From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5B554C77C8 for ; Tue, 5 May 2026 19:53:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778010804; cv=none; b=CLyJ8n6/gddj3pohNq7ctsZ7Zdl0hDu1cJDc7uZCRd/YJV9pzy9EFZKOZPAp2Zyb7r4KhLpb5oCKgWevzmJUZumYUMLc3gC+NbhDwoswUOkh8zbXvhkNlcOtspC0aAG25KH1DORg320LJF7DyE7/ZpIz/9yjpI9hh9L20bGmRnY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778010804; c=relaxed/simple; bh=D1zhYJbBOB61+H4UZMjf4+jfU+wYM//h7gA0HvL14Fo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eqqliuhHEDQuRPVrThi+i0FnNxRznQX9+zqS+4/qGD4FxhqUjTKTe4BAf261ZpPGiK09bzzOHWiT6dzX7vGRNwVoSczkmxst0vd0VGJoS+3YyvptEtRJUeZ8xensxBAUTDttv5gdVTptLADTdVsD/V/0aMSrOublYfXHeoXb5sQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=KJN/asoM; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=M2DkgFNq; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="KJN/asoM"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="M2DkgFNq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778010801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ul+fnq/919TIDb0iApWQrJPuaWdJH8uA/BhpwtXzr+4=; b=KJN/asoM01UH5r8YUJkKUC9xcQlf78l4RG9wjNdYSHXwsLOP1fjhQHrIFRmZkA84RTE4ny nI1j9rB1B+DSVmoD53TrY4lcA2m9Amcs4mT5GfdU5P2LsZYUYexZguNOVBwHt/3ueYHax9 wUsaxW/Rk9gngzYAr/7PFnTnVQwvaZY= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-339-SG-xicNbMQePxTW6VlqROQ-1; Tue, 05 May 2026 15:53:19 -0400 X-MC-Unique: SG-xicNbMQePxTW6VlqROQ-1 X-Mimecast-MFC-AGG-ID: SG-xicNbMQePxTW6VlqROQ_1778010798 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4837bfcfe0dso70678875e9.1 for ; Tue, 05 May 2026 12:53:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1778010797; x=1778615597; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ul+fnq/919TIDb0iApWQrJPuaWdJH8uA/BhpwtXzr+4=; b=M2DkgFNqsXOf+8PAtorlEYVCNfT2G81kdyoqVnflLAz7sPoyhXMbfnDMXmKbMkmOXV y8nL7O7TRnPuBOBDGx3+K3+KF1B9R1w/lL/xE9yo7IVTMX2Z94IZUr/AJDDsvU1bVwI6 k/i6RNyhu+iX4ZZL3K/B8F05ApKsXSQVhK8tZmsoNUWQHKgXUeLh6lRdb5gQG08ncgiZ ZmiyltLeDXlwu7MtoxVBpwH3ISRewMwTXvUfFBRaziEb6+qgC8HzUimF3JgrM9PKq9a4 e8yx272oFW9rvRrF165wNpHnSvBgvqNR2xVq0yIog6iGES9JpAEwWzVXYWtAVD+Pp/Uj zgzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778010797; x=1778615597; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=ul+fnq/919TIDb0iApWQrJPuaWdJH8uA/BhpwtXzr+4=; b=o8TFXUSoMTbMaFy/2SZAldIyOhcaHIBFfFenz9IIVHm2HIsmAiNIO+4T4cjTEfVrsv tiP9Cu2W+cShXUt0GENIj5q7rOldUroTvAGwmQjQ32OtMc5Ur9dKhezCGNUAe969syai nAQBggrjLv6t9MJ21FLqug+fouWCn7Zr9t5yiqeiBSqx3CtyiudOrPIGq/xJPA7QGGus F97onet4cCyV97efFr9hdZTwWmO71TRYEFWnQtVQVJ/gaQfkdlVzibjX2wmbGLfN3GzV nv+dyzKaKAGdc9C6/jtD14KNUjot1AnTJDYYu0mxJufwVclUoApe/HFnY+lXkPdAezOe LX7Q== X-Gm-Message-State: AOJu0YwrLAuzqSmudZRyAc6jFHW0ZRSoZfWrmvU/6WBdHcC3FUOxEtwd xj+b8y+tBskOAnM2qhOgyBFKD/TdzElLExIvCQ9yNrgsTTfGSznbNQccDITf5qBVItNVXJLJThr