All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Radim Krčmář" <rkrcmar@redhat.com>
To: Jim Mattson <jmattson@google.com>
Cc: kvm@vger.kernel.org, P J P <ppandit@redhat.com>,
	Andrew Honig <ahonig@google.com>
Subject: Re: [PATCH 1/2] KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
Date: Tue, 5 Dec 2017 22:32:07 +0100	[thread overview]
Message-ID: <20171205213206.GE20099@flask> (raw)
In-Reply-To: <20171201182110.7143-1-jmattson@google.com>

2017-12-01 10:21-0800, Jim Mattson:
> From: Andrew Honig <ahonig@google.com>
> 
> This fixes CVE-2017-1000407.
> 
> KVM allows guests to directly access I/O port 0x80 on Intel hosts.  If
> the guest floods this port with writes it generates exceptions and
> instability in the host kernel, leading to a crash.  With this change
> guest writes to port 0x80 on Intel will behave the same as they
> currently behave on AMD systems.
> 
> Prevent the flooding by removing the code that sets port 0x80 as a
> passthrough port.  This is essentially the same as upstream patch
> 99f85a28a78e96d28907fe036e1671a218fee597, except that patch was
> for AMD chipsets and this patch is for Intel.
> 
> Signed-off-by: Andrew Honig <ahonig@google.com>
> Signed-off-by: Jim Mattson <jmattson@google.com>

Fixes: fdef3ad1b386 ("KVM: VMX: Enable io bitmaps to avoid IO port 0x80 VMEXITs")
Cc: <stable@vger.kernel.org>

Applied, thanks.  The commit that introduced it boasted 3-5% performance
improvements when compiling the kernel -- have you noticed regressions?

  parent reply	other threads:[~2017-12-05 21:32 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-01 18:21 [PATCH 1/2] KVM: VMX: remove I/O port 0x80 bypass on Intel hosts Jim Mattson
2017-12-01 18:21 ` [PATCH 2/2] KVM: VMX: Use just one page for I/O permission bitmaps Jim Mattson
2017-12-04 18:30   ` kbuild test robot
2017-12-04 18:34     ` Jim Mattson
2017-12-05 21:26   ` Radim Krčmář
2017-12-06  0:16     ` Jim Mattson
2017-12-06 11:17     ` Quan Xu
2017-12-06 18:19       ` Jim Mattson
2017-12-07  2:33         ` Quan Xu
2017-12-07 17:06           ` Radim Krčmář
2017-12-08  2:04             ` Quan Xu
2017-12-02  0:34 ` [PATCH 1/2] KVM: VMX: remove I/O port 0x80 bypass on Intel hosts Krish Sadhukhan
2017-12-04 12:44 ` Wanpeng Li
2017-12-04 17:10   ` Jim Mattson
2017-12-05  7:19     ` Wanpeng Li
2017-12-05 11:24     ` Quan Xu
2017-12-05 12:15       ` Wanpeng Li
2017-12-05 21:32 ` Radim Krčmář [this message]
2017-12-06  0:36   ` Jim Mattson
2017-12-06  1:38   ` Quan Xu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171205213206.GE20099@flask \
    --to=rkrcmar@redhat.com \
    --cc=ahonig@google.com \
    --cc=jmattson@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=ppandit@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.