Messages in this thread | | | Date | Thu, 31 Jan 2013 14:34:27 -0500 | From | Don Zickus <> | Subject | Re: [PATCH] x86, x2apic: Only WARN on broken BIOSes inside a virtual guest |
| |
On Thu, Jan 31, 2013 at 08:52:00PM +0200, Gleb Natapov wrote: > > http://www.invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf > > > > After talking with folks, the threat of irq injections on virtual guests > > made sense. However, when discussing if this was possible on bare metal > > machines, we could not come up with a plausible scenario. > > > The irq injections is something that a guest with assigned device does > to attack a hypervisor it runs on. Interrupt remapping protects host > from this attack. According to pdf above if x2apic is disabled in a > hypervisor interrupt remapping can be bypassed and leave host vulnerable > to guest attack. This means that situation is exactly opposite: warning > has sense on a bare metal, but not in a guest. I am not sure that there is > a hypervisor that emulates interrupt remapping device though and without > it the warning cannot be triggered in a guest.
Ah, it makes sense. Not sure how I got it backwards then. So my patch is pointless then? I'll asked for it to be dropped.
From my previous discussions with folks, is that KVM was protected from this type of attack. Is that still true?
Cheers, Don
| |