From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7280B3EFD15 for ; Tue, 2 Jun 2026 14:28:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410504; cv=none; b=ShHqT6KMgLrDzPgRY3z2PQpOahRN6b6I/0y3T72kZOgAUAhUjxLqo+yFVtMwXrXBe+ZeO9nmUn1dYw2GiAqsqpAVfobhiOsXDnPnK6begFjBvAt7uctSb7u2cwZa+9yvpZ97dfM4g67FuRsUdjBUy9rbmvCtWwVSinLEpIPYczg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780410504; c=relaxed/simple; bh=aA6yfUlVwrY4lnP4GNVFW1EeuwUWvQUMzztYX0yECG8=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=jP5aj272F8D7rolwI0Z3N7banPODBV3rjx/vsBQjQERmUzyNF71fMrRquQ46so7dlSPYybm+gJOkXHHFNBqpObbaz3RKvjLJlmbPtywpCKqheE1yoednEmYNhdXcbr+0lR2efkJgkEnsAFSH7gnAlPCM+SaD5dyzwNq0bv1yLyA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Jid8SuHG; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=NLPxDiX2; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Jid8SuHG"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="NLPxDiX2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1780410502; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rz7Al6BmtvMaWx4/rV779+0g/KkbqqnrBpIyAytu1MA=; b=Jid8SuHGzPT7qk8J7EpPlTYppXXxiDibsJwhANu4Xo0S521U5Ggv/e5k5uijzWwiuXTfFt b9YPyfFzthoDZ7+c0YtRgJ3BjBXNkJzdT0i/Qy8B/c4w2GpX8lU1goGJqkpoBFI700PAtw rhhF8twVtHzgyI+Jmz2DkZlsjG6OvE4= Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-689-_addwLTWMwWpJ3NV8hDa6Q-1; Tue, 02 Jun 2026 10:28:21 -0400 X-MC-Unique: _addwLTWMwWpJ3NV8hDa6Q-1 X-Mimecast-MFC-AGG-ID: _addwLTWMwWpJ3NV8hDa6Q_1780410501 Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-5176d949c58so15197531cf.0 for ; Tue, 02 Jun 2026 07:28:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1780410501; x=1781015301; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=rz7Al6BmtvMaWx4/rV779+0g/KkbqqnrBpIyAytu1MA=; b=NLPxDiX277CgPbKqIAA5OyNfCOMwhQEF26FyZMzUCd2QNZPMDYUvAkw9kGunTDFVQ0 ByyFokxn+LFuEwrsyIKfHE3gNy28EysZZbsdWGdRUTwf0PneO1b+zvOKffu8BGB/modh N5kb7z/8yJl5LsCwSmWqgmGqnUslD/GenqWCgBoUW3+78Pm9jvqDuC/SpmLju8BETM7c 5w2dktgCtOTVNVOtM4YE3nN75R7mYDKxZebhGfivmYFE7MxEIVHQvtzRnaYRXol1V1GZ H4IYCKQLI1Sz16i4uy1KNyDIoI00uJEBfqUyo4WeC4v0cjLXzO0JqpyywK4F9mchyBLo 0nSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780410501; x=1781015301; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=rz7Al6BmtvMaWx4/rV779+0g/KkbqqnrBpIyAytu1MA=; b=l+lnLKGsupurDEdbVFFr7ktolt+ryPeiggvPrI+jeilzR1fMELppf6uy4VRKMq0FcK 0iPFunomR4mYVNu+2fgTx6gpSyRrjIXnB+n8VdIboJ+sR4hzlosXeznVpxoic8F5Q9u5 E97FBa4Uman7RoCKBffazV6uxzPn0aHdrz4kPjW2cGd1un7SrXloKhSr7/O2c7aUH5bF Sh4iapBOdwHNTXNM620baBiXakbHQoTc6FtD+2t7pjZoT4Nlq8GoCjIXYfAJZWT23S9m L6NjnlQlaa1GbYq1pWQEd9lj+aKsb1RSuGvrszvj8Fq9wOD7JnNiURiWpK5TfGBe0QzL UxZg== X-Forwarded-Encrypted: i=1; AFNElJ97Zv2bmIb/Rmw73MFDek/zXwd4L7BfgAzkaiWJHIG7/y6iwsEdH0Q4ZJ0XnKpMXUxHFNjiQm9mQom9JnI=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4Dok+B8x3a66UFrOnLbjbD3TUnn0qgd9mkOSdrz7A6XN6pJze yaDMmRqiieBXwFUJO0TVQLEMWfWfsNmv7vbLbE+BUQ2raxcbK9wzF2CyaQfYWB+9YdqnvYpjQoN rsusTehu8KWzl8oODMUacW5o9QAGbE2NMStBKRRBdVKlGJxn5fgC0/Fqu0bv7RAE/clkALcejNg == X-Gm-Gg: Acq92OGXGpOGtB5tUnz6kuiyXLNOPg7XnrYe3KPjHjoBfPIQtLOzul+mz2IiVqX4nEt AodZjr1g/r3a4fxvylPPVXKrWSRmcJRp91NkgqylyWBruZF+DjZx4Bheq0MBUucgH9LqmVCkCir xzCkU75CRsaHlOthLN/7dqs19sF1znhyXwS6BWTTpateST+2fq7iZe58l1GgzbUSndKdlvC6Cev 5gnDbsTJk8XJfIcdg90Q07IusNIqaatXzE2bSM3WSHuCa6blIzTb+gi0W7vmKbPYdesbrP8F8aM HoY/rx8y6t/ISVJAES+DnqUlrUdc66zXFLCyl/4yTCCERFcHJhhm9iHXwI+wfc2CuPLW3/FchT8 MSYctdFnjIfpRn6K6hPVVOiC47sjIAnFUCo7SVOw= X-Received: by 2002:a05:622a:2514:b0:516:e6f3:c1e with SMTP id d75a77b69052e-5173a86a534mr220258941cf.54.1780410500735; Tue, 02 Jun 2026 07:28:20 -0700 (PDT) X-Received: by 2002:a05:622a:2514:b0:516:e6f3:c1e with SMTP id d75a77b69052e-5173a86a534mr220258321cf.54.1780410500190; Tue, 02 Jun 2026 07:28:20 -0700 (PDT) Received: from intellaptop.lan ([2607:fea8:fc01:88aa:f1de:f35:7935:804f]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51775c07c29sm110111cf.1.2026.06.02.07.28.