Re: [PATCH v7 7/7] KVM: SVM: Add Page modification logging support

[Yosry Ahmed <yosry@kernel.org>]

> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 4ef9bc6a553f3..dd30aef9fc497 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -882,6 +882,12 @@ static void nested_vmcb02_prepare_control(struct vcpu_svm *svm)
>  	vmcb02->control.msrpm_base_pa = vmcb01->control.msrpm_base_pa;
>  	vmcb_mark_dirty(vmcb02, VMCB_PERM_MAP);
>  
> +	/* Clear PML fields to avoid stale data in vmcb02. */
> +	if (pml) {
> +		vmcb02->control.pml_addr = 0;
> +		vmcb02->control.pml_index = -1;
> +	}

I think the comment here is misleading. vmcb02 is allocated with
__GFP_ZERO, and IIUC pml_index should not matter when pml_addr is zero.
This is strictly for hardening as far as I can tell, especially looking
at commit c3bb9a20834f ("KVM: nVMX: Disable PML in hardware when running
L2"), which introduced something similar for VMX.

So maybe something like:
	/*
	 * PML is never enabled in hardware for L2. Make sure that an
	 * unexpected PML write would trigger a PML_FULL VM-Exit.
	 */

Also, the above commit also hanlded a PML_FULL VM-Exit as unexpected,
maybe we want to do that here as well? Or is that too paranoid?

Annoyingly, the unexpected exit reason handling is in
svm_invoke_exit_handler(), but the guest mode check is in
svm_handle_exit(), so if we do that we may need to move some code
around.