From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161232AbcFMMW4 (ORCPT ); Mon, 13 Jun 2016 08:22:56 -0400 Received: from smtp.ctxuk.citrix.com ([185.25.65.24]:35396 "EHLO SMTP.EU.CITRIX.COM" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1161084AbcFMMWz (ORCPT ); Mon, 13 Jun 2016 08:22:55 -0400 X-IronPort-AV: E=Sophos;i="5.26,466,1459814400"; d="scan'208";a="23985102" From: Paul Durrant To: Julien Grall , David Vrabel , "boris.ostrovsky@oracle.com" , "jgross@suse.com" , "sstabellini@kernel.org" , "konrad.wilk@oracle.com" CC: Andrew Cooper , "steve.capper@arm.com" , "linux-kernel@vger.kernel.org" , "JBeulich@suse.com" , "xen-devel@lists.xen.org" Subject: RE: [Xen-devel] [PATCH] xen: grant-table: Check truncation when giving access to a frame Thread-Topic: [Xen-devel] [PATCH] xen: grant-table: Check truncation when giving access to a frame Thread-Index: AQHRxWJ9PoACkRMRP0SxkMjfDgiWBp/nG/iAgAAzy/A= Date: Mon, 13 Jun 2016 12:20:32 +0000 Message-ID: References: <1465815046-5390-1-git-send-email-julien.grall@arm.com> <575E9198.70103@citrix.com> <575E948B.7060507@arm.com> In-Reply-To: <575E948B.7060507@arm.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 X-DLP: AMS1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id u5DCN0xf007475 > -----Original Message----- > From: Xen-devel [mailto:xen-devel-bounces@lists.xen.org] On Behalf Of > Julien Grall > Sent: 13 June 2016 12:10 > To: David Vrabel; boris.ostrovsky@oracle.com; jgross@suse.com; > sstabellini@kernel.org; konrad.wilk@oracle.com > Cc: Andrew Cooper; steve.capper@arm.com; linux-kernel@vger.kernel.org; > JBeulich@suse.com; xen-devel@lists.xen.org > Subject: Re: [Xen-devel] [PATCH] xen: grant-table: Check truncation when > giving access to a frame > > Hi David, > > On 13/06/16 11:57, David Vrabel wrote: > > On 13/06/16 11:50, Julien Grall wrote: > >> The version 1 of the grant-table protocol only supports frame encoded on > >> 32-bit. > >> > >> When the platform is supporting 48-bit physical address, the frame will > >> be encoded on 36-bit which will lead a truncation and give access to > >> the wrong frame. > >> > >> On ARM Xen will always allow the guest to use all the physical address, > >> although today the RAM is always located under 40-bits (see > >> xen/include/public/arch-arm.h). > >> > >> Add a truncation check in gnttab_update_entry_v1 to prevent the guest > to > >> give access to the wrong frame. > > > > In hindsight, we shouldn't have dropped the V2 support from Linux. > > Should we reinstate it? > > What were the reasons to drop the v2 support from Linux? More > importantly why people did choose to stay on v1? > One of the main reasons for v2's existence was to support a version of the netif protocol that pushed guest receive-side copy into the guest itself. This was done by granting pages from dom0, or from other guests, to the guest performing the copy. To do this securely a couple of things were needed: - The ability to have (copy only) sub-page grants. - The ability to transitively grant a ref from one domain to another. Unfortunately the idea did not scale as it became bottle-necked on dom0's grant table size, and there were some nasty corner cases to work around (which is why we also have a swap-grant-ref hypercall). In the end, guest copy was dropped and then there was really no need to use grant table v2. Using version 1 is simpler, and gives you more grant entries per page of table, so everyone stuck with that. Paul > Cheers, > > -- > Julien Grall > > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xen.org > http://lists.xen.org/xen-devel