Re: [PATCH] KVM: x86: Disallow hypercalls for guest callers in rings > 0

[Avi Kivity <avi@redhat.com>]

On 08/03/2009 05:04 PM, Anthony Liguori wrote:
>
> Actually, VT mandates that vmcalls can only be done from CPL=0.
>

That's exactly how I misremembered it.  However the docs say

IF not in VMX operation
     THEN #UD;
ELSIF in VMX non-root operation
     THEN VM exit;
ELSIF (RFLAGS.VM = 1) OR (IA32_EFER.LMA = 1 and CS.L = 0)
     THEN #UD;
ELSIF CPL > 0
     THEN #GP(0);

So CPL > 0 is only enforced on VMCALL from the hypervisor, not the guest 
(tip: don't ask what VMCALL in the hypervisor means).


> SVM allows hypercalls from CPL>0 unfortunately.

Yeah.

-- 
error compiling committee.c: too many arguments to function