lkml.org 
[lkml]   [2010]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 159/164] KVM: SVM: Dont allow nested guest to VMMCALL into host
    2.6.33-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Joerg Roedel <joerg.roedel@amd.com>

    This patch disables the possibility for a l2-guest to do a
    VMMCALL directly into the host. This would happen if the
    l1-hypervisor doesn't intercept VMMCALL and the l2-guest
    executes this instruction.

    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    (cherry picked from commit 0d945bd9351199744c1e89d57a70615b6ee9f394)
    ---
    arch/x86/kvm/svm.c | 9 +++++++--
    1 file changed, 7 insertions(+), 2 deletions(-)

    --- a/arch/x86/kvm/svm.c
    +++ b/arch/x86/kvm/svm.c
    @@ -1829,8 +1829,13 @@ static bool nested_svm_vmrun(struct vcpu
    svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK;
    }

    - /* We don't want a nested guest to be more powerful than the guest,
    - so all intercepts are ORed */
    + /* We don't want to see VMMCALLs from a nested guest */
    + svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMMCALL);
    +
    + /*
    + * We don't want a nested guest to be more powerful than the guest, so
    + * all intercepts are ORed
    + */
    svm->vmcb->control.intercept_cr_read |=
    nested_vmcb->control.intercept_cr_read;
    svm->vmcb->control.intercept_cr_write |=



    \
     
     \ /
      Last update: 2010-07-01 23:01    [W:7.490 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site