linux-kernel - Re: [RFC 0/6] Enlightened VMCS support for KVM on Hyper-V

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 16 Jan 2018 15:56:11 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Vitaly Kuznetsov <vkuznets@...hat.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     Wanpeng Li <kernellwp@...il.com>, kvm <kvm@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>,
        Radim Krčmář <rkrcmar@...hat.com>,
        "K. Y. Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "Michael Kelley (EOSG)" <Michael.H.Kelley@...rosoft.com>,
        Mohammed Gamal <mmorsy@...hat.com>,
        Cathy Avery <cavery@...hat.com>, Bandan Das <bsd@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC 0/6] Enlightened VMCS support for KVM on Hyper-V

On 16.01.2018 15:43, Vitaly Kuznetsov wrote:
> Paolo Bonzini <pbonzini@...hat.com> writes:
> 
>> On 16/01/2018 14:58, Vitaly Kuznetsov wrote:
>>>> Haven't looked into the details, but we have to watch out for other
>>>> VCPUs trying to modify that vmcs12.
>>>>
>>>> Basically because other VCPUs could try to modify values in vmcs12 while
>>>> we are currently building vmcs02. Nasty races could result in us copying
>>>> stuff (probably unchecked) into vmcs02 and therefore running something
>>>> that was not intended.
>>>>
>>> I don't think we share VMCS among vCPUs, do we?
>>
>> VMCS is just memory, so who knows what a malicious L1 guest will do.
>> But for vmread/vmwrite we can go through hypervisor memory, for
>> enlightened VMCS we cannot.
>>
> 
> True; not sure if Hyper-V actually copies the data to some internal
> storage, probably it does. TLFS explicitly forbids making the same
> enlightened VMCS active on several vCPUs simultaneously but again, this
> is just memory...
> 

FWIF, on nested s390x we pin the guest provided SIE control block ("SCB"
- s390x VMCS12). As this is just guest memory, another VCPU can write to
that memory.

When building our shadow SCB ("VMCS02"), we directly access the pinned
block, but we basically only copy values and mask them for the critical
parts (execution controls).

However, as I realize, the compiler might fetch values several times, so
we better add READ_ONCE() to these places. Will look into that.

-- 

Thanks,

David / dhildenb