Re: [Xen-devel] [PATCH 13/25] argo: implement the register op

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

On 1/9/19 6:34 PM, Roger Pau Monné wrote:
> > > > > Maybe this is use-case is different, but how does introspection handle
> > > > > accesses to the shared info page or the runstate info for example?
> > > > >
> > > > > I would consider argo to be the same in this regard.
> > > > Not exactly: The shared info page is special in any event. For
> > > > runstate info (and alike - there's also struct vcpu_time_info)
> > > > I'd question correctness of the current handling. If that's
> > > > wrong already, I'd prefer if the issue wasn't spread.
> > > There are also grants, which when used together with another guest on
> > > the same host could allow to bypass introspection AFAICT? (unless
> > > there's some policy applied that limit grant sharing to trusted
> > > domains)
> > >
> > > TBH I'm not sure how to handle hypoervisor accesses with
> > > introspection.  My knowledge of introspection is fairly limited, but
> > > it pauses the guest and sends a notification to an in guest agent. I'm
> > > not sure this is applicable to hypervisor writes, since it's not
> > > possible to pause hypervisor execution and wait for a response from a
> > > guest agent.
> > Introspection applications only care about memory accesses performed
> > by the guest. Hypervisor accesses to monitored pages are not included
> > when monitoring - it is actually a feature when using the emulator in
> > Xen to continue guest execution because the hypervisor ignores EPT
> > memory permissions that trip the guest for introspection. So having
> > the hypervisor access memory or a grant-shared page being accessed in
> > another domain are not a problem for introspection.
> Can't then two guests running on the same host be able to completely
> bypass introspection? I guess you prevent this by limiting to which
> guests pages can be shared?
Would these two guests be HVM guests? Introspection only works for HVM 
guests. I'm not sure I follow your scenario though. How would these 
guests collaborate to escape introspection via grants?
> If that's the case, and introspection doesn't care about hypervisor
> accesses to guest pages, then just getting a reference to the
> underlying page when the ring is setup should be enough. There's no
> need to check the gfn -> mfn relation every time there's an hypervisor
> access to the ring.
I think so, but I might be missing something.


Thanks,
Razvan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel