diff options
| author | Joerg Roedel <joerg.roedel@amd.com> | 2010-05-05 16:04:45 +0200 |
|---|---|---|
| committer | Avi Kivity <avi@redhat.com> | 2010-05-19 11:36:38 +0300 |
| commit | 0d945bd9351199744c1e89d57a70615b6ee9f394 (patch) | |
| tree | c5c416d3214b73c35d33d68e980298d24ec76958 | |
| parent | 3f0fd2927b737c0ac2e04af7858b60d1e927d4b1 (diff) | |
| download | op-kernel-dev-0d945bd9351199744c1e89d57a70615b6ee9f394.zip op-kernel-dev-0d945bd9351199744c1e89d57a70615b6ee9f394.tar.gz | |
KVM: SVM: Don't allow nested guest to VMMCALL into host
This patch disables the possibility for a l2-guest to do a
VMMCALL directly into the host. This would happen if the
l1-hypervisor doesn't intercept VMMCALL and the l2-guest
executes this instruction.
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
| -rw-r--r-- | arch/x86/kvm/svm.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 2511664..4a66ffe 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2036,6 +2036,9 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm) svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK; } + /* We don't want to see VMMCALLs from a nested guest */ + svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMMCALL); + /* * We don't want a nested guest to be more powerful than the guest, so * all intercepts are ORed |