feoSCyI+CT/TQnnFGKv1jgPUBjLC+/4YjXk1mfh9+fhafkCIy1drVmm6DVf8rv63ANEJwDthz03 0buawVcS+lkCQGyLpJ2suFXPhsRzwLDQP64o3KWNxF2ky71RkjBw== X-Gm-Gg: AeBDievnY64j6LgyGEibx2xUj3WSwF1xHP/F5MbaIjkzRzrnZI+O6TBLwj8qx8PneOZ bT102+G4tuu2iHTIva2X0y7X2a/NGQoEGpBr7Pg/Ktps5AsLGMuOWTJT99/JGuGHAyLFUweuFQ0 WW8Qsb883zMS52qvGlujFCLIPmgF48MHkReiNKc3V0fMKMoHJ2IhLCLAa6rFUwRRxGwYUckcwcH KvqM1lrOxVc58DvduyCZBLQ7BxantWoIsUpIRh0ALqpVy6cVsORrzw/NxYCoIfVJ3Jl5R8mlMMV Nw1nEIcHtaj0MxT9F6RzdVEVCdWcZe0gRUwRC2T7WKyQW9My4JNXGiCIavhsy6J0K3VRMf3/oYP 8wHljXmyhTGGCkftZGfnlfcuE/xWYYYyPpcWpyxPfgmY37mMy7WEcLxosq7swtHAxxE9NezRqWc H7fqcI5K/4d7U8dVJ2DUIOhYwtvWUTP2uarCl52TA= X-Received: by 2002:a05:600c:47d6:b0:489:1cda:bbb7 with SMTP id 5b1f17b1804b1-48e521d750fmr5444405e9.25.1778010797529; Tue, 05 May 2026 12:53:17 -0700 (PDT) X-Received: by 2002:a05:600c:47d6:b0:489:1cda:bbb7 with SMTP id 5b1f17b1804b1-48e521d750fmr5444215e9.25.1778010797109; Tue, 05 May 2026 12:53:17 -0700 (PDT) Received: from [192.168.10.48] ([176.206.106.181]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48e52859ac7sm1625355e9.1.2026.05.05.12.53.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 05 May 2026 12:53:15 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: d.riley@proxmox.com, jon@nutanix.com Subject: [PATCH 20/28] KVM: nVMX: allow MBEC with EVMCS Date: Tue, 5 May 2026 21:52:18 +0200 Message-ID: <20260505195226.563317-21-pbonzini@redhat.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260505195226.563317-1-pbonzini@redhat.com> References: <20260505195226.563317-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jon Kohler Extend EVMCS1_SUPPORTED_2NDEXEC to allow MBEC and EVMCS to coexist. Presenting both EVMCS and MBEC simultaneously causes KVM to filter out MBEC and not present it as a supported control to the guest, preventing performance gains from MBEC when Windows HVCI is enabled. The guest may choose not to use MBEC (e.g., if the admin does not enable Windows HVCI / Memory Integrity), but if they use traditional nested virt (Hyper-V, WSL2, etc.), having EVMCS exposed is important for improving nested guest performance. IOW allowing MBEC and EVMCS to coexist provides maximum optionality to Windows users without overcomplicating VM administration. Signed-off-by: Jon Kohler Message-ID: <20251223054806.1611168-8-jon@nutanix.com> Tested-by: David Riley Signed-off-by: Paolo Bonzini --- arch/x86/kvm/vmx/hyperv_evmcs.h | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/vmx/hyperv_evmcs.h b/arch/x86/kvm/vmx/hyperv_evmcs.h index fc7c4e7bd1bf..bc08fe40590e 100644 --- a/arch/x86/kvm/vmx/hyperv_evmcs.h +++ b/arch/x86/kvm/vmx/hyperv_evmcs.h @@ -87,6 +87,7 @@ SECONDARY_EXEC_PT_CONCEAL_VMX | \ SECONDARY_EXEC_BUS_LOCK_DETECTION | \ SECONDARY_EXEC_NOTIFY_VM_EXITING | \ + SECONDARY_EXEC_MODE_BASED_EPT_EXEC | \ SECONDARY_EXEC_ENCLS_EXITING) #define EVMCS1_SUPPORTED_3RDEXEC (0ULL) -- 2.54.0