Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-24 Thread Laurent Dufour
Le 24/03/2020 à 13:00, Greg Kurz a écrit : On Tue, 24 Mar 2020 10:43:23 +1100 Paul Mackerras wrote: On Fri, Mar 20, 2020 at 01:22:48PM +0100, Greg Kurz wrote: On Fri, 20 Mar 2020 11:26:42 +0100 Laurent Dufour wrote: The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing

Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-24 Thread Greg Kurz
On Tue, 24 Mar 2020 10:43:23 +1100 Paul Mackerras wrote: > On Fri, Mar 20, 2020 at 01:22:48PM +0100, Greg Kurz wrote: > > On Fri, 20 Mar 2020 11:26:42 +0100 > > Laurent Dufour wrote: > > > > > The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing > > > prevent a malicious VM

Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-23 Thread Paul Mackerras
On Fri, Mar 20, 2020 at 01:22:48PM +0100, Greg Kurz wrote: > On Fri, 20 Mar 2020 11:26:42 +0100 > Laurent Dufour wrote: > > > The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing > > prevent a malicious VM or SVM to call them. This could lead to weird result > > and should be

Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-20 Thread Ram Pai
On Fri, Mar 20, 2020 at 11:26:42AM +0100, Laurent Dufour wrote: > The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing > prevent a malicious VM or SVM to call them. This could lead to weird result > and should be filtered out. > > Checking the Secure bit of the calling MSR

Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-20 Thread Laurent Dufour
Le 20/03/2020 à 13:22, Greg Kurz a écrit : On Fri, 20 Mar 2020 11:26:42 +0100 Laurent Dufour wrote: The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing prevent a malicious VM or SVM to call them. This could lead to weird result and should be filtered out. Checking the

Re: [PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-20 Thread Greg Kurz
On Fri, 20 Mar 2020 11:26:42 +0100 Laurent Dufour wrote: > The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing > prevent a malicious VM or SVM to call them. This could lead to weird result > and should be filtered out. > > Checking the Secure bit of the calling MSR ensure

[PATCH 1/2] KVM: PPC: Book3S HV: check caller of H_SVM_* Hcalls

2020-03-20 Thread Laurent Dufour
The Hcall named H_SVM_* are reserved to the Ultravisor. However, nothing prevent a malicious VM or SVM to call them. This could lead to weird result and should be filtered out. Checking the Secure bit of the calling MSR ensure that the call is coming from either the Ultravisor or a SVM. But any