, Nvidia too (though some SoCs are broken) and I think Qualcomm might as well. A lot of the other ARM SoCs seem to have just one or maybe two domains (GPU and everything else), and a non standard IOMMU for even that too. I’ve looked a few times for an ARM SBC with a nice architecture to play with this stuff, Nvidia seemed to be the only option but they are also unobtanium right now.