From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDA5F4C77A7 for ; Tue, 5 May 2026 19:53:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778010800; cv=none; b=YRHxtzWpOR7HAgyJ+it2PJHi5+iZx7wqqdNCfMqfjeQzu0ztSMIm62aoC7LaSQn+CGDsYc1fdvGXbkBxKamkdjJwDuphvEvNA5HfADtxEWCWARnQZa/hTA+GIzYnMq+Cnh97bVfd+D8GSKNBJa3cSwWx1NIiY0wjvNTNfsSrJRw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778010800; c=relaxed/simple; bh=hlFbZLuDctOr5fRl9zPu6wXHpmzUeN74wXoDTN0J3eU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Apnvp46nK4MMvCrlQ5d5XOBu3uW1oPAibGN4Io2KLuHa0FDCsNOpatyJ50sNUCtY4xvJ2bDt1zHOVkg0yA1Vx9pLVcexOnpgMnHQApHwGQ5xss/WoXIaH7qHswN8sgtYvPK2x5lBcpNE26nDu5X7wZOqBhpqpN0i+qoFk2in78A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=KMv4/iZV; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=GgolTBct; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="KMv4/iZV"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="GgolTBct" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778010798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=otDQpVDmvckURKbD5WKZEO96KuUH2bQ7UgJHC9+Btxk=; b=KMv4/iZVAFxZd1cTBTvlJ64t3pzamhRm2EvaVHBZswozP/zRw52YS5nMm9q5Jx5WdxOmUH BvO4k1enz44FDL3xgZmxaqHyKpnGqaJ5r6PNYJFzdupl+8n41RVgTOgNkE0CDiTO4w9e67 M4Vp+iIqCoKsbLyFTIQnAsnKhFi8f3c= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-472-_J9c4NnKPJWKMkyBwvWo4Q-1; Tue, 05 May 2026 15:53:16 -0400 X-MC-Unique: _J9c4NnKPJWKMkyBwvWo4Q-1 X-Mimecast-MFC-AGG-ID: _J9c4NnKPJWKMkyBwvWo4Q_1778010796 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-488f973ddfeso41387515e9.3 for ; Tue, 05 May 2026 12:53:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1778010795; x=1778615595; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=otDQpVDmvckURKbD5WKZEO96KuUH2bQ7UgJHC9+Btxk=; b=GgolTBctObFHFGxFEwVyCZmVy0A7b2S2fFV2mg3mhkbW3ruJQrbSztot6pqS9+e4g5 7LSrH5ElJefiAYy99kjsY3wnal1PCJvlNVbNV8NDhr4Pk3gZumu7p8hOqekEzDcpUIyy TSCHmLfr6Hh17V0g2fgNiN2x094QBBM2d5FQz2Iqe64ZwtiI7vHM80/GXzEeAK0+ct8m VuImQx+cPJBwxZDZuboxfQ7OLT/miF56E9aCCM/12E6Tb7y6FP8MpKjJIm2Zs7cJr5l/ /FRUpORKS0UPLyEHACYBPEmEvViV21J8Dg3lYeu/gDT/iRtgy7Wqq51j5sf5+gPaE/FY nlfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778010795; x=1778615595; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=otDQpVDmvckURKbD5WKZEO96KuUH2bQ7UgJHC9+Btxk=; b=dY0SH97YS8D7Z7vVBczVVvztBf7rrHVLERDzsDdw35/qShH6mmo1/+d74rZzYtp7X+ kW7WqRs6+4+mqVjjL39jzufWTuuodwitoVRge1TEkLQHc0O6LPxv5ycF0AyfSxOjbmbM rOF1U14V9FNpaez9qe3LlquqlbEndS95UvCWtD49gQNt1EbRdfKpBeIoVRMSocykKlAu vUhq3dy4T8o5Ih39gY8X+Lypa5H+lb91gWz5oHuBc9Czrih1Lhpst5mXpYRpFtsWWOnX qoWn8DRcTl7JLuTSndqHPLdTncQXHXuPBHgHLJ8scSc0jQgRaK+YQdqm+lrZIXIBJQSN h3VQ== X-Gm-Message-State: AOJu0YxKNiykGrKFH/zcVub51LGue29/blgUZ4U7BFo86wBRv/TpaGB1 T0HnPAmEXLb2sjsZvpVQy+CKJYca6wbQThvNdInqlrzgfiZsL4z+zwBAhozDXcVxYCDKmfONo5r hOqKR46gYglhTIvCVjVdLdSKvkb+/2E2TK4CZPFTR9ZzvaWTww8mxy1zorg1bptU3NCjfSxDP7F IK3TWstOWysEAvi3bEytzNh7i14x9l67HtxGuYzX7R34qeSxX2ug== X-Gm-Gg: AeBDievwfEsBPVqC43E1LVuyQ5gcxH2wVcnqjkSomVROel56LwPNjBOA3KUFNUX184I 9ySkz5x3ztJ5DOi/QkyLlSJyvBkI3cYXjf2rgUyPWH4WWnc2AbYGWcqWOmn1U7t6b89utxq1OSO