Re: [Xen-devel] Alternate p2m design specification

[Ed White <edmund.h.white@xxxxxxxxx>]

On 06/10/2015 04:09 PM, Andrew Cooper wrote:
> On 10/06/15 20:41, Ed White wrote:
>> On 06/10/2015 11:23 AM, Andrew Cooper wrote:
>>> On 10/06/15 01:09, Ed White wrote:
>>>> This document describes a new capability for VM Introspection, Security 
>>>> and Privacy in Xen. The new capability is called âaltp2mâ (short for 
>>>> Alternate p2m) that is used to provide the ability for Xen to host 
>>>> alternate guest physical memory domains for a specific guest-domain. This 
>>>> document describes the overall design specific to Xen for your review and 
>>>> feedback.
>>> This is a very thorough description, and everything here seems in order.
>>>
>>> A couple of remarks,
>>>
>>>> The altp2m functionality allows the capability to be used via an agent 
>>>> operating in an HVM guest or alternately an agent operating in a separate 
>>>> privileged domain. For cross domain operation, an XSM hook is defined such 
>>>> that the administrator can define a policy for inter-domain VM 
>>>> introspection.
>>> There should be an interlock to prevent both an internal and external
>>> entity from actually being able to use the altp2m infrastructure.
>>>
>>> Nothing good can come of an uncoordinated attempt like this, whereas a
>>> coordinated use would already have to be communicating far more than the
>>> hypercalls themselves would allow.
>>>
>> I have to disagree with you on that. Assuming we have the XSM hooks right,
>> you could enforce either/or through policy, but we have envisaged scenarios
>> where we would want to mix internal and external use of the hypercalls.
> 
> I suppose, as long as nothing bad can happen to Xen from mixed use, the
> worst that will happen is a very confused guest.
> 

No, nothing bad can happen to Xen.

The *only* difference between internal and external is how a violation is
reported. If the restriction was placed via an internal hypercall, an
attempt is made to report it internally, with the VM event mechanism
used as a fallback. Externally replaced restrictions always result in
VM event notifications.

It is possible to end up crashing the domain if there's no listener,
but that's existing VM event behaviour.

>>> Also, hardware accelerated altp2m is mutually exclusive with EPT PML, as
>>> we have no way of determining which translation was in use when a gpa
>>> was appended to the buffer.  We are going to have to maintain a feature
>>> compatibility matrix.  Even for non-accelerated altp2m, the cost of
>>> working out the real gpa is likely prohibitive, and we should probably
>>> resort to declaring logdirty and altp2m as exclusive features.
>>>
>>> ~Andrew
>>>
>> I haven't investigated the PML code, but just to be clear, log-dirty
>> without PML is compatible with altp2m.
> 
> The logdirty code is built around the notion of a single linear idea of
> a guests physical address space.  Altp2m, by its very nature, introduces
> non-linearities into a guests physical address space.
> 
> A reasonable compromise might be "the linear view offered by the host
> p2m" (which itself highlights one fact that the host p2m, if it isn't
> already, must at all times be a strict superset of anything contained in
> any nestp2m/altp2m).  However, you are still left with the problem of
> translating a guest physical address as viewed in one altp2m into the
> host p2m's view of the same mfn.  I suppose this is possible, given a
> reverse lookup in the host p2m, but performance would be unappealing.
> 
> As for PML, it is an unspecified length of time until the hardware PML
> buffer fills up and Xen comes to drain it into the logdirty bitmap.  The
> vcpu in question could have switched EPTs any number of times in the
> intervening period.  Xen therefore cannot even tell which altp2m an
> individual gpa was logged under.
> 

To be clear, I was not suggesting that PML might work -- I know it will not.

The reason log-dirty without PML works is that page state transitions are
always done in the host p2m, even when the vcpu is not using that p2m. After
the transition occurs in the host p2m, that change is propagated to any altp2m
that currently has a copy of that gfn mapping, and if the gfn->mfn mapping is
different in the altp2m the entire altp2m is invalidated -- at least that
will be the case by the time I submit a revised patch series.

That works well enough for the common log-dirty use case (VRAM change tracking)
to work.

For a use case where the tracking must be 100% accurate, migration for example,
I don't see any alternative to stating that altp2m mode must be off for the
target domain, at least in the Xen 4.6 time frame.

Ed


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel