linux-kernel - Re: KVM Nested L2 guest startup problems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <536A5412.5000403@redhat.com>
Date:	Wed, 07 May 2014 17:41:06 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Abel Gordon <abel@...atoscale.com>
CC:	Hu Yaohui <loki2441@...il.com>, Bandan Das <bsd@...hat.com>,
	kvm <kvm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Muli Ben-Yehuda <muli@...atoscale.com>
Subject: Re: KVM Nested L2 guest startup problems

Il 07/05/2014 17:30, Abel Gordon ha scritto:
> > ... which we already do.  The only secondary execution controls we allow are
> > APIC page, unrestricted guest, WBINVD exits, and of course EPT.
> 
> But we don't verify if L1  tries to enable the feature for L1 (even if
> it's not exposed)... Or do we ?

Yes, we do:

        if (!vmx_control_verify(vmcs12->cpu_based_vm_exec_control,
              nested_vmx_procbased_ctls_low, nested_vmx_procbased_ctls_high) ||
            !vmx_control_verify(vmcs12->secondary_vm_exec_control,
              nested_vmx_secondary_ctls_low, nested_vmx_secondary_ctls_high) ||
            !vmx_control_verify(vmcs12->pin_based_vm_exec_control,
              nested_vmx_pinbased_ctls_low, nested_vmx_pinbased_ctls_high) ||
            !vmx_control_verify(vmcs12->vm_exit_controls,
              nested_vmx_exit_ctls_low, nested_vmx_exit_ctls_high) ||
            !vmx_control_verify(vmcs12->vm_entry_controls,
              nested_vmx_entry_ctls_low, nested_vmx_entry_ctls_high))
        {
                nested_vmx_failValid(vcpu, VMXERR_ENTRY_INVALID_CONTROL_FIELD);
                return 1;
        }

Paolo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/