Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH v2 3/7] KVM: nVMX: Explicitly check for valid guest state
 for !unrestricted guest
To:     Sean Christopherson <sean.j.christopherson@intel.com>
Cc:     Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, Dan Cross <dcross@google.com>,
        Peter Shier <pshier@google.com>
References: <20200923184452.980-1-sean.j.christopherson@intel.com>
 <20200923184452.980-4-sean.j.christopherson@intel.com>
From:   Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <0fc761eb-8758-ae96-65b1-90cc4d32f043@redhat.com>
Date:   Fri, 25 Sep 2020 23:33:23 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.11.0
MIME-Version: 1.0
In-Reply-To: <20200923184452.980-4-sean.j.christopherson@intel.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 23/09/20 20:44, Sean Christopherson wrote:
> +bool __vmx_guest_state_valid(struct kvm_vcpu *vcpu)
>  {
> -	if (enable_unrestricted_guest)
> -		return true;
> -
>  	/* real mode guest state checks */
>  	if (!is_protmode(vcpu) || (vmx_get_rflags(vcpu) & X86_EFLAGS_VM)) {
>  		if (!rmode_segment_valid(vcpu, VCPU_SREG_CS))
> diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> index d7ec66db5eb8..e147f180350f 100644
> --- a/arch/x86/kvm/vmx/vmx.h
> +++ b/arch/x86/kvm/vmx/vmx.h
> @@ -343,6 +343,15 @@ void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
>  void vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
>  u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa,
>  		   int root_level);
> +
> +bool __vmx_guest_state_valid(struct kvm_vcpu *vcpu);
> +static inline bool vmx_guest_state_valid(struct kvm_vcpu *vcpu)
> +{
> +	if (enable_unrestricted_guest)
> +		return true;
> +
> +	return __vmx_guest_state_valid(vcpu);

This is now "if (is_unrestricted_guest (vcpu))", but the patch otherwise
applies.

Paolo