From: Andrew Cooper <andrew.cooper3@citrix.com>
To: Jan Beulich <JBeulich@suse.com>
Cc: kevin.tian@intel.com, wei.liu2@citrix.com,
ian.campbell@citrix.com, stefano.stabellini@eu.citrix.com,
Ian Jackson <Ian.Jackson@eu.citrix.com>,
xen-devel@lists.xen.org, Paul.Durrant@citrix.com,
Zhang Yu <yu.c.zhang@linux.intel.com>,
zhiyuan.lv@intel.com, keir@xen.org
Subject: Re: [PATCH v3 3/3] tools: introduce parameter max_wp_ram_ranges.
Date: Tue, 2 Feb 2016 14:20:41 +0000 [thread overview]
Message-ID: <56B0BB39.2020803@citrix.com> (raw)
In-Reply-To: <56B0A45702000078000CD719@prv-mh.provo.novell.com>
On 02/02/16 11:43, Jan Beulich wrote:
>>>> On 02.02.16 at 12:31, <andrew.cooper3@citrix.com> wrote:
>> This specific issue concerns resource allocation during domain building
>> and is an area which can never ever be given to a less privileged entity.
> Which is because of ...? (And if so, why would we have put
> XEN_DOMCTL_createdomain on the XSA-77 waiver list?)
That list came out of the blue as far as the Xen community went.
The purpose of XEN_DOMCTL_createdomain is to mutate the set of valid
identifiers in Xen on which XSM permissions are based, and any entity
capable of making the hypercall can at the very least cause reuse of an
existing identifier.
For a different example, take XEN_DOMCTL_gdbsx_guestmemio. This
hypercall specifically permits the caller to change arbitrary memory,
including that of the Xen itself.
Neither of these two operations will ever be safe in the hands of
anything but a fully privileged entity. Pretending otherwise isn't
going to change this fact.
~Andrew
next prev parent reply other threads:[~2016-02-02 14:20 UTC|newest]
Thread overview: 109+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-29 10:45 [PATCH v12 0/3] Refactor ioreq server for better performance Yu Zhang
2016-01-29 10:45 ` [PATCH v12 1/3] Refactor rangeset structure " Yu Zhang
2016-01-29 10:45 ` [PATCH v12 2/3] Differentiate IO/mem resources tracked by ioreq server Yu Zhang
2016-01-29 10:45 ` [PATCH v3 3/3] tools: introduce parameter max_wp_ram_ranges Yu Zhang
2016-01-29 16:33 ` Jan Beulich
2016-01-30 14:38 ` Yu, Zhang
2016-02-01 7:52 ` Jan Beulich
2016-02-01 12:02 ` Wei Liu
2016-02-01 12:15 ` Jan Beulich
2016-02-01 12:49 ` Wei Liu
2016-02-01 13:07 ` Jan Beulich
2016-02-01 15:14 ` Yu, Zhang
2016-02-01 16:16 ` Jan Beulich
2016-02-01 16:33 ` Yu, Zhang
2016-02-01 16:19 ` Yu, Zhang
2016-02-01 16:35 ` Jan Beulich
2016-02-01 16:37 ` Yu, Zhang
2016-02-01 17:05 ` Ian Jackson
2016-02-02 8:04 ` Yu, Zhang
2016-02-02 11:51 ` Wei Liu
2016-02-02 13:56 ` Yu, Zhang
2016-02-02 10:32 ` Jan Beulich
2016-02-02 10:56 ` Yu, Zhang
2016-02-02 11:12 ` Jan Beulich
2016-02-02 14:01 ` Yu, Zhang
2016-02-02 14:42 ` Jan Beulich
2016-02-02 15:00 ` Yu, Zhang
2016-02-02 15:21 ` Jan Beulich
2016-02-02 15:19 ` Yu, Zhang
2016-02-03 7:10 ` Yu, Zhang
2016-02-03 8:32 ` Jan Beulich
2016-02-03 12:20 ` Paul Durrant
