[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] Clarification regarding Meltdown and 64-bit PV guests

  • To: xen-devel@xxxxxxxxxxxxxxxxxxxx
  • From: Andy Smith <andy@xxxxxxxxxxxxxx>
  • Date: Sat, 13 Jan 2018 06:42:23 +0000
  • Delivery-date: Sat, 13 Jan 2018 06:42:36 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
  • Openpgp: id=BF15490B; url=http://strugglers.net/~andy/pubkey.asc



    "On Intel processors, only 64-bit PV mode guests can attack Xen
    using Variant 3. Guests running in 32-bit PV mode, HVM mode, and
    PVH mode (both v1 and v2) cannot attack the hypervisor using
    Variant 3. However, in 32-bit PV mode, HVM mode, and PVH mode
    (both v1 and v2), guest userspaces can attack guest kernels
    using Variant 3; so updating guest kernels is advisable.

    Interestingly, guest kernels running in 64-bit PV mode are not
    vulnerable to attack using Variant 3, because 64-bit PV guests
    already run in a KPTI-like mode."

However, in multiple other places, including
<https://xenbits.xen.org/xsa/xsa254/README.comet> and

    "Note that both of these shim-based approaches prevent attacks on
    the host, but leave the guest vulnerable to Meltdown attacks by
    its own unprivileged processes; this is true even if the guest
    OS has KPTI or similar Meltdown mitigation."

These seem to contradict each other.

The FAQ seems to suggest that:

- 32-bit PV guest userland processes can use Variant 3 against their
  own kernels and that the KPTI patch would protect against that.

- Without Comet/Vixen, 64-bit PV guests can't use Variant 3 on
  themselves but can use it on the hypervisor, and KPTI patches in
  the guest do not prevent that.

- Running PV guests inside Comet or Vixen prevents them making use
  of Variant 3, they still cannot use Variant 3 against their own
  kernels, and KPTI patches in the guest are not necessary.

The Comet and Vixen READMEs seem to suggest that:

- Use of Comet/Vixen prevents PV guests from using Variant 3 against
  the hypervisor (and thus other guests as well).

- The guest itself remains able to use Variant 3 on its own kernel
  and KPTI patches inside the guest cannot prevent this.

Which is correct, or have I misunderstood and they are somehow both


Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.