linux-kernel - RE: [PATCH 4/4] x86: properly handle kvm emulation of hyperv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 24 Jul 2013 19:05:19 +0000
From:	KY Srinivasan <kys@...rosoft.com>
To:	"H. Peter Anvin" <hpa@...or.com>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Jason Wang <jasowang@...hat.com>
CC:	"tglx@...utronix.de" <tglx@...utronix.de>,
	"mingo@...hat.com" <mingo@...hat.com>,
	"x86@...nel.org" <x86@...nel.org>,
	"gleb@...hat.com" <gleb@...hat.com>,
	"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 4/4] x86: properly handle kvm emulation of hyperv



> -----Original Message-----
> From: H. Peter Anvin [mailto:hpa@...or.com]
> Sent: Wednesday, July 24, 2013 11:14 AM
> To: KY Srinivasan; Paolo Bonzini; Jason Wang
> Cc: tglx@...utronix.de; mingo@...hat.com; x86@...nel.org; gleb@...hat.com;
> kvm@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: RE: [PATCH 4/4] x86: properly handle kvm emulation of hyperv
> 
> I don't see how this solves the A emulates B, B emulates A problem?

As Paolo suggested if there were some priority encoded, the guest could make an
informed decision. If the guest under question can run on both hypervisors A and B,
we would rather the guest discover hypervisor A when running on A and hypervisor B
when running on B. The priority encoding could be as simple as surfacing the native hypervisor
signature earlier in the CPUID space.

K. Y
> 
> KY Srinivasan <kys@...rosoft.com> wrote:
> >
> >
> >> -----Original Message-----
> >> From: Paolo Bonzini [mailto:paolo.bonzini@...il.com] On Behalf Of
> >Paolo
> >> Bonzini
> >> Sent: Wednesday, July 24, 2013 3:07 AM
> >> To: Jason Wang
> >> Cc: H. Peter Anvin; KY Srinivasan; tglx@...utronix.de;
> >mingo@...hat.com;
> >> x86@...nel.org; gleb@...hat.com; kvm@...r.kernel.org; linux-
> >> kernel@...r.kernel.org
> >> Subject: Re: [PATCH 4/4] x86: properly handle kvm emulation of hyperv
> >>
> >> Il 24/07/2013 08:54, Jason Wang ha scritto:
> >> > On 07/24/2013 12:48 PM, H. Peter Anvin wrote:
> >> >> On 07/23/2013 09:37 PM, Jason Wang wrote:
> >> >>> On 07/23/2013 10:48 PM, H. Peter Anvin wrote:
> >> >>>> On 07/23/2013 06:55 AM, KY Srinivasan wrote:
> >> >>>>> This strategy of hypervisor detection based on some detection
> >order
> >> IMHO is not
> >> >>>>> a robust detection strategy. The current scheme works since the
> >only
> >> hypervisor emulated
> >> >>>>> (by other hypervisors happens to be Hyper-V). What if this were
> >to
> >> change.
> >> >>>>>
> >> >>>> One strategy would be to pick the *last* one in the CPUID list,
> >since
> >> >>>> the ones before it are logically the one(s) being emulated...
> >> >>>>
> >> >>>> 	-hpa
> >> >>>>
> >> >>> How about simply does a reverse loop from 0x40010000 to
> >0x40010000?
> >> >>>
> >> >> Not all systems like being poked too far into hyperspace.  Just
> >remember
> >> >> the last match and walk the list.
> >> >>
> >> >> 	-hpa
> >> >>
> >> >
> >> > Ok, but it raises a question - how to know it was the 'last' match
> >> > without knowing all signatures of other hyper-visor?
> >>
> >> You can return a "priority" value from the .detect function.  The
> >> priority value can simply be the CPUID leaf where the signature was
> >> found (or a low value such as 1 if detection was done with DMI).
> >>
> >> Then you can pick the hypervisor with the highest priority instead of
> >> hard-coding the order.
> >
> >I like this idea; this allows some guest level control that is what we
> >want
> >when we have hypervisors emulating each other.
> >
> >
> >Regards,
> >
> >K. Y
> >>
> >> Paolo
> >>
> >>
> 
> --
> Sent from my mobile phone. Please excuse brevity and lack of formatting.
> 
>