From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH 0/3] Infinite loops in microcode while running guests
Date: Wed, 11 Nov 2015 14:07:31 +0100
Message-ID: <56433D93.8070702@redhat.com>
References: <1447158174-10484-1-git-send-email-pbonzini@redhat.com>
 <564338F6.3070207@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Cc: digitaleric@google.com
To: Austin S Hemmelgarn <ahferroin7@gmail.com>,
	linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <564338F6.3070207@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
List-Id: kvm.vger.kernel.org



On 11/11/2015 13:47, Austin S Hemmelgarn wrote:
>>
> I just finished running a couple of tests in a KVM instance running
> nested on a Xen HVM instance, and found no issues, so for the set as a
> whole:
> 
> Tested-by: Austin S. Hemmelgarn <ahferroin7@gmail.com>
> 
> Now to hope the equivalent fix for Xen gets into the Gentoo repositories
> soon, as the issue propagates down through nested virtualization and
> ties up the CPU regardless (and in turn triggers the watchdog).

Note that nested guests should _not_ lock up the outer (L0) hypervisor
if the outer hypervisor has the fix.  At least this is the case for KVM:
a fixed outer KVM can protect any vulnerable nested (L1) hypervisor from
malicious nested guests.  A vulnerable outer KVM is also protected if
the nested hypervisor has the workaround.

Paolo