linux-kernel - Re: [PATCH v2 5/5] kvm, mem-hotplug: Do not pin apic access page in memory.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Jul 2014 17:22:06 +0800
From:	Tang Chen <tangchen@...fujitsu.com>
To:	Gleb Natapov <gleb@...nel.org>
CC:	Jan Kiszka <jan.kiszka@....de>, <mtosatti@...hat.com>,
	<nadav.amit@...il.com>, <kvm@...r.kernel.org>,
	<laijs@...fujitsu.com>, <isimatu.yasuaki@...fujitsu.com>,
	<guz.fnst@...fujitsu.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 5/5] kvm, mem-hotplug: Do not pin apic access page
 in memory.

Hi Gleb,

Sorry for the delay. Please see below.

On 07/15/2014 10:40 PM, Gleb Natapov wrote:
......
>>>>
>>> We can request APIC_ACCESS_ADDR reload during L2->L1 vmexit emulation, so
>>> if APIC_ACCESS_ADDR changes while L2 is running it will be reloaded for L1 too.
>>>
>>
>> apic pages for L2 and L1 are not the same page, right ?
>>
> If L2 guest enable apic access page then they are different, otherwise
> they are the same.
>
>> I think, just like we are doing in patch 5/5, we cannot wait for the next
>> L2->L1 vmexit.
>> We should enforce a L2->L1 vmexit in mmu_notifier, just like
>> make_all_cpus_request() does.
>>
>> Am I right ?
>>
> I do not see why forcing APIC_ACCESS_ADDR reload during L2->L1 exit is not enough.

Yes, you are right. APIC_ACCESS_ADDR reload should be done during L2->L1 
vmexit.

I mean, before the page is moved to other place, we have to enforce a 
L2->L1 vmexit,
but not wait for the next L2->L1 vmexit. Since when the page is being 
moved, if the
L2 vm is still running, it could access apic page directly. And the vm 
may corrupt.

In the mmu_notifier called before the page is moved, we have to enforce 
a L2->L1
vmexit, and ask vcpus to reload APIC_ACCESS_ADDR for L2 vm. The process 
will wait
till the page migration is completed, and update the APIC_ACCESS_ADDR, 
and re-enter
guest mode.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/