[lkml]   [2023]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 08/12] KVM: nSVM: Use KVM-governed feature framework to track "vVM{SAVE,LOAD} enabled"
On Tue, Feb 21, 2023, Yu Zhang wrote:
> > Sorry, why guest_cpuid_is_intel(vcpu)? Is it becasue that a AMD host with virtual
> > VMSAVE/VMLOAD capability will always expose this feature for all AMD guests?
> Oh, sorry. I missed the guest_cpuid_has() in kvm_governed_feature_check_and_set().
> So please just ignore my 2nd question.
> As to the check of guest_cpuid_is_intel(), is it necessary?

Yes? The comment in init_vmcb_after_set_cpuid() says:

* We must intercept SYSENTER_EIP and SYSENTER_ESP
* accesses because the processor only stores 32 bits.
* For the same reason we cannot use virtual VMLOAD/VMSAVE.

but I'm struggling to connect the dots to SYSENTER. I suspect the comment is
misleading and has nothing to do 32-bit vs. 64-bit (or I'm reading it wrong) and
should be something like:

* Disable virtual VMLOAD/VMSAVE and intercept VMLOAD/VMSAVE if the
* guest CPU is Intel in order to inject #UD.

In other words, a non-SVM guest shouldn't be allowed to execute VMLOAD/VMSAVE.

 \ /
  Last update: 2023-03-27 00:31    [W:0.052 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site