mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Edwin Török
9284ae0c40
Introduce a limit on the number of outstanding reply packets in the xenbus queue. This limits the number of in-flight requests: when the output queue is full we'll stop processing inputs until the output queue has room again. To avoid a busy loop on the Unix socket we only add it to the watched input file descriptor set if we'd be able to call `input` on it. Even though Dom0 is trusted and exempt from quotas a flood of events might cause a backlog where events are produced faster than daemons in Dom0 can consume them, which could lead to an unbounded queue size and OOM. Therefore the xenbus queue limit must apply to all connections, Dom0 is not exempt from it, although if everything works correctly it will eventually catch up. This prevents a malicious guest from sending more commands while it has outstanding watch events or command replies in its input ring. However if it can cause the generation of watch events by other means (e.g. by Dom0, or another cooperative guest) and stop reading its own ring then watch events would've queued up without limit. The xenstore protocol doesn't have a back-pressure mechanism, and doesn't allow dropping watch events. In fact, dropping watch events is known to break some pieces of normal functionality. This leaves little choice to safely implement the xenstore protocol without exposing the xenstore daemon to out-of-memory attacks. Implement the fix as pipes with bounded buffers: * Use a bounded buffer for watch events * The watch structure will have a bounded receiving pipe of watch events * The source will have an "overflow" pipe of pending watch events it couldn't deliver Items are queued up on one end and are sent as far along the pipe as possible: source domain -> watch -> xenbus of target -> xenstore ring/socket of target If the pipe is "full" at any point then back-pressure is applied and we prevent more items from being queued up. For the source domain this means that we'll stop accepting new commands as long as its pipe buffer is not empty. Before we try to enqueue an item we first check whether it is possible to send it further down the pipe, by attempting to recursively flush the pipes. This ensures that we retain the order of events as much as possible. We might break causality of watch events if the target domain's queue is full and we need to start using the watch's queue. This is a breaking change in the xenstore protocol, but only for domains which are not processing their incoming ring as expected. When a watch is deleted its entire pending queue is dropped (no code is needed for that, because it is part of the 'watch' type). There is a cache of watches that have pending events that we attempt to flush at every cycle if possible. Introduce 3 limits here: * quota-maxwatchevents on watch event destination: when this is hit the source will not be allowed to queue up more watch events. * quota-maxoustanding which is the number of responses not read from the ring: once exceeded, no more inputs are processed until all outstanding replies are consumed by the client. * overflow queue on the watch event source: all watches that cannot be stored on destination are queued up here, a single command can trigger multiple watches (e.g. due to recursion). The overflow queue currently doesn't have an upper bound, it is difficult to accurately calculate one as it depends on whether you are Dom0 and how many watches each path has registered and how many watch events you can trigger with a single command (e.g. a commit). However these events were already using memory, this just moves them elsewhere, and as long as we correctly block a domain it shouldn't result in unbounded memory usage. Note that Dom0 is not excluded from these checks, it is important that Dom0 is especially not excluded when it is the source, since there are many ways in which a guest could trigger Dom0 to send it watch events. This should protect against malicious frontends as long as the backend follows the PV xenstore protocol and only exposes paths needed by the frontend, and changes those paths at most once as a reaction to guest events, or protocol state. The queue limits are per watch, and per domain-pair, so even if one communication channel would be "blocked", others would keep working, and the domain itself won't get blocked as long as it doesn't overflow the queue of watch events. Similarly a malicious backend could cause the frontend to get blocked, but this watch queue protects the frontend as well as long as it follows the PV protocol. (Although note that protection against malicious backends is only a best effort at the moment) This is part of XSA-326 / CVE-2022-42318. Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com>
###############################################
__ __ _ _ _ _____
\ \/ /___ _ __ | || | / |___ | _ __ ___
\ // _ \ '_ \ | || |_ | | / /____| '__/ __|
/ \ __/ | | | |__ _|| | / /_____| | | (__
/_/\_\___|_| |_| |_|(_)_|/_/ |_| \___|
###############################################
https://www.xen.org/
What is Xen?
============
Xen is a Virtual Machine Monitor (VMM) originally developed by the
Systems Research Group of the University of Cambridge Computer
Laboratory, as part of the UK-EPSRC funded XenoServers project. Xen
is freely-distributable Open Source software, released under the GNU
GPL. Since its initial public release, Xen has grown a large
development community, spearheaded by xen.org (https://www.xen.org).
This file contains some quick-start instructions to install Xen on
your system. For more information see https://www.xen.org/ and
https://wiki.xen.org/
Quick-Start Guide
=================
First, this is just a quick-start guide. For more comprehensive
information see the INSTALL file and the Xen wiki at
https://wiki.xenproject.org and in particular
https://wiki.xenproject.org/wiki/Getting_Started.
Second, there are a number of prerequisites for building a Xen source
release. Make sure you have all the following installed, either by
visiting the project webpage or installing a pre-built package
provided by your OS distributor:
* GNU Make v3.80 or later
* C compiler and linker:
- For x86:
- GCC 4.1.2_20070115 or later
- GNU Binutils 2.16.91.0.5 or later
or
- Clang/LLVM 3.5 or later
- For ARM 32-bit:
- GCC 4.9 or later
- GNU Binutils 2.24 or later
- For ARM 64-bit:
- GCC 5.1 or later
- GNU Binutils 2.24 or later
* POSIX compatible awk
* Development install of zlib (e.g., zlib-dev)
* Development install of Python 2.6 or later (e.g., python-dev)
* Development install of curses (e.g., libncurses-dev)
* Development install of openssl (e.g., openssl-dev)
* Development install of x11 (e.g. xorg-x11-dev)
* Development install of uuid (e.g. uuid-dev)
* Development install of yajl (e.g. libyajl-dev)
* Development install of libaio (e.g. libaio-dev) version 0.3.107 or
greater.
