Re: [PATCH v9 19/26] KVM: nVMX: Enable support for secondary VM exit controls

[Sohil Mehta]

> 
> The write side already validates against
> 
> vmcs_config.nested.secondary_exit_ctls; the read side should likewise gate
> 
> on the control being advertised:
> 
> 

You are right, the read can be gated on the control being advertised.
Looking at the rest of the read function, it doesn't seem to have any
other equivalent check. I think there might be others that have similar
behavior.

But, I don't see any harm in adding the below check to match the bare
metal behavior for the new code. I'll add it to v10 unless someone objects.

> 
> 	case MSR_IA32_VMX_EXIT_CTLS2:
> 
> +		if (!(msrs->exit_ctls_high & VM_EXIT_ACTIVATE_SECONDARY_CONTROLS))
> 
> +			return 1;
> 
> 		*pdata = msrs->secondary_exit_ctls;
> 
> 		break;
>