linux-kernel - Re: [PATCH 3.2 087/102] nEPT: Nested INVEPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 05 Nov 2014 20:21:47 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Paolo Bonzini <pbonzini@...hat.com>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	akpm@...ux-foundation.org, Jun Nakajima <jun.nakajima@...el.com>,
	Xinhao Xu <xinhao.xu@...el.com>,
	Yang Zhang <yang.z.zhang@...el.com>,
	Xiao Guangrong <xiaoguangrong@...ux.vnet.ibm.com>,
	Gleb Natapov <gleb@...hat.com>, Nadav Har'El <nyh@...ibm.com>
Subject: Re: [PATCH 3.2 087/102] nEPT: Nested INVEPT

On Mon, 2014-11-03 at 16:29 +0100, Paolo Bonzini wrote:
> On 03/11/2014 14:44, Ben Hutchings wrote:
> >> You can just use the same scheme as your patch 88/102:
> > Why is that?  Why should I not use the upstream version?
> 
> Because it makes no sense to invalidate nested EPT page tables, if the 
> kernel cannot make nested EPT page tables in the first place.

Indeed, but I didn't realise it wasn't.

> I think that this "if" in your patch should always trigger, thus making
> your large patch equivalent to my small patch:
> 
> +	if (!(nested_vmx_secondary_ctls_high & SECONDARY_EXEC_ENABLE_EPT) ||
> +	    !(nested_vmx_ept_caps & VMX_EPT_INVEPT_BIT)) {
> +		kvm_queue_exception(vcpu, UD_VECTOR);
> +		return 1;
> +	}
> 
> ... but without looking at the entire source of vmx.c in the relatively
> old 3.2 kernel, I'd rather play it safe and avoid introducing bugs in case
> the above turns out not to be true.

I see - only the SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES flag should be
set in nested_vmx_secondary_ctls_high.  I'll use your simple version,
thanks.

Ben.

-- 
Ben Hutchings
The program is absolutely right; therefore, the computer must be wrong.

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)