From mboxrd@z Thu Jan 1 00:00:00 1970 From: Krish Sadhukhan Subject: Re: [PATCH 1/2] KVM: VMX: remove I/O port 0x80 bypass on Intel hosts Date: Fri, 1 Dec 2017 16:34:54 -0800 Message-ID: <89ee0169-807f-cce6-3281-e8e2c94a3ee8@oracle.com> References: <20171201182110.7143-1-jmattson@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Cc: Andrew Honig To: Jim Mattson , kvm@vger.kernel.org, P J P Return-path: Received: from aserp1040.oracle.com ([141.146.126.69]:39207 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751596AbdLBAfA (ORCPT ); Fri, 1 Dec 2017 19:35:00 -0500 In-Reply-To: <20171201182110.7143-1-jmattson@google.com> Sender: kvm-owner@vger.kernel.org List-ID: On 12/01/2017 10:21 AM, Jim Mattson wrote: > From: Andrew Honig > > This fixes CVE-2017-1000407. > > KVM allows guests to directly access I/O port 0x80 on Intel hosts. If > the guest floods this port with writes it generates exceptions and > instability in the host kernel, leading to a crash. With this change > guest writes to port 0x80 on Intel will behave the same as they > currently behave on AMD systems. > > Prevent the flooding by removing the code that sets port 0x80 as a > passthrough port. This is essentially the same as upstream patch > 99f85a28a78e96d28907fe036e1671a218fee597, except that patch was > for AMD chipsets and this patch is for Intel. > > Signed-off-by: Andrew Honig > Signed-off-by: Jim Mattson > --- > arch/x86/kvm/vmx.c | 5 ----- > 1 file changed, 5 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index d2b452d66363..d16abd1808eb 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -6753,12 +6753,7 @@ static __init int hardware_setup(void) > memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE); > memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE); > > - /* > - * Allow direct access to the PC debug port (it is often used for I/O > - * delays, but the vmexits simply slow things down). > - */ > memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE); > - clear_bit(0x80, vmx_io_bitmap_a); > > memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE); > Reviewed-by: Krish Sadhukhan