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 07:28:19 -0700 (PDT) Message-ID: Subject: Re: [PATCH 19/28] KVM: nVMX: advertise MBEC to nested guests From: mlevitsk@redhat.com To: Paolo Bonzini , linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: d.riley@proxmox.com, jon@nutanix.com Date: Tue, 02 Jun 2026 10:28:18 -0400 In-Reply-To: <20260505195226.563317-20-pbonzini@redhat.com> References: <20260505195226.563317-1-pbonzini@redhat.com> <20260505195226.563317-20-pbonzini@redhat.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.52.4 (3.52.4-2.fc40) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Tue, 2026-05-05 at 21:52 +0200, Paolo Bonzini wrote: > From: Jon Kohler >=20 > Advertise SECONDARY_EXEC_MODE_BASED_EPT_EXEC (MBEC) to userspace, which > allows userspace to expose and advertise the feature to the guest. >=20 > When MBEC is enabled by the guest, it is passed to the MMU via cr4_smep, > and to the processor by the merging of vmcs12->secondary_vm_exec_control > into the VMCS02's secondary VM execution controls. >=20 > Signed-off-by: Jon Kohler > Message-ID: <20251223054806.1611168-9-jon@nutanix.com> > Tested-by: David Riley > Signed-off-by: Paolo Bonzini > --- > =C2=A0arch/x86/kvm/mmu.h=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |=C2= =A0 2 +- > =C2=A0arch/x86/kvm/mmu/mmu.c=C2=A0=C2=A0=C2=A0 |=C2=A0 7 ++++--- > =C2=A0arch/x86/kvm/mmu/spte.c=C2=A0=C2=A0 | 10 ++++++---- > =C2=A0arch/x86/kvm/vmx/nested.c | 11 +++++++++++ > =C2=A04 files changed, 22 insertions(+), 8 deletions(-) >=20 > diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h > index 23bc5b18efd0..e1e3869f568b 100644 > --- a/arch/x86/kvm/mmu.h > +++ b/arch/x86/kvm/mmu.h > @@ -100,7 +100,7 @@ void kvm_init_shadow_npt_mmu(struct kvm_vcpu *vcpu, u= nsigned long cr0, > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 unsigned long cr4, u64 efer, gpa_t nested= _cr3); > =C2=A0void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly, > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 int huge_page_level, bool accessed_dirty, > - =C2=A0=C2=A0=C2=A0=C2=A0 gpa_t new_eptp); > + =C2=A0=C2=A0=C2=A0=C2=A0 bool mbec, gpa_t new_eptp); > =C2=A0bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu); > =C2=A0int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code, > =C2=A0 u64 fault_address, char *insn, int insn_len); > diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c > index a5b68f18b220..ededc26c6675 100644 > --- a/arch/x86/kvm/mmu/mmu.c > +++ b/arch/x86/kvm/mmu/mmu.c > @@ -5959,7 +5959,7 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_init_shadow_npt_= mmu); > =C2=A0 > =C2=A0static union kvm_cpu_role > =C2=A0kvm_calc_shadow_ept_root_page_role(struct kvm_vcpu *vcpu, bool acce= ssed_dirty, > - =C2=A0=C2=A0 bool execonly, u8 level) > + =C2=A0=C2=A0 bool execonly, u8 level, bool mbec) > =C2=A0{ > =C2=A0 union kvm_cpu_role role =3D {0}; > =C2=A0 > @@ -5969,6 +5969,7 @@ kvm_calc_shadow_ept_root_page_role(struct kvm_vcpu = *vcpu, bool accessed_dirty, > =C2=A0 */ > =C2=A0 WARN_ON_ONCE(is_smm(vcpu)); > =C2=A0 role.base.level =3D level; > + role.base.cr4_smep =3D mbec; > =C2=A0 role.base.has_4_byte_gpte =3D false; > =C2=A0 