[Xen-devel] Clarification regarding Meltdown and 64-bit PV guests

[Andy Smith <andy@xxxxxxxxxxxxxx>]

Hi,

In
<https://blog.xenproject.org/2018/01/04/xen-project-spectremeltdown-faq/>:

    "On Intel processors, only 64-bit PV mode guests can attack Xen
    using Variant 3. Guests running in 32-bit PV mode, HVM mode, and
    PVH mode (both v1 and v2) cannot attack the hypervisor using
    Variant 3. However, in 32-bit PV mode, HVM mode, and PVH mode
    (both v1 and v2), guest userspaces can attack guest kernels
    using Variant 3; so updating guest kernels is advisable.

    Interestingly, guest kernels running in 64-bit PV mode are not
    vulnerable to attack using Variant 3, because 64-bit PV guests
    already run in a KPTI-like mode."

However, in multiple other places, including
<https://xenbits.xen.org/xsa/xsa254/README.comet> and
<https://xenbits.xen.org/xsa/xsa254/README.vixen>:

    "Note that both of these shim-based approaches prevent attacks on
    the host, but leave the guest vulnerable to Meltdown attacks by
    its own unprivileged processes; this is true even if the guest
    OS has KPTI or similar Meltdown mitigation."

These seem to contradict each other.

The FAQ seems to suggest that:

- 32-bit PV guest userland processes can use Variant 3 against their
  own kernels and that the KPTI patch would protect against that.

- Without Comet/Vixen, 64-bit PV guests can't use Variant 3 on
  themselves but can use it on the hypervisor, and KPTI patches in
  the guest do not prevent that.

- Running PV guests inside Comet or Vixen prevents them making use
  of Variant 3, they still cannot use Variant 3 against their own
  kernels, and KPTI patches in the guest are not necessary.

The Comet and Vixen READMEs seem to suggest that:

- Use of Comet/Vixen prevents PV guests from using Variant 3 against
  the hypervisor (and thus other guests as well).

- The guest itself remains able to use Variant 3 on its own kernel
  and KPTI patches inside the guest cannot prevent this.

Which is correct, or have I misunderstood and they are somehow both
correct?

Cheers,
Andy

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel