[PATCH v2 1/2] KVM: nVMX: Do eVMCS consistency check on secondary controls iff they're enable

[Sean Christopherson]

Check that the secondary execution controls are actually enabled before
performing eVMCS-specific consistency checks, as the secondary controls are
supposed to be completely ignored if they're not enabled.  Per the SDM:

  If the "activate secondary controls" primary processor-based VM-execution
  control is 0 (or if the processor does not support the 1-setting of that
  control), no checks are performed on the secondary processor-based
  VM-execution controls. The logical processor operates as if all the
  secondary processor-based VM-execution controls were 0.

Fixes: a83502314ce3 ("x86/kvm/hyper-v: don't allow to turn on unsupported VMX controls for nested guests")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
---
 arch/x86/kvm/vmx/hyperv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/hyperv.c b/arch/x86/kvm/vmx/hyperv.c
index fa41d036acd4..2b40ac32ff06 100644
--- a/arch/x86/kvm/vmx/hyperv.c
+++ b/arch/x86/kvm/vmx/hyperv.c
@@ -169,7 +169,8 @@ int nested_evmcs_check_controls(struct vmcs12 *vmcs12)
 					       vmcs12->cpu_based_vm_exec_control)))
 		return -EINVAL;
 
-	if (CC(!nested_evmcs_is_valid_controls(EVMCS_2NDEXEC,
+	if (nested_cpu_has(vmcs12, CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) &&
+	    CC(!nested_evmcs_is_valid_controls(EVMCS_2NDEXEC,
 					       vmcs12->secondary_vm_exec_control)))
 		return -EINVAL;
 
-- 
2.56.0.567.gdb80ae8cd5-goog