On Tue, 24 Mar 2020 10:43:23 +1100 Paul Mackerras <paulus@xxxxxxxxxx> wrote: > On Fri, Mar 20, 2020 at 01:22:48PM +0100, Greg Kurz wrote: > > On Fri, 20 Mar 2020 11:26:42 +0100 > > Laurent Dufour <ldufour@xxxxxxxxxxxxx> wrote: > > > > > The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing > > > prevent a malicious VM or SVM to call them. This could lead to weird result > > > and should be filtered out. > > > > > > Checking the Secure bit of the calling MSR ensure that the call is coming > > > from either the Ultravisor or a SVM. But any system call made from a SVM > > > are going through the Ultravisor, and the Ultravisor should filter out > > > these malicious call. This way, only the Ultravisor is able to make such a > > > Hcall. > > > > "Ultravisor should filter" ? And what if it doesn't (eg. because of a bug) ? > > > > Shouldn't we also check the HV bit of the calling MSR as well to > > disambiguate SVM and UV ? > > The trouble with doing that (checking the HV bit) is that KVM does not > expect to see the HV bit set on an interrupt that occurred while we > were in the guest, and if it is set, it indicates a serious problem, > i.e. that an interrupt occurred while we were in the code that > transitions from host context to guest context, or from guest context > to host context. In those cases we don't know how much of the > transition has been completed and therefore whether we have guest > values or host values in the CPU registers (GPRs, FPRs/VSRs, SPRs). > If we do see HV set then KVM reports a severe error to userspace which > should cause userspace to terminate the guest. > > Therefore the UV should *always* have the HV bit clear in HSRR1/SRR1 > when transitioning to KVM. > Indeed... thanks for the clarification. So I guess we'll just assume that the UV doesn't reflect these SVM specific hcalls if they happened to be issued by the guest then. Cheers, -- Greg > Paul.
