Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Disable SMAP in VMs

Browse Source 
Linux kernel bug cause hypercall fails from HVM userspace (see
referenced issue). As a simple workaround, do not advertise SMAP to VMs
- but still use it as hypervisor level.

Fixes QubesOS/qubes-issues#2881
This commit is contained in:
Marek Marczykowski-Górecki 2017-07-03 23:25:43 +02:00
parent 3721ae3e8b
commit 75608795b0
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
templates/libvirt/xen.xml
View File

@ -10,6 +10,15 @@
<currentMemory unit="MiB">{{ vm.memory }}</currentMemory> <currentMemory unit="MiB">{{ vm.memory }}</currentMemory>
<vcpu placement="static">{{ vm.vcpus }}</vcpu> <vcpu placement="static">{{ vm.vcpus }}</vcpu>
{% endblock %} {% endblock %}
{% block cpu %}
<cpu mode='host-passthrough'>
<!-- disable nested HVM -->
<feature name='vmx' policy='disable'/>
<feature name='svm' policy='disable'/>
<!-- disable SMAP inside VM, because of Linux bug -->
<feature name='smap' policy='disable'/>
</cpu>
{% endblock %}
<os> <os>
{% block os %} {% block os %}
{% if vm.hvm %} {% if vm.hvm %}