Re: [PATCH] KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware"

[Sean Christopherson <seanjc@google.com>]

On Wed, Dec 17, 2025, Chao Gao wrote:
> >+static __init bool cpu_has_vmcs12_field(unsigned int idx)
> >+{
> >+	switch (VMCS12_IDX_TO_ENC(idx)) {
> >+	case VIRTUAL_PROCESSOR_ID: return cpu_has_vmx_vpid();
> >+	case POSTED_INTR_NV: return cpu_has_vmx_posted_intr();
> >+	VMCS12_CASE64(TSC_MULTIPLIER): return cpu_has_vmx_tsc_scaling();
> >+	VMCS12_CASE64(VIRTUAL_APIC_PAGE_ADDR): return cpu_has_vmx_tpr_shadow();
> >+	VMCS12_CASE64(APIC_ACCESS_ADDR): return cpu_has_vmx_virtualize_apic_accesses();
> >+	VMCS12_CASE64(POSTED_INTR_DESC_ADDR): return cpu_has_vmx_posted_intr();
> >+	VMCS12_CASE64(VM_FUNCTION_CONTROL): return cpu_has_vmx_vmfunc();
> >+	VMCS12_CASE64(EPT_POINTER): return cpu_has_vmx_ept();
> >+	VMCS12_CASE64(EPTP_LIST_ADDRESS): return cpu_has_vmx_vmfunc();
> >+	VMCS12_CASE64(XSS_EXIT_BITMAP): return cpu_has_vmx_xsaves();
> >+	VMCS12_CASE64(ENCLS_EXITING_BITMAP): return cpu_has_vmx_encls_vmexit();
> >+	VMCS12_CASE64(GUEST_IA32_PERF_GLOBAL_CTRL): return cpu_has_load_perf_global_ctrl();
> >+	VMCS12_CASE64(HOST_IA32_PERF_GLOBAL_CTRL): return cpu_has_load_perf_global_ctrl();
> >+	case TPR_THRESHOLD: return cpu_has_vmx_tpr_shadow();
> >+	case SECONDARY_VM_EXEC_CONTROL: return cpu_has_secondary_exec_ctrls();
> >+	case GUEST_S_CET: return cpu_has_load_cet_ctrl();
> >+	case GUEST_SSP: return cpu_has_load_cet_ctrl();
> >+	case GUEST_INTR_SSP_TABLE: return cpu_has_load_cet_ctrl();
> >+	case HOST_S_CET: return cpu_has_load_cet_ctrl();
> >+	case HOST_SSP: return cpu_has_load_cet_ctrl();
> >+	case HOST_INTR_SSP_TABLE: return cpu_has_load_cet_ctrl();
> 
> Most fields here are not shadowed, e.g., CET-related fields. So, the plan is
> that new fields should be added here regardless of whether they are shadowed or
> not, right?

Yep.  It'll be mildly annoying to keep up-to-date, but I hopefully having an
"unconditional" rule will be less confusing than limiting the checks to fields
that are allowed to hit the shadow VMCS.

> And GUEST_INTR_STATUS is missing here. It depends on APICv and is handled
> explicitly in init_vmcs_shadow_fields().

Gah, I had that one on my todo list, but got sidetracked for a week and completely
forgot about it.

Thank you!