2016-02-03 12:35 ` Jan Beulich
2016-02-03 12:50 ` Paul Durrant
2016-02-03 13:00 ` Jan Beulich
2016-02-03 13:07 ` Paul Durrant
2016-02-03 13:17 ` Jan Beulich
2016-02-03 13:18 ` Paul Durrant
2016-02-03 14:43 ` Ian Jackson
2016-02-03 15:10 ` Paul Durrant
2016-02-03 17:50 ` George Dunlap
2016-02-04 8:50 ` Yu, Zhang
2016-02-03 17:41 ` George Dunlap
2016-02-03 18:21 ` George Dunlap
2016-02-03 18:26 ` George Dunlap
2016-02-03 18:39 ` Andrew Cooper
2016-02-03 19:12 ` George Dunlap
2016-02-04 8:51 ` Yu, Zhang
2016-02-04 10:49 ` George Dunlap
2016-02-04 11:08 ` Ian Campbell
2016-02-04 11:19 ` Ian Campbell
2016-02-04 8:50 ` Yu, Zhang
2016-02-04 9:28 ` Paul Durrant
2016-02-04 9:38 ` Yu, Zhang
2016-02-04 9:49 ` Paul Durrant
2016-02-04 10:34 ` Jan Beulich
2016-02-04 13:33 ` Ian Jackson
2016-02-04 13:47 ` Paul Durrant
2016-02-04 14:12 ` Jan Beulich
2016-02-04 14:25 ` Paul Durrant
2016-02-04 15:06 ` Ian Jackson
2016-02-04 15:51 ` Paul Durrant
2016-02-05 3:47 ` Tian, Kevin
2016-02-05 3:35 ` Tian, Kevin
2016-02-04 14:08 ` Jan Beulich
2016-02-04 17:12 ` George Dunlap
2016-02-05 4:18 ` Tian, Kevin
2016-02-05 8:41 ` Yu, Zhang
2016-02-05 8:32 ` Jan Beulich
2016-02-05 9:24 ` Paul Durrant
2016-02-05 10:41 ` Jan Beulich
2016-02-05 11:14 ` George Dunlap
2016-02-05 11:24 ` Paul Durrant
2016-02-16 7:22 ` Tian, Kevin
2016-02-16 8:50 ` Paul Durrant
2016-02-16 10:33 ` Jan Beulich
2016-02-16 11:11 ` Paul Durrant
2016-02-17 3:18 ` Tian, Kevin
2016-02-17 8:58 ` Paul Durrant
2016-02-17 9:32 ` Jan Beulich
2016-02-17 9:58 ` Tian, Kevin
2016-02-17 10:03 ` Paul Durrant
2016-02-17 10:22 ` Jan Beulich
2016-02-17 10:24 ` Paul Durrant
2016-02-17 10:25 ` Tian, Kevin
2016-02-17 11:01 ` George Dunlap
2016-02-17 11:12 ` Paul Durrant
2016-02-22 15:56 ` George Dunlap
2016-02-22 16:02 ` Paul Durrant
2016-02-22 16:45 ` George Dunlap
2016-02-22 17:01 ` Paul Durrant
2016-02-22 17:23 ` George Dunlap
2016-02-22 17:34 ` Paul Durrant
2016-02-05 8:41 ` Yu, Zhang
2016-02-04 11:06 ` George Dunlap
2016-02-05 2:01 ` Zhiyuan Lv
2016-02-05 3:44 ` Tian, Kevin
2016-02-05 8:38 ` Jan Beulich
2016-02-05 11:05 ` George Dunlap
2016-02-05 15:13 ` Zhiyuan Lv
2016-02-05 20:14 ` George Dunlap
2016-02-05 8:40 ` Yu, Zhang
2016-02-04 10:06 ` Ian Campbell
2016-02-05 3:31 ` Tian, Kevin
2016-02-02 11:31 ` Andrew Cooper
2016-02-02 11:43 ` Jan Beulich
2016-02-02 14:20 ` Andrew Cooper [this message]
2016-02-01 11:57 ` Wei Liu
2016-02-01 15:15 ` Yu, Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56B0BB39.2020803@citrix.com \
--to=andrew.cooper3@citrix.com \
--cc=Ian.Jackson@eu.citrix.com \
--cc=JBeulich@suse.com \
--cc=Paul.Durrant@citrix.com \
--cc=ian.campbell@citrix.com \
--cc=keir@xen.org \
--cc=kevin.tian@intel.com \
--cc=stefano.stabellini@eu.citrix.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xen.org \
--cc=yu.c.zhang@linux.intel.com \
--cc=zhiyuan.lv@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).