Re: KVM Nested L2 guest startup problems

[Paolo Bonzini <pbonzini@redhat.com>]

Il 07/05/2014 17:30, Abel Gordon ha scritto:
> > ... which we already do.  The only secondary execution controls we allow are
> > APIC page, unrestricted guest, WBINVD exits, and of course EPT.
> 
> But we don't verify if L1  tries to enable the feature for L1 (even if
> it's not exposed)... Or do we ?

Yes, we do:

        if (!vmx_control_verify(vmcs12->cpu_based_vm_exec_control,
              nested_vmx_procbased_ctls_low, nested_vmx_procbased_ctls_high) ||
            !vmx_control_verify(vmcs12->secondary_vm_exec_control,
              nested_vmx_secondary_ctls_low, nested_vmx_secondary_ctls_high) ||
            !vmx_control_verify(vmcs12->pin_based_vm_exec_control,
              nested_vmx_pinbased_ctls_low, nested_vmx_pinbased_ctls_high) ||
            !vmx_control_verify(vmcs12->vm_exit_controls,
              nested_vmx_exit_ctls_low, nested_vmx_exit_ctls_high) ||
            !vmx_control_verify(vmcs12->vm_entry_controls,
              nested_vmx_entry_ctls_low, nested_vmx_entry_ctls_high))
        {
                nested_vmx_failValid(vcpu, VMXERR_ENTRY_INVALID_CONTROL_FIELD);
                return 1;
        }

Paolo