Sawmill's dataspaces and the Hurd's physmem

[yuan Darwin-r62832]

Hi Neal,

	Thanks for your detailed information.

> Physical memory management needn't be an all or nothing deal. Certainly, an application might wish to completely 
> manage the paging policy and its address space layout, however, I tend to think that this is the exception.  And as 
> we will provide a POSIX personality, we need to have some sort of default VM manager.

About general VM manager, what I really mean is just the "default VM manager".  However, the question is still there: now that those sort of default VM managers provide mmap to those applications who don't want to manage their phsical memory, should they trust these VM managers?

If yes, these applications who use the Sawmill's framework should also trust DSMs, now that DSMs provide mapping to them, and DSMs will manage their own physical memory(implement their own replacement policy, they can even just use the library(LRU) provided by Hurd).

So, we can divide the applications into 2 categories: some of them wanna manage their physical memory, others won't. For the applications who do intend to do that, they just apply memory directly from Hurd's physmem server which is trustworthy; For others, they can  just use the Sawmill's framework. Note that these DSMs also apply memory from Hurd's physmem, instead of Sawmill physmem DSM. So we can just think these DSMs are just the applications who intend to manager their own physical memory.

My conclusion is, if Sawmill's framework has security problem on trust model, so has Hurd. So we have to assume that an application must trust its pager ( or pagers in Sawmill's model). Base on this assumption, Hurd & Sawmill's approach can live together.

> I see a number of problems with SawMill's dataspaces.  The root of this thread is the presentation of a potential security flaw 
> in the design of dataspaces.  (Whether this is important or not depends on the assumed trust model and security goals.)  
> Another is that as far as I can tell paging decisions are made towards the root of a dataspace hierarchy and not at the applications themselves.

As I said above, for those applications who don't want to manage their own physical memory, they don't need to make paging decision. For others, they just apply memory from Hurd's physmem server, and manage the memory by themselves, which means they can make the paging decision by themselves.

Correct me if I have any misunderstanding.

Thanks.
Darwin