w0F7YOiKrd+MzJ1zBppMO54N4gZ9tJWJPfPdvusot48dBzDWV5qY1FmDazg3ihDWEdkVNNNzO0a vbuVc6F87+C1ep4VT8R/sSUB1XnSrliZ8qoBIpHj2LFsinCKh2AfkaPm+I4oXSdH0X0PxovLsPO Awe+UGUoK3vIDjdVH/YLaUulX85a+U5se3Za2p7puXQms4rZN8hYNQFa6HineMGxJ99neYigfg4 O4sp8yJpfT7dGyiNXMElS3y1ZvBE+IcHqaF3KPzCp6ENknu+E7cfXJI7LI1sRgrtC511Ga+JLbT orXo0AWqWUWG21lOfKwwgJE8+ynFGzvOR/Z9ymd9E= X-Received: by 2002:a05:600c:2d16:b0:48a:72ab:f88c with SMTP id 5b1f17b1804b1-48e52be1069mr574835e9.17.1778010795334; Tue, 05 May 2026 12:53:15 -0700 (PDT) X-Received: by 2002:a05:600c:2d16:b0:48a:72ab:f88c with SMTP id 5b1f17b1804b1-48e52be1069mr574525e9.17.1778010794893; Tue, 05 May 2026 12:53:14 -0700 (PDT) Received: from [192.168.10.48] ([176.206.106.181]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48a824f9f0dsm405542435e9.15.2026.05.05.12.53.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 05 May 2026 12:53:13 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: d.riley@proxmox.com, jon@nutanix.com Subject: [PATCH 19/28] KVM: nVMX: advertise MBEC to nested guests Date: Tue, 5 May 2026 21:52:17 +0200 Message-ID: <20260505195226.563317-20-pbonzini@redhat.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260505195226.563317-1-pbonzini@redhat.com> References: <20260505195226.563317-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jon Kohler Advertise SECONDARY_EXEC_MODE_BASED_EPT_EXEC (MBEC) to userspace, which allows userspace to expose and advertise the feature to the guest. When MBEC is enabled by the guest, it is passed to the MMU via cr4_smep, and to the processor by the merging of vmcs12->secondary_vm_exec_control into the VMCS02's secondary VM execution controls. Signed-off-by: Jon Kohler Message-ID: <20251223054806.1611168-9-jon@nutanix.com> Tested-by: David Riley Signed-off-by: Paolo Bonzini --- arch/x86/kvm/mmu.h | 2 +- arch/x86/kvm/mmu/mmu.c | 7 ++++--- arch/x86/kvm/mmu/spte.c | 10 ++++++---- arch/x86/kvm/vmx/nested.c | 11 +++++++++++ 4 files changed, 22 insertions(+), 8 deletions(-) diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h index 23bc5b18efd0..e1e3869f568b 100644 --- a/arch/x86/kvm/mmu.h +++ b/arch/x86/kvm/mmu.h @@ -100,7 +100,7 @@ void kvm_init_shadow_npt_mmu(struct kvm_vcpu *vcpu, unsigned long cr0, unsigned long cr4, u64 efer, gpa_t nested_cr3); void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly, int huge_page_level, bool accessed_dirty, - gpa_t new_eptp); + bool mbec, gpa_t new_eptp); bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu); int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code, u64 fault_address, char *insn, int insn_len); diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index a5b68f18b220..ededc26c6675 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -5959,7 +5959,7 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_init_shadow_npt_mmu); static union kvm_cpu_role kvm_calc_shadow_ept_root_page_role(struct kvm_vcpu *vcpu, bool accessed_dirty, - bool execonly, u8 level) + bool execonly, u8 level, bool mbec) { union kvm_cpu_role role = {0}; @@ -5969,6 +5969,7 @@ kvm_calc_shadow_ept_root_page_role(struct