Messages in this thread | | | Subject | Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls | From | Laurent Dufour <> | Date | Tue, 24 Mar 2020 14:13:11 +0100 |
| |
Le 24/03/2020 à 13:00, Greg Kurz a écrit : > On Tue, 24 Mar 2020 10:43:23 +1100 > Paul Mackerras <paulus@ozlabs.org> wrote: > >> On Fri, Mar 20, 2020 at 01:22:48PM +0100, Greg Kurz wrote: >>> On Fri, 20 Mar 2020 11:26:42 +0100 >>> Laurent Dufour <ldufour@linux.ibm.com> wrote: >>> >>>> The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing >>>> prevent a malicious VM or SVM to call them. This could lead to weird result >>>> and should be filtered out. >>>> >>>> Checking the Secure bit of the calling MSR ensure that the call is coming >>>> from either the Ultravisor or a SVM. But any system call made from a SVM >>>> are going through the Ultravisor, and the Ultravisor should filter out >>>> these malicious call. This way, only the Ultravisor is able to make such a >>>> Hcall. >>> >>> "Ultravisor should filter" ? And what if it doesn't (eg. because of a bug) ? >>> >>> Shouldn't we also check the HV bit of the calling MSR as well to >>> disambiguate SVM and UV ? >> >> The trouble with doing that (checking the HV bit) is that KVM does not >> expect to see the HV bit set on an interrupt that occurred while we >> were in the guest, and if it is set, it indicates a serious problem, >> i.e. that an interrupt occurred while we were in the code that >> transitions from host context to guest context, or from guest context >> to host context. In those cases we don't know how much of the >> transition has been completed and therefore whether we have guest >> values or host values in the CPU registers (GPRs, FPRs/VSRs, SPRs). >> If we do see HV set then KVM reports a severe error to userspace which >> should cause userspace to terminate the guest. >> >> Therefore the UV should *always* have the HV bit clear in HSRR1/SRR1 >> when transitioning to KVM. >> > > Indeed... thanks for the clarification. So I guess we'll just assume > that the UV doesn't reflect these SVM specific hcalls if they happened > to be issued by the guest then.
As mentioned in the series's description: "It is assumed that the UV will filtered out such Hcalls made by a malicious SVM."
> Cheers, > > -- > Greg > >> Paul. >
| |