Re: [Xen-devel] Clarification regarding Meltdown and 64-bit PV guests

[Andy Smith <andy@xxxxxxxxxxxxxx>]

Hi Hans,

On Sat, Jan 13, 2018 at 10:43:03AM +0100, Hans van Kranenburg wrote:
> By injecting a copy of a hypervisor between the outer level hypervisor
> (that's called L0 right?) (in HVM or PVH mode) and the guest, having it
> just run 1 guest, that (64-bit PV) guest cannot attack its own kernel,
> but it can attack the intermediate hypervisor which results in reading
> it's own memory from the fake intermediate "host memory".

So are you saying that, considering only SP3/Variant 3/Meltdown, it
works out like this:

== 64-bit PV mode guest ==

- Can't use SP3/Variant 3/Meltdown directly on its own kernel.

- Can use SP3/Variant 3/Meltdown on the hypervisor to read data from
  hypervisor so effectively everything including other kernels and
  its own kernel.

- Can't be mitigated by KPTI in the guest.

== PV-in-Comet and PV-in-Vixen ==

- Can't use SP3/Variant 3/Meltdown directly on its own kernel

- Can't use SP3/Variant 3/Meltdown on the real hypervisor.

- Can still use SP3/Variant 3/Meltdown on the shim hypervisor to
  still gain access to data from itself.

- Can't be mitigated by KPTI in the guest.

== HVM and PVHv2 ==

- Can use SP3/Variant 3/Meltdown directly on its own kernel.

- Can't use SP3/Variant 3/Meltdown on the hypervisor.

- Can be mitigated by KPTI in the guest (becomes not a Xen issue).

?

If so, then I can see how the FAQ, README.Comet and README.Vixen
can all be correct in this regard, but do note that this is
extremely confusing and a lot of people are only reading the
comments that say that Xen PV can't make use of SP3/Variant
3/Meltdown.

Cheers,
Andy

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel