summaryrefslogtreecommitdiffstats
path: root/arch/x86/kvm
diff options
context:
space:
mode:
authorJoerg Roedel <joerg.roedel@amd.com>2010-05-05 16:04:45 +0200
committerAvi Kivity <avi@redhat.com>2010-05-19 11:36:38 +0300
commit0d945bd9351199744c1e89d57a70615b6ee9f394 (patch)
treec5c416d3214b73c35d33d68e980298d24ec76958 /arch/x86/kvm
parent3f0fd2927b737c0ac2e04af7858b60d1e927d4b1 (diff)
KVM: SVM: Don't allow nested guest to VMMCALL into host
This patch disables the possibility for a l2-guest to do a VMMCALL directly into the host. This would happen if the l1-hypervisor doesn't intercept VMMCALL and the l2-guest executes this instruction. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com>
Diffstat (limited to 'arch/x86/kvm')
-rw-r--r--arch/x86/kvm/svm.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 2511664ff67..4a66ffe1dc8 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2036,6 +2036,9 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK;
}
+ /* We don't want to see VMMCALLs from a nested guest */
+ svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMMCALL);
+
/*
* We don't want a nested guest to be more powerful than the guest, so
* all intercepts are ORed