Re: [PATCH v9 19/26] KVM: nVMX: Enable support for secondary VM exit controls

[Sean Christopherson]

On Wed, Sep 02, 2026, Sohil Mehta wrote:
> > The write side already validates against
> > 
> > vmcs_config.nested.secondary_exit_ctls; the read side should likewise gate
> > 
> > on the control being advertised:
> > 
> > 
> 
> You are right, the read can be gated on the control being advertised.
> Looking at the rest of the read function, it doesn't seem to have any
> other equivalent check. I think there might be others that have similar
> behavior.

Yes.  Secondary controls, tertiary controls, VMFUNC, EPT/VPID, etc.

> But, I don't see any harm in adding the below check to match the bare
> metal behavior for the new code. I'll add it to v10 unless someone objects.

Normally I want MSR accesses to have the same fault semantics for userspace and
guest accesses, but for the VMX MSRs, I think we should let userspace read at all
times since they're feature MSRs.  E.g. I don't want to end up in a state where
userspace can't read an MSR because it restored/set MSRs in the "wrong" order.

We could plumb in @host_initiated to vmx_get_vmx_msr(), but I think I would rather
add the check in vmx_get_msr().  E.g. shoot for something like:

diff --git arch/x86/kvm/vmx/vmx.c arch/x86/kvm/vmx/vmx.c
index 504630f0eb40..a99cebfe50e0 100644
--- arch/x86/kvm/vmx/vmx.c
+++ arch/x86/kvm/vmx/vmx.c
@@ -2200,6 +2200,10 @@ int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
        case KVM_FIRST_EMULATED_VMX_MSR ... KVM_LAST_EMULATED_VMX_MSR:
                if (!guest_cpu_cap_has(vcpu, X86_FEATURE_VMX))
                        return 1;
+               if (!msr_info->host_initiated &&
+                   !guest_cpu_has_vmx_msr(msr_info->index))
+                       return 1;
+
                if (vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
                                    &msr_info->data))
                        return 1;


That'll require yet another switch(), but reading these MSRs should never be a
hot path.

> > 	case MSR_IA32_VMX_EXIT_CTLS2:
> > 
> > +		if (!(msrs->exit_ctls_high & VM_EXIT_ACTIVATE_SECONDARY_CONTROLS))
> > 
> > +			return 1;
> > 
> > 		*pdata = msrs->secondary_exit_ctls;
> > 
> > 		break;
> > 
>