On 22/11/2017 10:43, Liran Alon wrote: >>> >>> I think we should also set "vmx->nested.smm.vmxon = false;" >>> after "vmx->nested.vmxon = false;" to correctlyhandle the case >>> VMXOFF is executed from SMI handler. Otherwise, when SMI handler >>> executes RSM, we will reach vmx_pre_leave_smm() which will set >>> again "vmx->nested.vmxon = true;" which I think shouldn't >>> happen. >> >> I didn't see a real scenario for this. > > Actually I later saw that handle_vmoff() calls > nested_vmx_check_permission() which indeed won't allow to continue > executing if running from SMI because vmx->nested.vmxon=false; and > therefore this will raise a #UD. So you are right. :) Still, not clearing the flag is wrong. free_nested is also called by vmx_leave_nested when the host writes 0 to MSR_IA32_FEATURE_CONTROL with KVM_SET_MSRS. Paolo