role.base.direct =3D false; > =C2=A0 role.base.ad_disabled =3D !accessed_dirty; > @@ -5984,13 +5985,13 @@ kvm_calc_shadow_ept_root_page_role(struct kvm_vcp= u *vcpu, bool accessed_dirty, > =C2=A0 > =C2=A0void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly, > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 int huge_page_level, bool accessed_dirty, > - =C2=A0=C2=A0=C2=A0=C2=A0 gpa_t new_eptp) > + =C2=A0=C2=A0=C2=A0=C2=A0 bool mbec, gpa_t new_eptp) > =C2=A0{ > =C2=A0 struct kvm_mmu *context =3D &vcpu->arch.guest_mmu; > =C2=A0 u8 level =3D vmx_eptp_page_walk_level(new_eptp); > =C2=A0 union kvm_cpu_role new_mode =3D > =C2=A0 kvm_calc_shadow_ept_root_page_role(vcpu, accessed_dirty, > - =C2=A0=C2=A0 execonly, level); > + =C2=A0=C2=A0 execonly, level, mbec); > =C2=A0 > =C2=A0 if (new_mode.as_u64 !=3D context->cpu_role.as_u64) { > =C2=A0 /* EPT, and thus nested EPT, does not consume CR0, CR4, nor EFER. = */ > diff --git a/arch/x86/kvm/mmu/spte.c b/arch/x86/kvm/mmu/spte.c > index f41573b0ccfa..d2f5f7dd8fe1 100644 > --- a/arch/x86/kvm/mmu/spte.c > +++ b/arch/x86/kvm/mmu/spte.c > @@ -517,10 +517,12 @@ void kvm_mmu_set_ept_masks(bool has_ad_bits) > =C2=A0 * host's MBEC setting does not matter.=C2=A0 On hardware without M= BEC > =C2=A0 * the XU bit is reserved-as-ignored, and setting it does no harm. > =C2=A0 * > - * For nested EPT MBEC is not supported, but bit 10 of the gPTE has > - * no effect because (a) is_present_gpte() does not treat it as a > - * present bit, and (b) permission_fault() uses an mmu->permissions[] > - * array that effectively ignores ACC_USER_EXEC_MASK. > + * For nested EPT, when MBEC is disabled by L1, correctness relies > + * on (a) ignoring bit 10 of the gPTE in is_present_gpte(), rather > + * than treating it as a present bit, and (b) permission_fault() > + * using an mmu->permissions[] array that effectively ignores > + * ACC_USER_EXEC_MASK.=C2=A0 Bit 10 of the gPTE does end up mirrored > + * in the sPTEs but is ignored because L2 runs with MBEC disabled. Makes sense. > =C2=A0 */ > =C2=A0 shadow_xu_mask =3D VMX_EPT_USER_EXECUTABLE_MASK; > =C2=A0 shadow_present_mask =3D VMX_EPT_SUPPRESS_VE_BIT; > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > index 84f5c25a1f12..bc1046f32ebc 100644 > --- a/arch/x86/kvm/vmx/nested.c > +++ b/arch/x86/kvm/vmx/nested.c > @@ -469,6 +469,13 @@ static void nested_ept_inject_page_fault(struct kvm_= vcpu *vcpu, > =C2=A0 vmcs12->guest_physical_address =3D fault->address; > =C2=A0} > =C2=A0 > +static inline bool nested_ept_mbec_enabled(struct kvm_vcpu *vcpu) > +{ > + struct vmcs12 *vmcs12 =3D get_vmcs12(vcpu); > + > + return nested_cpu_has2(vmcs12, SECONDARY_EXEC_MODE_BASED_EPT_EXEC); > +} > + > =C2=A0static void nested_ept_new_eptp(struct kvm_vcpu *vcpu) > =C2=A0{ > =C2=A0 struct vcpu_vmx *vmx =3D to_vmx(vcpu); > @@ -477,6 +484,7 @@ static void nested_ept_new_eptp(struct kvm_vcpu *vcpu= ) > =C2=A0 > =C2=A0 kvm_init_shadow_ept_mmu(vcpu, execonly, ept_lpage_level, > =C2=A0 nested_ept_ad_enabled(vcpu), > + nested_ept_mbec_enabled(vcpu), > =C2=A0 nested_ept_get_eptp(vcpu)); > =C2=A0} > =C2=A0 > @@ -7257,6 +7265,9 @@ static void nested_vmx_setup_secondary_ctls(u32 ept= _caps, > =C2=A0 msrs->ept_caps |=3D VMX_EPT_AD_BIT; > =C2=A0 } > =C2=A0 > + if (enable_mbec) > + msrs->secondary_ctls_high |=3D > + SECONDARY_EXEC_MODE_BASED_EPT_EXEC; > =C2=A0 /* > =C2=A0 * Advertise EPTP switching irrespective of hardware support, > =C2=A0 * KVM emulates it in software so long as VMFUNC is supported. Reviewed-by: Maxim Levitsky Best regards, Maxim Levitsky