linux-kernel - Re: [PATCH v8 12/18] KVM: SVM: Add support for static allocation of unified Page Encryption Bitmap.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201204213852.GA1424@ashkalra_ubuntu_server>
Date:   Fri, 4 Dec 2020 21:38:52 +0000
From:   Ashish Kalra <ashish.kalra@....com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     tglx@...utronix.de, mingo@...hat.com, hpa@...or.com,
        joro@...tes.org, bp@...e.de, Thomas.Lendacky@....com,
        x86@...nel.org, kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        srutherford@...gle.com, rientjes@...gle.com,
        venu.busireddy@...cle.com, brijesh.singh@....com
Subject: Re: [PATCH v8 12/18] KVM: SVM: Add support for static allocation of
 unified Page Encryption Bitmap.

Hello Paolo,

On Fri, Dec 04, 2020 at 12:08:20PM +0100, Paolo Bonzini wrote:
> On 05/05/20 23:18, Ashish Kalra wrote:
> > Add support for static allocation of the unified Page encryption bitmap
> > by extending kvm_arch_commit_memory_region() callack to add svm specific
> > x86_ops which can read the userspace provided memory region/memslots and
> > calculate the amount of guest RAM managed by the KVM and grow the bitmap
> > based on that information, i.e. the highest guest PA that is mapped by a
> > memslot.
> 
> Hi Ashish,
> 
> the commit message should explain why this is needed or useful.
> 

Earlier we used to dynamic resizing of the page encryption bitmap based
on the guest hypercall, but potentially a malicious guest can make a hypercall
which can trigger a really large memory allocation on the host side and may
eventually cause denial of service.

Hence now we don't do dynamic resizing of the page encryption bitmap as
per the hypercall and allocate it statically based on guest memory 
allocation by walking through memslots and computing it's size.

I will add the above comment to the fresh series of the patch-set i am
going to post. 

Thanks,
Ashish