[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] Clarification regarding Meltdown and 64-bit PV guests


  • To: Hans van Kranenburg <hans@xxxxxxxxxxx>
  • From: Andy Smith <andy@xxxxxxxxxxxxxx>
  • Date: Sat, 13 Jan 2018 10:08:50 +0000
  • Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx
  • Delivery-date: Sat, 13 Jan 2018 10:09:09 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
  • Openpgp: id=BF15490B; url=http://strugglers.net/~andy/pubkey.asc

Hi Hans,

On Sat, Jan 13, 2018 at 10:43:03AM +0100, Hans van Kranenburg wrote:
> By injecting a copy of a hypervisor between the outer level hypervisor
> (that's called L0 right?) (in HVM or PVH mode) and the guest, having it
> just run 1 guest, that (64-bit PV) guest cannot attack its own kernel,
> but it can attack the intermediate hypervisor which results in reading
> it's own memory from the fake intermediate "host memory".

So are you saying that, considering only SP3/Variant 3/Meltdown, it
works out like this:

== 64-bit PV mode guest ==

- Can't use SP3/Variant 3/Meltdown directly on its own kernel.

- Can use SP3/Variant 3/Meltdown on the hypervisor to read data from
  hypervisor so effectively everything including other kernels and
  its own kernel.

- Can't be mitigated by KPTI in the guest.

== PV-in-Comet and PV-in-Vixen ==

- Can't use SP3/Variant 3/Meltdown directly on its own kernel

- Can't use SP3/Variant 3/Meltdown on the real hypervisor.

- Can still use SP3/Variant 3/Meltdown on the shim hypervisor to
  still gain access to data from itself.

- Can't be mitigated by KPTI in the guest.

== HVM and PVHv2 ==

- Can use SP3/Variant 3/Meltdown directly on its own kernel.

- Can't use SP3/Variant 3/Meltdown on the hypervisor.

- Can be mitigated by KPTI in the guest (becomes not a Xen issue).

?

If so, then I can see how the FAQ, README.Comet and README.Vixen
can all be correct in this regard, but do note that this is
extremely confusing and a lot of people are only reading the
comments that say that Xen PV can't make use of SP3/Variant
3/Meltdown.

Cheers,
Andy

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.