Re: [PATCH] KVM: x86: Disallow hypercalls for guest callers in rings > 0

From: Anthony Liguori <anthony@codemonkey.ws>
To: Avi Kivity <avi@redhat.com>
Cc: Jan Kiszka <jan.kiszka@siemens.com>, kvm-devel <kvm@vger.kernel.org>
Subject: Re: [PATCH] KVM: x86: Disallow hypercalls for guest callers in rings > 0
Date: Mon, 03 Aug 2009 10:04:42 -0500	[thread overview]
Message-ID: <4A76FC8A.3010308@codemonkey.ws> (raw)
In-Reply-To: <4A76F325.7020309@redhat.com>

Avi Kivity wrote:
> On 08/03/2009 05:04 PM, Anthony Liguori wrote:
>>
>> Actually, VT mandates that vmcalls can only be done from CPL=0.
>>
>
> That's exactly how I misremembered it.  However the docs say
>
> IF not in VMX operation
>     THEN #UD;
> ELSIF in VMX non-root operation
>     THEN VM exit;
> ELSIF (RFLAGS.VM = 1) OR (IA32_EFER.LMA = 1 and CS.L = 0)
>     THEN #UD;
> ELSIF CPL > 0
>     THEN #GP(0);
>
> So CPL > 0 is only enforced on VMCALL from the hypervisor, not the 
> guest (tip: don't ask what VMCALL in the hypervisor means).

Ah, it's used to call SMM peer mode... awesome :-)

Regards,

Anthony Liguori