lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Thu, 17 Jul 2014 17:22:06 +0800
From:	Tang Chen <>
To:	Gleb Natapov <>
CC:	Jan Kiszka <>, <>,
	<>, <>,
	<>, <>,
	<>, <>
Subject: Re: [PATCH v2 5/5] kvm, mem-hotplug: Do not pin apic access page
 in memory.

Hi Gleb,

Sorry for the delay. Please see below.

On 07/15/2014 10:40 PM, Gleb Natapov wrote:
>>> We can request APIC_ACCESS_ADDR reload during L2->L1 vmexit emulation, so
>>> if APIC_ACCESS_ADDR changes while L2 is running it will be reloaded for L1 too.
>> apic pages for L2 and L1 are not the same page, right ?
> If L2 guest enable apic access page then they are different, otherwise
> they are the same.
>> I think, just like we are doing in patch 5/5, we cannot wait for the next
>> L2->L1 vmexit.
>> We should enforce a L2->L1 vmexit in mmu_notifier, just like
>> make_all_cpus_request() does.
>> Am I right ?
> I do not see why forcing APIC_ACCESS_ADDR reload during L2->L1 exit is not enough.

Yes, you are right. APIC_ACCESS_ADDR reload should be done during L2->L1 

I mean, before the page is moved to other place, we have to enforce a 
L2->L1 vmexit,
but not wait for the next L2->L1 vmexit. Since when the page is being 
moved, if the
L2 vm is still running, it could access apic page directly. And the vm 
may corrupt.

In the mmu_notifier called before the page is moved, we have to enforce 
a L2->L1
vmexit, and ask vcpus to reload APIC_ACCESS_ADDR for L2 vm. The process 
will wait
till the page migration is completed, and update the APIC_ACCESS_ADDR, 
and re-enter
guest mode.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists