linux-kernel - Re: [Xen-devel] KVM PV (was: Re: [PATCH v2 2/2] x86/lguest: remove lguest support)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 2 Oct 2017 11:36:00 +0100
From:   George Dunlap <george.dunlap@...rix.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
CC:     Lai Jiangshan <jiangshanlai+lkml@...il.com>,
        Juergen Gross <jgross@...e.com>,
        Rusty Russell <rusty@...tcorp.com.au>,
        <lguest@...ts.ozlabs.org>, <kvm@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        xen-devel <xen-devel@...ts.xenproject.org>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [Xen-devel] KVM PV (was: Re: [PATCH v2 2/2] x86/lguest: remove
 lguest support)

On Sat, Sep 30, 2017 at 4:39 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
>
> ----- Lai Jiangshan <jiangshanlai+lkml@...il.com> ha scritto:
>> On Sat, Sep 30, 2017 at 12:39 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
>> > On 29/09/2017 17:47, Lai Jiangshan wrote:
>> >> Hello, all
>> >>
>> >> An interesting (at least to me) thinking came up to me when I found
>> >> that the lguest was removed. But I don't have enough knowledge
>> >> to find out the answer nor energy to implement it in some time.
>> >>
>> >> Is it possible to implement kvm-pv which allows kvm to run on
>> >> the boxes without hardware virtualization support, so that
>> >> qemu/kvm can be used on clouds such as aws, azure?
>> >
>> > No, please don't. :)  Even Xen is moving from PV to PVH (paravirtualized
>> > hardware with event channels, grant tables and the like, but still using
>> > hardware extensions for MMU).
>> >
>> > Rather, cloud providers should help getting nested virtualization ready
>> > for production use.  At least for KVM it's not that far.
>> >
>>
>> Although I'm not business man, I don't think the top cloud provider[s]
>> would allow nested virtualization, however mature nested virtualization
>> is. Even xen-pv is unable to be nested in the aws and azure.

A lot of new Windows features, like Credential Guard and Device Guard
require hardware virtualization support, as do security products like
Bromium.  So it's not surprising that cloud providers are becoming
more interested in nested hardware support.

> Check the contributors to KVM nested virtualization, you might be surprised.
>
> Nested Xen PV is not possible because the Xen hypervisor cannot run as a PV guest. It's a technical limitation.

Minor correction: Xen can't run on AWS as a PV guest, but it can run
as an L1 hypervisor inside any "fully virtualized" VM (as both AWS and
Azure provide), and provide PV L2 guests.

 -George