Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1731155 > unrolled thread

Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version Andrew Cooper <andrew.cooper3@citrix.com> - 2017-09-12 21:00 +0200
    Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version Juergen Gross <jgross@suse.com> - 2017-09-13 11:30 +0200
      Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version Juergen Gross <jgross@suse.com> - 2017-09-15 15:10 +0200
        Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version Juergen Gross <jgross@suse.com> - 2017-09-15 15:30 +0200
        Re: [Xen-devel] [PATCH 4/4] xen: select grant interface  version "Jan Beulich" <JBeulich@suse.com> - 2017-09-15 15:30 +0200

#1731155 — Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version

On 08/09/17 15:48, Juergen Gross wrote:
>  static void gnttab_request_version(void)
>  {
> -	int rc;
> +	long rc;
>  	struct gnttab_set_version gsv;
>  
> -	gsv.version = 1;
> +	rc = HYPERVISOR_memory_op(XENMEM_maximum_ram_page, NULL);

This hypercall is information leak and layering violation.  Please can
we avoid adding more dependence on its presence?  (I'm got a
proto-series which strips various corners off the hypervisor for attack
surface reduction purposes, and this hypercall is one victim which is
restricted to privileged domains only.)

For translated guests, it is definitely not the right number to check. 
What matters is the maximum frame inside the translated guest, not on
the host.

For PV guests, I'm not sure what to suggest, but the result of
XENMEM_maximum_ram_page isn't applicable.  Xen's max_page can increase
at runtime through memory hotplug, after which ballooning operations can
leave Linux with a frame it wishes to grant which exceeds the limit
calculated here.

The more I look into this, the more of a mess it turns out to be.

~Andrew

> +	if (rc < 0 || !(rc >> 32))
> +		gsv.version = 1;
> +	else
> +		gsv.version = 2;
> +	if (xen_gnttab_version >= 1 && xen_gnttab_version <= 2)
> +		gsv.version = xen_gnttab_version;
>  
>  	rc = HYPERVISOR_grant_table_op(GNTTABOP_set_version, &gsv, 1);
>  	if (rc == 0 && gsv.version == 2)

[toc] | [next] | [standalone]

#1731504

On 12/09/17 20:54, Andrew Cooper wrote:
> On 08/09/17 15:48, Juergen Gross wrote:
>>  static void gnttab_request_version(void)
>>  {
>> -	int rc;
>> +	long rc;
>>  	struct gnttab_set_version gsv;
>>  
>> -	gsv.version = 1;
>> +	rc = HYPERVISOR_memory_op(XENMEM_maximum_ram_page, NULL);
> 
> This hypercall is information leak and layering violation.  Please can
> we avoid adding more dependence on its presence?  (I'm got a
> proto-series which strips various corners off the hypervisor for attack
> surface reduction purposes, and this hypercall is one victim which is
> restricted to privileged domains only.)
> 
> For translated guests, it is definitely not the right number to check. 
> What matters is the maximum frame inside the translated guest, not on
> the host.

Oh, right.

> For PV guests, I'm not sure what to suggest, but the result of
> XENMEM_maximum_ram_page isn't applicable.  Xen's max_page can increase
> at runtime through memory hotplug, after which ballooning operations can
> leave Linux with a frame it wishes to grant which exceeds the limit
> calculated here.

We need a way to decide whether V2 is to be selected.

Is there a way to determine which is the highest physical address being
available for memory hotplug on a system? Something in ACPI tables
perhaps?