kvm_vcpu *vcpu, bool accessed_dirty, */ WARN_ON_ONCE(is_smm(vcpu)); role.base.level = level; + role.base.cr4_smep = mbec; role.base.has_4_byte_gpte = false; role.base.direct = false; role.base.ad_disabled = !accessed_dirty; @@ -5984,13 +5985,13 @@ kvm_calc_shadow_ept_root_page_role(struct kvm_vcpu *vcpu, bool accessed_dirty, void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly, int huge_page_level, bool accessed_dirty, - gpa_t new_eptp) + bool mbec, gpa_t new_eptp) { struct kvm_mmu *context = &vcpu->arch.guest_mmu; u8 level = vmx_eptp_page_walk_level(new_eptp); union kvm_cpu_role new_mode = kvm_calc_shadow_ept_root_page_role(vcpu, accessed_dirty, - execonly, level); + execonly, level, mbec); if (new_mode.as_u64 != context->cpu_role.as_u64) { /* EPT, and thus nested EPT, does not consume CR0, CR4, nor EFER. */ diff --git a/arch/x86/kvm/mmu/spte.c b/arch/x86/kvm/mmu/spte.c index f41573b0ccfa..d2f5f7dd8fe1 100644 --- a/arch/x86/kvm/mmu/spte.c +++ b/arch/x86/kvm/mmu/spte.c @@ -517,10 +517,12 @@ void kvm_mmu_set_ept_masks(bool has_ad_bits) * host's MBEC setting does not matter. On hardware without MBEC * the XU bit is reserved-as-ignored, and setting it does no harm. * - * For nested EPT MBEC is not supported, but bit 10 of the gPTE has - * no effect because (a) is_present_gpte() does not treat it as a - * present bit, and (b) permission_fault() uses an mmu->permissions[] - * array that effectively ignores ACC_USER_EXEC_MASK. + * For nested EPT, when MBEC is disabled by L1, correctness relies + * on (a) ignoring bit 10 of the gPTE in is_present_gpte(), rather + * than treating it as a present bit, and (b) permission_fault() + * using an mmu->permissions[] array that effectively ignores + * ACC_USER_EXEC_MASK. Bit 10 of the gPTE does end up mirrored + * in the sPTEs but is ignored because L2 runs with MBEC disabled. */ shadow_xu_mask = VMX_EPT_USER_EXECUTABLE_MASK; shadow_present_mask = VMX_EPT_SUPPRESS_VE_BIT; diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 84f5c25a1f12..bc1046f32ebc 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -469,6 +469,13 @@ static void nested_ept_inject_page_fault(struct kvm_vcpu *vcpu, vmcs12->guest_physical_address = fault->address; } +static inline bool nested_ept_mbec_enabled(struct kvm_vcpu *vcpu) +{ + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); + + return nested_cpu_has2(vmcs12, SECONDARY_EXEC_MODE_BASED_EPT_EXEC); +} + static void nested_ept_new_eptp(struct kvm_vcpu *vcpu) { struct vcpu_vmx *vmx = to_vmx(vcpu); @@ -477,6 +484,7 @@ static void nested_ept_new_eptp(struct kvm_vcpu *vcpu) kvm_init_shadow_ept_mmu(vcpu, execonly, ept_lpage_level, nested_ept_ad_enabled(vcpu), + nested_ept_mbec_enabled(vcpu), nested_ept_get_eptp(vcpu)); } @@ -7257,6 +7265,9 @@ static void nested_vmx_setup_secondary_ctls(u32 ept_caps, msrs->ept_caps |= VMX_EPT_AD_BIT; } + if (enable_mbec) + msrs->secondary_ctls_high |= + SECONDARY_EXEC_MODE_BASED_EPT_EXEC; /* * Advertise EPTP switching irrespective of hardware support, * KVM emulates it in software so long as VMFUNC is supported. -- 2.54.0