* Development install of GLib v2.0 (e.g. libglib2.0-dev)
* Development install of Pixman (e.g. libpixman-1-dev)
* pkg-config
* bridge-utils package (/sbin/brctl)
* iproute package (/sbin/ip)
* GNU bison and GNU flex
* ACPI ASL compiler (iasl)
In addition to the above there are a number of optional build
prerequisites. Omitting these will cause the related features to be
disabled at compile time:
* Binary-search capable grep (if building Xen with CET support)
* Development install of Ocaml (e.g. ocaml-nox and
ocaml-findlib). Required to build ocaml components which
includes the alternative ocaml xenstored.
* cmake (if building vtpm stub domains)
* pandoc, transfig, pod2{man,html,text} for rendering various pieces of
documentation into alternative formats
* figlet (for generating the traditional Xen start of day banner)
* systemd daemon development files
* Development install of libnl3 (e.g., libnl-3-200,
libnl-3-dev, etc). Required if network buffering is desired
when using Remus with libxl. See docs/README.remus for detailed
information.
* 16-bit x86 assembler, loader and compiler for qemu-traditional / rombios
(dev86 rpm or bin86 & bcc debs)
* Development install of liblzma for rombios
* Development install of libbz2, liblzma, liblzo2, and libzstd for DomU
kernel decompression.
Second, you need to acquire a suitable kernel for use in domain 0. If
possible you should use a kernel provided by your OS distributor. If
no suitable kernel is available from your OS distributor then refer to
https://wiki.xen.org/wiki/XenDom0Kernels for suggestions for
suitable kernels to use.
If you are looking to compile a Dom0 kernel from source, please refer to
https://wiki.xen.org/wiki/XenParavirtOps.
[NB. Unless noted otherwise, all the following steps should be
performed with root privileges.]
1. Download and untar the source tarball file. This will be a
file named xen-unstable-src.tgz, or xen-$version-src.tgz.
You can also pull the current version from the git or mercurial
repositories at https://xenbits.xen.org/
# tar xzf xen-unstable-src.tgz
Assuming you are using the unstable tree, this will
untar into xen-unstable. The rest of the instructions
use the unstable tree as an example, substitute the
version for unstable.
2. cd to xen-unstable (or whatever you sensibly rename it to).
3. For the very first build, or if you want to destroy build trees,
perform the following steps:
# ./configure
# make world
# make install
See the documentation in the INSTALL file for more info.
This will create and install onto the local machine. It will build
the xen binary (xen.gz), the tools and the documentation.
You can override the destination for make install by setting DESTDIR
to some value.
4. To rebuild an existing tree without modifying the config:
# make dist
This will build and install xen, tools, and docs into the local dist/
directory.
You can override the destination for make install by setting DISTDIR
to some value.
make install and make dist differ in that make install does the
right things for your local machine (installing the appropriate
version of udev scripts, for example), but make dist includes all
versions of those scripts, so that you can copy the dist directory
to another machine and install from that distribution.
xenstore: xenstored and oxenstored
====================================
Xen uses a configuration database called xenstore [0] to maintain configuration
and status information shared between domains. A daemon is implemented as part
of xenstore to act as an interface for access to the database for dom0 and
guests. Two xenstored daemons are supported, one written in C which we refer
to as the xenstored (sometimes referred to as cxenstored), and another written
in Ocaml called oxenstored. Details for xenstore and the different
implementations can be found on the wiki's xenstore reference guide [1] and
the xenstored [2] page. You can choose which xenstore you want to enable as
default on a system through configure:
./configure --with-xenstored=xenstored
./configure --with-xenstored=oxenstored
By default oxenstored will be used if the ocaml development tools are found.
If you enable oxenstored the xenstored will still be built and installed,
the xenstored used can be changed through the configuration file:
/etc/sysconfig/xencommons
or
/etc/default/xencommons
You can change the preferred xenstored you want to use in the configuration
but since we cannot stop the daemon a reboot will be required to make the
change take effect.
[0] https://wiki.xen.org/wiki/XenStore
[1] https://wiki.xen.org/wiki/XenStoreReference
[2] https://wiki.xen.org/wiki/Xenstored
Python Runtime Libraries
========================
Various tools, such as pygrub, have the following runtime dependencies:
* Python 2.6 or later.
URL: http://www.python.org/
Debian: python
Note that the build system expects `python` to be available. If your system
only has `python2` or `python3` but not `python` (as in Linux From Scratch),
you will need to create a symlink for it, or specify PYTHON= when invoking
make, like (note the position of PYTHON= matters):
# make PYTHON=/usr/bin/python3
Intel(R) Trusted Execution Technology Support
=============================================
Intel's technology for safer computing, Intel(R) Trusted Execution Technology
(Intel(R) TXT), defines platform-level enhancements that provide the building
blocks for creating trusted platforms. For more information, see
http://www.intel.com/technology/security/.
Intel(R) TXT support is provided by the Trusted Boot (tboot) module in
conjunction with minimal logic in the Xen hypervisor.
Tboot is an open source, pre- kernel/VMM module that uses Intel(R) TXT to
perform a measured and verified launch of an OS kernel/VMM.
The Trusted Boot module is available from
http://sourceforge.net/projects/tboot. This project hosts the code in a
mercurial repo at http://tboot.sourceforge.net/hg/tboot.hg and contains
tarballs of the source. Instructions in the tboot README describe how
to modify grub.conf to use tboot to launch Xen.