Re: [PATCH v9 19/26] KVM: nVMX: Enable support for secondary VM exit controls

[Emily Ehlert]

> +	case MSR_IA32_VMX_EXIT_CTLS2:
> +		*pdata = msrs->secondary_exit_ctls;
> +		break;

vmx_get_vmx_msr() returns msrs->secondary_exit_ctls for
MSR_IA32_VMX_EXIT_CTLS2 unconditionally. But IA32_VMX_EXIT_CTLS2 is only
valid if VM-exit controls advertise VM_EXIT_ACTIVATE_SECONDARY_CONTROLS
(bit 63 of IA32_VMX_{TRUE_}EXIT_CTLS). On a vCPU where that bit isn't
exposed to L1, nested_vmx_setup_exit_ctls() never populates
secondary_exit_ctls, yet an L1 RDMSR of 0x493 still succeeds and
returns 0 instead of #GP'ing as it would on bare metal.

The write side already validates against
vmcs_config.nested.secondary_exit_ctls; the read side should likewise gate
on the control being advertised:

	case MSR_IA32_VMX_EXIT_CTLS2:
+		if (!(msrs->exit_ctls_high & VM_EXIT_ACTIVATE_SECONDARY_CONTROLS))
+			return 1;
		*pdata = msrs->secondary_exit_ctls;
		break;

Thanks,
Emily