Re: [Xen-devel] [PATCH] common/gnttab: Introduce command line feature controls

[Juergen Gross <jgross@xxxxxxxx>]

On 25/08/17 18:21, George Dunlap wrote:
> On 08/25/2017 01:31 PM, Jan Beulich wrote:
>>>>> On 25.08.17 at 14:10, <andrew.cooper3@xxxxxxxxxx> wrote:
>>> On 25/08/17 10:57, Jan Beulich wrote:
>>>>>>> On 24.08.17 at 17:16, <andrew.cooper3@xxxxxxxxxx> wrote:
>>>>> On 24/08/17 16:01, Juergen Gross wrote:
>>>>>> On 24/08/17 16:50, Andrew Cooper wrote:
>>>>>>> --- a/docs/misc/xen-command-line.markdown
>>>>>>> +++ b/docs/misc/xen-command-line.markdown
>>>>>>> @@ -868,6 +868,19 @@ Controls EPT related features.
>>>>>>>  
>>>>>>>  Specify which console gdbstub should use. See **console**.
>>>>>>>  
>>>>>>> +### gnttab
>>>>>>> +> `= List of [ max_ver:<integer>, transitive ]`
>>>>>>> +
>>>>>>> +> Default: `gnttab=max_ver:2,transitive`
>>>>>>> +
>>>>>>> +Control various aspects of the grant table behaviour available to 
>>>>>>> guests.
>>>>>>> +
>>>>>>> +* `max_ver` Select the maximum grant table version to offer to guests. 
>>>>>>>  Valid
>>>>>>> +version are 1 and 2.
>>>>>>> +* `transitive` Permit or disallow the use of transitive grants.  Note 
>>>>>>> that the
>>>>>>> +use of grant table v2 without transitive grants is an ABI breakage 
>>>>>>> from the
>>>>>>> +guests point of view.
>>>>>> So shouldn't there be a way for the guest to query the support of
>>>>>> transient grants?
>>>>> Ideally yes, but how do you suggest doing this in a compatible way?
>>>>>
>>>>> All Xen downstreams which haven't backported the eventual transitive
>>>>> fixes will have this clobber in place, without any query-ability.
>>>> That workaround should not be used as an argument to not
>>>> provide a way to query the capability. It was put in place knowing
>>>> that it would cause problems for (hypothetical) guests using
>>>> transitive grants.
>>>
>>> I am not objecting to introducing a mechanism if a suitable one can be
>>> found.
>>>
>>> However, the heritage of XSA-226 is a valid reason to not block this
>>> patch because a mechanism isn't present.
>>
>> Code submission deadline for 4.10 isn't very far away; we shouldn't
>> ship a major version with a partial workaround.
> 
> I'd say we shouldn't ship a major version with a risky, unused feature
> on by default.

You are aware that this "unused feature" is part of the public interface
since about 8 years or so?


Juergen

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel