From nobody Sat Apr 4 04:36:35 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D9FE288C34 for ; Sat, 21 Mar 2026 00:10:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774051837; cv=none; b=MLW0eKdDhUdyX3n9bIxh0j7MoBkoRDXZS/HaO26vwL7VyGNq70aHrA65VnPKJqvCtk28PEDubXxv32sm/Db81cUm2Ov6PrseBWXf038ZVfVcyEzSjWewIkfJGluFOUc4yYn+1M2FBfAmRFD2rONK425nIhhXgiw81nd5XVRxdNw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774051837; c=relaxed/simple; bh=hR6ikdWuhI2qG+icGaUmLS04/GWkH1r6O8oArtk4uzs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=oYWVqkvHcdMMo1piQawZp68epMsKrL0dUr7I28moQW4f1p6ylizXJL5+hLwJ5+BWHKAjTgJ7Hy1I3/VUrEcQfycuye9iFm8VjN/vCKQZWKW454KTwixvMnp6QIogyW5G1XWB2hPxk0Ehj2/fMU1rxms9KwbLustumAGcVMImvFg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=h0/CW4nR; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=cLEmIy9i; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="h0/CW4nR"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="cLEmIy9i" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774051835; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dMltVXI0rnLkVBMnchf5NfLX7cwXpJxqWzPAkjBf7Ao=; b=h0/CW4nRKd3Jux9g0lt1GKp9CGFN5+RIHUwUJfUaQdMk/Fftjccqp91rTMNZrxsvwkwqbv i0K1puZVA4uameJPhgwDD01F7slRSNfZpYxoqkV76yWvPUyBeJX86IVDGwiF51VDDt3ACz qazrzkUpvVHygI0e5qbDEFfO6W76QaA= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-606-1S6RW8M9Py2MtIE20Lgpyg-1; Fri, 20 Mar 2026 20:10:33 -0400 X-MC-Unique: 1S6RW8M9Py2MtIE20Lgpyg-1 X-Mimecast-MFC-AGG-ID: 1S6RW8M9Py2MtIE20Lgpyg_1774051833 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-43b41d45be4so2498277f8f.0 for ; Fri, 20 Mar 2026 17:10:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774051832; x=1774656632; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=dMltVXI0rnLkVBMnchf5NfLX7cwXpJxqWzPAkjBf7Ao=; b=cLEmIy9iSI0GmWxz4PlRNzDh7R/Dvw8Q/037acIQKFqNWOfO3mgvmLpBXoFQd/REhk Al186fQw+u1aJOgTn2qCPmTOCk9Jn2mSUAI4ys2Vb1ATES5yiAWRpMDH2OjcBXuwnNDS OMN1PR6izNcowtAu7KgLX5p7W2K5GERvTKh6i24LiglVLoxDLWefNqSbR+5hkUcYScOi hXUsKBRdVUzGp4GPBwtue2csgwfE6iVD9KMesdsMvkB9JZaYaiWv4ifUQtyMKVh3T5dN tNPcLksAtW1Nqm73YkEyDNcV3ZPklbRkXgrl52AVe+jO8zAZECtBZmU/frh2hDooH/Dy DyxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774051832; x=1774656632; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=dMltVXI0rnLkVBMnchf5NfLX7cwXpJxqWzPAkjBf7Ao=; b=P2t/xpS4B8/NcBuds9tUBDowuTXoZEH0QZODmhR5zoEJiBDqnPvXV9fQ6ALAzD3DW5 0SQVs90PkjKv5W2U4+jpa05v4Ui0o+kWxnqS5+F+oh7z98OSGK9FQXJwJA13fiIaU48g R9Ga4xvF4K5PP5vsb8YVmBjwHTHirgKiNwqOk5Mdf3u86jMPzunrUYpFq0PB1X3Fm6XH rEBqt5xqLUjsDJOSrLubda6rLB5qKYHDvCVmEMmP5f7yf6Ip8vDsGlig4a5z4HVe1YUC T3mr/QR/vsUNpEpOb5NG/PQEj9tcZ1RGumfjSa3MMZqRK+gKyANM0cEiQq57n0g6MIyd JfEw== X-Gm-Message-State: AOJu0Yz/LOOHeEyymdMQl89/GVeYmCL2dUpmCiew1Wmp9V38dB5iMIyD KLl+Zqi7vIbPTPLClrsL3S1DT4pxgfWPVeoPnWZCj9d2XAB8kgdh3DsYMwiiCnef9jTMDfMI/Qb esWjKjgixzNPeWwMUicS3jMe9UMxvdSJuU/ifgJjxM+wolMGnApCofZpnhAx+uPa2KTD5o7Uz+O txK9T3xWsSGsqdyEGcBDBltcVuKHrWlVdtN59571aEkLA/6m/q3A== X-Gm-Gg: ATEYQzzFonBozVvIu3TmSrTiE60EjeZa+W+1bGUkTBgHdwpNuJKwykQPLj3/Di08LTT /89e1WchfDXUwxh8s/XrIdODwKUwGB+Yb0EbJhqIxlrF1NB85cN2xkhTm13FVMvqibxlS9/kRrs fjarvNDubngwwayKzNkD82tjmRl8eBy1iYQTU//rtc97Qbn1UpV20YUoj3JkEUBP6HwjQ5Ccxdv s60eIhtfzFZvAk+T5o9C4rWmo7JWU4KLESmkOSvaeGZyKyRcdG8yLAjb07O6q/AiZxsT7mGpTA9 fMuDEDa7jGBcfftWBI6FUbIgY+VOWz0V4AT5yky4aRWTmbxwIf24RTudeVp1dtn3VZwJYrENsTz 5ijcqS0rtElhI9TzEtb0NC92upwyeF2TTh25ITBalf70nZfcUDJ2rrOwG3gpyvL12B3zPRfbmVS +L3C4Din+y6ypOjyVlcpisWwjY X-Received: by 2002:a05:6000:2b10:b0:43b:3c53:283d with SMTP id ffacd0b85a97d-43b57729855mr9903528f8f.21.1774051831880; Fri, 20 Mar 2026 17:10:31 -0700 (PDT) X-Received: by 2002:a05:6000:2b10:b0:43b:3c53:283d with SMTP id ffacd0b85a97d-43b57729855mr9903503f8f.21.1774051831384; Fri, 20 Mar 2026 17:10:31 -0700 (PDT) Received: from [192.168.10.48] ([151.49.85.67]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b64703650sm9497992f8f.20.2026.03.20.17.10.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Mar 2026 17:10:27 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Jon Kohler , Marcelo Tosatti , Nikunj A Dadhania , Amit Shah , Sean Christopherson Subject: [PATCH 20/22] KVM: SVM: enable GMET and set it in MMU role Date: Sat, 21 Mar 2026 01:09:29 +0100 Message-ID: <20260321000931.1947084-21-pbonzini@redhat.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260321000931.1947084-1-pbonzini@redhat.com> References: <20260321000931.1947084-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Set the GMET bit in the nested control field. This has effectively no impact as long as NPT page tables are changed to have U=3D0. Signed-off-by: Paolo Bonzini --- arch/x86/kvm/mmu/mmu.c | 6 +++++- arch/x86/kvm/svm/nested.c | 2 ++ arch/x86/kvm/svm/svm.c | 16 ++++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index eeb8667a283f..06289b2d4f96 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -5734,7 +5734,6 @@ kvm_calc_tdp_mmu_root_page_role(struct kvm_vcpu *vcpu, { union kvm_mmu_page_role role =3D {0}; =20 - role.access =3D ACC_ALL; role.cr0_wp =3D true; role.cr4_smep =3D kvm_x86_call(tdp_has_smep)(vcpu->kvm); role.efer_nx =3D true; @@ -5745,6 +5744,11 @@ kvm_calc_tdp_mmu_root_page_role(struct kvm_vcpu *vcp= u, role.direct =3D true; role.has_4_byte_gpte =3D false; =20 + /* All TDP pages are supervisor-executable */ + role.access =3D ACC_ALL; + if (role.cr4_smep && shadow_user_mask) + role.access &=3D ~ACC_USER_MASK; + return role; } =20 diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 617052c98365..d69bcf52f948 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -773,6 +773,8 @@ static void nested_vmcb02_prepare_control(struct vcpu_s= vm *svm, else vmcb02->control.bus_lock_counter =3D 0; =20 + vmcb02->control.nested_ctl &=3D ~SVM_NESTED_CTL_GMET_ENABLE; + /* Done at vmrun: asid. */ =20 /* Also overwritten later if necessary. */ diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 23cb4beea886..4a4f663b2bd2 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -134,6 +134,9 @@ module_param(pause_filter_count_max, ushort, 0444); bool npt_enabled =3D true; module_param_named(npt, npt_enabled, bool, 0444); =20 +bool gmet_enabled =3D true; +module_param_named(gmet, gmet_enabled, bool, 0444); + /* allow nested virtualization in KVM/SVM */ static int nested =3D true; module_param(nested, int, 0444); @@ -1184,6 +1187,10 @@ static void init_vmcb(struct kvm_vcpu *vcpu) save->g_pat =3D vcpu->arch.pat; save->cr3 =3D 0; } + + if (gmet_enabled) + control->nested_ctl |=3D SVM_NESTED_CTL_GMET_ENABLE; + svm->current_vmcb->asid_generation =3D 0; svm->asid =3D 0; =20 @@ -4423,6 +4430,11 @@ svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned = char *hypercall) hypercall[2] =3D 0xd9; } =20 +static bool svm_tdp_has_smep(struct kvm *kvm) +{ + return gmet_enabled; +} + /* * The kvm parameter can be NULL (module initialization, or invocation bef= ore * VM creation). Be sure to check the kvm parameter before using it. @@ -5147,6 +5159,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata =3D { .write_tsc_multiplier =3D svm_write_tsc_multiplier, =20 .load_mmu_pgd =3D svm_load_mmu_pgd, + .tdp_has_smep =3D svm_tdp_has_smep, =20 .check_intercept =3D svm_check_intercept, .handle_exit_irqoff =3D svm_handle_exit_irqoff, @@ -5377,6 +5390,9 @@ static __init int svm_hardware_setup(void) if (!boot_cpu_has(X86_FEATURE_NPT)) npt_enabled =3D false; =20 + if (!npt_enabled || !boot_cpu_has(X86_FEATURE_GMET)) + gmet_enabled =3D false; + /* Force VM NPT level equal to the host's paging level */ kvm_configure_mmu(npt_enabled, get_npt_level(), get_npt_level(), PG_LEVEL_1G); --=20 2.52.0