| Message ID | 52B09EA7.4040507@siemens.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Il 17/12/2013 19:57, Jan Kiszka ha scritto: > When userspace sets MSR_IA32_FEATURE_CONTROL to 0, make sure we leave > root and non-root mode, fully disabling VMX. The register state of the > VCPU is undefined after this step, so userspace has to set it to a > proper state afterward. > > This enables to reboot a VM while it is running some hypervisor code. > > Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> > --- > > Even without a QEMU patch, this already enables system reset - the guest > is left in such a broken state that it simply triple-faults and resets > twice. Nevertheless, QEMU patch will follow. > > arch/x86/kvm/vmx.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index f90320b..6a0c2fa 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -2455,6 +2455,8 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata) > return 1; > } > > +static void vmx_leave_nested(struct kvm_vcpu *vcpu); > + > static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) > { > u32 msr_index = msr_info->index; > @@ -2470,6 +2472,8 @@ static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) > & FEATURE_CONTROL_LOCKED) > return 0; > to_vmx(vcpu)->nested.msr_ia32_feature_control = data; > + if (host_initialized && data == 0) > + vmx_leave_nested(vcpu); > return 1; > } > > @@ -8488,6 +8492,16 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu) > } > > /* > + * Forcibly leave nested mode in order to be able to reset the VCPU later on. > + */ > +static void vmx_leave_nested(struct kvm_vcpu *vcpu) > +{ > + if (is_guest_mode(vcpu)) > + nested_vmx_vmexit(vcpu); > + free_nested(to_vmx(vcpu)); > +} > + > +/* > * L1's failure to enter L2 is a subset of a normal exit, as explained in > * 23.7 "VM-entry failures during or after loading guest state" (this also > * lists the acceptable exit-reason and exit-qualification parameters). > Applied, thanks! Paolo -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index f90320b..6a0c2fa 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -2455,6 +2455,8 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata) return 1; } +static void vmx_leave_nested(struct kvm_vcpu *vcpu); + static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) { u32 msr_index = msr_info->index; @@ -2470,6 +2472,8 @@ static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) & FEATURE_CONTROL_LOCKED) return 0; to_vmx(vcpu)->nested.msr_ia32_feature_control = data; + if (host_initialized && data == 0) + vmx_leave_nested(vcpu); return 1; } @@ -8488,6 +8492,16 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu) } /* + * Forcibly leave nested mode in order to be able to reset the VCPU later on. + */ +static void vmx_leave_nested(struct kvm_vcpu *vcpu) +{ + if (is_guest_mode(vcpu)) + nested_vmx_vmexit(vcpu); + free_nested(to_vmx(vcpu)); +} + +/* * L1's failure to enter L2 is a subset of a normal exit, as explained in * 23.7 "VM-entry failures during or after loading guest state" (this also * lists the acceptable exit-reason and exit-qualification parameters).
When userspace sets MSR_IA32_FEATURE_CONTROL to 0, make sure we leave root and non-root mode, fully disabling VMX. The register state of the VCPU is undefined after this step, so userspace has to set it to a proper state afterward. This enables to reboot a VM while it is running some hypervisor code. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> --- Even without a QEMU patch, this already enables system reset - the guest is left in such a broken state that it simply triple-faults and resets twice. Nevertheless, QEMU patch will follow. arch/x86/kvm/vmx.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)