Re: [PATCH] x86, x2apic: Only WARN on broken BIOSes inside a virtualguest

[Don Zickus]

On Thu, Jan 31, 2013 at 08:52:00PM +0200, Gleb Natapov wrote:
> > http://www.invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf
> > 
> > After talking with folks, the threat of irq injections on virtual guests
> > made sense.  However, when discussing if this was possible on bare metal
> > machines, we could not come up with a plausible scenario.
> > 
> The irq injections is something that a guest with assigned device does
> to attack a hypervisor it runs on. Interrupt remapping protects host
> from this attack. According to pdf above if x2apic is disabled in a
> hypervisor interrupt remapping can be bypassed and leave host vulnerable
> to guest attack. This means that situation is exactly opposite: warning
> has sense on a bare metal, but not in a guest. I am not sure that there is
> a hypervisor that emulates interrupt remapping device though and without
> it the warning cannot be triggered in a guest.

Ah, it makes sense.  Not sure how I got it backwards then.  So my patch is
pointless then?  I'll asked for it to be dropped.

>From my previous discussions with folks, is that KVM was protected from
this type of attack.  Is that still true?

Cheers,
Don
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/