[PATCH] KVM: nVMX: Leave VMX mode on clearing of feature control MSR

[PATCH] KVM: nVMX: Leave VMX mode on clearing of feature control MSR

[Jan Kiszka]

When userspace sets MSR_IA32_FEATURE_CONTROL to 0, make sure we leave
root and non-root mode, fully disabling VMX. The register state of the
VCPU is undefined after this step, so userspace has to set it to a
proper state afterward.

This enables to reboot a VM while it is running some hypervisor code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---

Even without a QEMU patch, this already enables system reset - the guest
is left in such a broken state that it simply triple-faults and resets
twice. Nevertheless, QEMU patch will follow.

 arch/x86/kvm/vmx.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f90320b..6a0c2fa 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2455,6 +2455,8 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
 	return 1;
 }
 
+static void vmx_leave_nested(struct kvm_vcpu *vcpu);
+
 static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
 	u32 msr_index = msr_info->index;
@@ -2470,6 +2472,8 @@ static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 				& FEATURE_CONTROL_LOCKED)
 			return 0;
 		to_vmx(vcpu)->nested.msr_ia32_feature_control = data;
+		if (host_initialized && data == 0)
+			vmx_leave_nested(vcpu);
 		return 1;
 	}
 
@@ -8488,6 +8492,16 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu)
 }
 
 /*
+ * Forcibly leave nested mode in order to be able to reset the VCPU later on.
+ */
+static void vmx_leave_nested(struct kvm_vcpu *vcpu)
+{
+	if (is_guest_mode(vcpu))
+		nested_vmx_vmexit(vcpu);
+	free_nested(to_vmx(vcpu));
+}
+
+/*
  * L1's failure to enter L2 is a subset of a normal exit, as explained in
  * 23.7 "VM-entry failures during or after loading guest state" (this also
  * lists the acceptable exit-reason and exit-qualification parameters).
-- 
1.8.1.1.298.ge7eed54

Re: [PATCH] KVM: nVMX: Leave VMX mode on clearing of feature control MSR

[Paolo Bonzini]

Il 17/12/2013 19:57, Jan Kiszka ha scritto:
> When userspace sets MSR_IA32_FEATURE_CONTROL to 0, make sure we leave
> root and non-root mode, fully disabling VMX. The register state of the
> VCPU is undefined after this step, so userspace has to set it to a
> proper state afterward.
> 
> This enables to reboot a VM while it is running some hypervisor code.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
> 
> Even without a QEMU patch, this already enables system reset - the guest
> is left in such a broken state that it simply triple-faults and resets
> twice. Nevertheless, QEMU patch will follow.
> 
>  arch/x86/kvm/vmx.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index f90320b..6a0c2fa 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -2455,6 +2455,8 @@ static int vmx_get_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
>  	return 1;
>  }
>  
> +static void vmx_leave_nested(struct kvm_vcpu *vcpu);
> +
>  static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>  {
>  	u32 msr_index = msr_info->index;
> @@ -2470,6 +2472,8 @@ static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>  				& FEATURE_CONTROL_LOCKED)
>  			return 0;
>  		to_vmx(vcpu)->nested.msr_ia32_feature_control = data;
> +		if (host_initialized && data == 0)
> +			vmx_leave_nested(vcpu);
>  		return 1;
>  	}
>  
> @@ -8488,6 +8492,16 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu)
>  }
>  
>  /*
> + * Forcibly leave nested mode in order to be able to reset the VCPU later on.
> + */
> +static void vmx_leave_nested(struct kvm_vcpu *vcpu)
> +{
> +	if (is_guest_mode(vcpu))
> +		nested_vmx_vmexit(vcpu);
> +	free_nested(to_vmx(vcpu));
> +}
> +
> +/*
>   * L1's failure to enter L2 is a subset of a normal exit, as explained in
>   * 23.7 "VM-entry failures during or after loading guest state" (this also
>   * lists the acceptable exit-reason and exit-qualification parameters).
> 

Applied, thanks!

Paolo