Juergen

[toc] | [prev] | [next] | [standalone]

#1732875

On 13/09/17 11:23, Juergen Gross wrote:
> On 12/09/17 20:54, Andrew Cooper wrote:
>> On 08/09/17 15:48, Juergen Gross wrote:
>>>  static void gnttab_request_version(void)
>>>  {
>>> -	int rc;
>>> +	long rc;
>>>  	struct gnttab_set_version gsv;
>>>  
>>> -	gsv.version = 1;
>>> +	rc = HYPERVISOR_memory_op(XENMEM_maximum_ram_page, NULL);
>>
>> This hypercall is information leak and layering violation.  Please can
>> we avoid adding more dependence on its presence?  (I'm got a
>> proto-series which strips various corners off the hypervisor for attack
>> surface reduction purposes, and this hypercall is one victim which is
>> restricted to privileged domains only.)
>>
>> For translated guests, it is definitely not the right number to check. 
>> What matters is the maximum frame inside the translated guest, not on
>> the host.
> 
> Oh, right.
> 
>> For PV guests, I'm not sure what to suggest, but the result of
>> XENMEM_maximum_ram_page isn't applicable.  Xen's max_page can increase
>> at runtime through memory hotplug, after which ballooning operations can
>> leave Linux with a frame it wishes to grant which exceeds the limit
>> calculated here.
> 
> We need a way to decide whether V2 is to be selected.
> 
> Is there a way to determine which is the highest physical address being
> available for memory hotplug on a system? Something in ACPI tables
> perhaps?

So I've found the data I've searched in the hypervisor. The maximum
frame number to expect can be calculated from max_page, mem_hotplug
and the maximum physical address from cpuid node 0x80000008. If
CONFIG_BIGMEM isn't defined in Xen it is 16TB max.

The question is how to present this value to a guest. IMHO something
like the maximum address width similar to cpuid node 0x80000008
would be fine. It could be above width for pv guests and the max.
memory address of the guest for HVM guests (adding a cap for those
wouldn't be the worst idea, I guess).

What about a new subop of the xen_version hypercall?


Juergen

[toc] | [prev] | [next] | [standalone]

#1732880

On 15/09/17 15:21, Jan Beulich wrote:
>>>> On 15.09.17 at 15:00, <jgross@suse.com> wrote:
>> So I've found the data I've searched in the hypervisor. The maximum
>> frame number to expect can be calculated from max_page, mem_hotplug
>> and the maximum physical address from cpuid node 0x80000008. If
>> CONFIG_BIGMEM isn't defined in Xen it is 16TB max.
>>
>> The question is how to present this value to a guest. IMHO something
>> like the maximum address width similar to cpuid node 0x80000008
>> would be fine. It could be above width for pv guests and the max.
>> memory address of the guest for HVM guests (adding a cap for those
>> wouldn't be the worst idea, I guess).
>>
>> What about a new subop of the xen_version hypercall?
> 
> I don't see how that would be a good fit; instead, with the CPUID
> similarity you mention, why not provide the information in one of
> Xen's CPUID leaves? Otoh I wonder whether returning max_page
> from XENMEM_maximum_ram_page is really a good idea, if later
> on that value may increase, so perhaps that op should take
> mem_hotplug into account.

I think Andrew had concerns with the exact value being returned via
XENMEM_maximum_ram_page. Using a Xen CPUID leaf returning just the
number of address bits would be a better fit, I guess.


Juergen

[toc] | [prev] | [next] | [standalone]

#1732882 — Re: [Xen-devel] [PATCH 4/4] xen: select grant interface version

>>> On 15.09.17 at 15:00, <jgross@suse.com> wrote:
> So I've found the data I've searched in the hypervisor. The maximum
> frame number to expect can be calculated from max_page, mem_hotplug
> and the maximum physical address from cpuid node 0x80000008. If
> CONFIG_BIGMEM isn't defined in Xen it is 16TB max.
> 
> The question is how to present this value to a guest. IMHO something
> like the maximum address width similar to cpuid node 0x80000008
> would be fine. It could be above width for pv guests and the max.
> memory address of the guest for HVM guests (adding a cap for those
> wouldn't be the worst idea, I guess).
> 
> What about a new subop of the xen_version hypercall?

I don't see how that would be a good fit; instead, with the CPUID
similarity you mention, why not provide the information in one of
Xen's CPUID leaves? Otoh I wonder whether returning max_page
from XENMEM_maximum_ram_page is really a good idea, if later
on that value may increase, so perhaps that op should take
mem_hotplug into account.

Jan

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web