* [stable request 3.4 3.10] nEPT: Nested INVEPT
@ 2014-12-13 1:13 Vinson Lee
2014-12-13 9:09 ` Paolo Bonzini
0 siblings, 1 reply; 3+ messages in thread
From: Vinson Lee @ 2014-12-13 1:13 UTC (permalink / raw)
To: stable
Cc: Nadav Har'El, Xiao Guangrong, Jun Nakajima, Xinhao Xu,
Yang Zhang, Gleb Natapov, Paolo Bonzini, kvm
Please consider upstream 3.12 commit
bfd0a56b90005f8c8a004baf407ad90045c2b11e "nEPT: Nested INVEPT" for
stable trees 3.4 and 3.10. This patch addresses CVE-2014-3645. It has
already been backported to 3.2 in 3.2.64.
commit bfd0a56b90005f8c8a004baf407ad90045c2b11e
Author: Nadav Har'El <nyh@il.ibm.com>
Date: Mon Aug 5 11:07:17 2013 +0300
nEPT: Nested INVEPT
If we let L1 use EPT, we should probably also support the INVEPT
instruction.
In our current nested EPT implementation, when L1 changes its EPT table
for L2 (i.e., EPT12), L0 modifies the shadow EPT table (EPT02), and in
the course of this modification already calls INVEPT. But if last level
of shadow page is unsync not all L1's changes to EPT12 are intercepted,
which means roots need to be synced when L1 calls INVEPT. Global INVEPT
should not be different since roots are synced by kvm_mmu_load() each
time EPTP02 changes.
Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Signed-off-by: Nadav Har'El <nyh@il.ibm.com>
Signed-off-by: Jun Nakajima <jun.nakajima@intel.com>
Signed-off-by: Xinhao Xu <xinhao.xu@intel.com>
Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cheers,
Vinson
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [stable request 3.4 3.10] nEPT: Nested INVEPT
2014-12-13 1:13 [stable request 3.4 3.10] nEPT: Nested INVEPT Vinson Lee
@ 2014-12-13 9:09 ` Paolo Bonzini
2014-12-24 7:58 ` Zefan Li
0 siblings, 1 reply; 3+ messages in thread
From: Paolo Bonzini @ 2014-12-13 9:09 UTC (permalink / raw)
To: Vinson Lee, stable
Cc: Nadav Har'El, Xiao Guangrong, Jun Nakajima, Xinhao Xu,
Yang Zhang, Gleb Natapov, kvm
On 13/12/2014 02:13, Vinson Lee wrote:
> Please consider upstream 3.12 commit
> bfd0a56b90005f8c8a004baf407ad90045c2b11e "nEPT: Nested INVEPT" for
> stable trees 3.4 and 3.10. This patch addresses CVE-2014-3645. It has
> already been backported to 3.2 in 3.2.64.
Note that the patch for 3.4 and 3.10 can be much simpler:
https://lkml.org/lkml/2014/11/2/48
Paolo
> commit bfd0a56b90005f8c8a004baf407ad90045c2b11e
> Author: Nadav Har'El <nyh@il.ibm.com>
> Date: Mon Aug 5 11:07:17 2013 +0300
>
> nEPT: Nested INVEPT
>
> If we let L1 use EPT, we should probably also support the INVEPT
> instruction.
>
> In our current nested EPT implementation, when L1 changes its EPT table
> for L2 (i.e., EPT12), L0 modifies the shadow EPT table (EPT02), and in
> the course of this modification already calls INVEPT. But if last level
> of shadow page is unsync not all L1's changes to EPT12 are intercepted,
> which means roots need to be synced when L1 calls INVEPT. Global INVEPT
> should not be different since roots are synced by kvm_mmu_load() each
> time EPTP02 changes.
>
> Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
> Signed-off-by: Nadav Har'El <nyh@il.ibm.com>
> Signed-off-by: Jun Nakajima <jun.nakajima@intel.com>
> Signed-off-by: Xinhao Xu <xinhao.xu@intel.com>
> Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
> Signed-off-by: Gleb Natapov <gleb@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>
>
> Cheers,
> Vinson
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [stable request 3.4 3.10] nEPT: Nested INVEPT
2014-12-13 9:09 ` Paolo Bonzini
@ 2014-12-24 7:58 ` Zefan Li
0 siblings, 0 replies; 3+ messages in thread
From: Zefan Li @ 2014-12-24 7:58 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Vinson Lee, stable, Nadav Har'El, Xiao Guangrong,
Jun Nakajima, Xinhao Xu, Yang Zhang, Gleb Natapov, kvm
On 2014/12/13 17:09, Paolo Bonzini wrote:
>
>
> On 13/12/2014 02:13, Vinson Lee wrote:
>> Please consider upstream 3.12 commit
>> bfd0a56b90005f8c8a004baf407ad90045c2b11e "nEPT: Nested INVEPT" for
>> stable trees 3.4 and 3.10. This patch addresses CVE-2014-3645. It has
>> already been backported to 3.2 in 3.2.64.
>
> Note that the patch for 3.4 and 3.10 can be much simpler:
>
> https://lkml.org/lkml/2014/11/2/48
>
I've applied the simpler version to 3.4. Thanks!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-12-24 7:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-13 1:13 [stable request 3.4 3.10] nEPT: Nested INVEPT Vinson Lee
2014-12-13 9:09 ` Paolo Bonzini
2014-12-24 7:58 ` Zefan Li
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.