Re: Device model operation hypercall (DMOP, re qemu depriv)

From: George Dunlap <george.dunlap@citrix.com>
To: Jan Beulich <JBeulich@suse.com>, Ian Jackson <ian.jackson@eu.citrix.com>
Cc: StefanoStabellini <sstabellini@kernel.org>,
	Wei Liu <wei.liu2@citrix.com>,
	Andrew Cooper <andrew.cooper3@citrix.com>,
	Tim Deegan <tim@xen.org>, David Vrabel <david.vrabel@citrix.com>,
	Anthony Perard <anthony.perard@citrix.com>,
	xen-devel <xen-devel@lists.xenproject.org>,
	dgdegra@tycho.nsa.gov
Subject: Re: Device model operation hypercall (DMOP, re qemu depriv)
Date: Fri, 12 Aug 2016 10:44:42 +0100	[thread overview]
Message-ID: <402d11bc-fc96-03f9-33f3-14f21dc56cd9@citrix.com> (raw)
In-Reply-To: <57A9DB0D02000078001042FE@prv-mh.provo.novell.com>

On 09/08/16 12:30, Jan Beulich wrote:
>>>> On 09.08.16 at 12:48, <ian.jackson@eu.citrix.com> wrote:
>> Jan Beulich writes ("Re: Device model operation hypercall (DMOP, re qemu 
>> depriv)"):
>>> Actually, having thought about this some more, and taking this
>>> together with the expectations to the privcmd driver previously
>>> outlined, I think this part is problematic: If all the driver is to know
>>> is the position (within the interface structure) of the target domain
>>> ID, then any guest handles embedded in the interface structure
>>> (XEN_HVMCTL_track_dirty_vram only for now) couldn't get
>>> validated, and hence user mode code would have a way to access
>>> or modify kernel memory.
>>
>> Could the hypervisor know the difference between user and kernel
>> memory, in principle ?
> 
> Not without further new hypercalls, as the guest kernel would need
> to tell Xen what address ranges are kernel vs user (and that implies
> that any OS wishing to be able to act as Dom0 has a uniform
> separation of address spaces).

Couldn't Xen tell from the guest pagetables whether the memory being
accessed was user-mode or kernel mode?

>> Alternatively, would it be possible for the ABI to specify somehow
>> what parameters are guest handles, so that the privcmd driver could
>> check them ?
> 
> We could presumably invent something, but I'm afraid it would end
> up quite ugly.
> 
>>  (Would it be sufficient to check the starts, or would
>> the ends need to be checked too?)
> 
> Both would need to be checked, so the size field(s) would need to
> be locatable too.

We could have the "fixed" part of the structure contain domid and an
array of <ptr, len> which the privcmd driver could check.  I don't think
that would be terrible.

Alternately, the "fixed" part of the hypercall could contain a
<start,end> range, which if non-zero, Xen should use to check any
pointer contained in the struct -- that would be more flexible probably.

Or we could do as Jan hints at above -- have some way to have dom0
communicate the kernel address range to Xen (either via hypercall, or
maybe via the shared info page) so that Xen just knows the address
layout for any individual domain.

And unless we're positive the guest kernel will never need these
hypercalls, we probably need a flag that allows kernel-mode pointers.

It's worth pointing out that the problem Xen has distinguishing
user/kernel mode pointers is the same even if we use the alternate
suggestion of per-process XSM labels.

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel