Hi,
In
<https://blog.xenproject.org/2018/01/04/xen-project-spectremeltdown-faq/>:
"On Intel processors, only 64-bit PV mode guests can attack Xen
using Variant 3. Guests running in 32-bit PV mode, HVM mode, and
PVH mode (both v1 and v2) cannot attack the hypervisor using
Variant 3. However, in 32-bit PV mode, HVM mode, and PVH mode
(both v1 and v2), guest userspaces can attack guest kernels
using Variant 3; so updating guest kernels is advisable.
Interestingly, guest kernels running in 64-bit PV mode are not
vulnerable to attack using Variant 3, because 64-bit PV guests
already run in a KPTI-like mode."
However, in multiple other places, including
<https://xenbits.xen.org/xsa/xsa254/README.comet> and
<https://xenbits.xen.org/xsa/xsa254/README.vixen>:
"Note that both of these shim-based approaches prevent attacks on
the host, but leave the guest vulnerable to Meltdown attacks by
its own unprivileged processes; this is true even if the guest
OS has KPTI or similar Meltdown mitigation."
These seem to contradict each other.
The FAQ seems to suggest that:
- 32-bit PV guest userland processes can use Variant 3 against their
own kernels and that the KPTI patch would protect against that.
- Without Comet/Vixen, 64-bit PV guests can't use Variant 3 on
themselves but can use it on the hypervisor, and KPTI patches in
the guest do not prevent that.
- Running PV guests inside Comet or Vixen prevents them making use
of Variant 3, they still cannot use Variant 3 against their own
kernels, and KPTI patches in the guest are not necessary.
The Comet and Vixen READMEs seem to suggest that:
- Use of Comet/Vixen prevents PV guests from using Variant 3 against
the hypervisor (and thus other guests as well).
- The guest itself remains able to use Variant 3 on its own kernel
and KPTI patches inside the guest cannot prevent this.
Which is correct, or have I misunderstood and they are somehow both
correct?
Cheers,
Andy
_______________________________________________
Xen-devel mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-devel
