From nobody Thu Apr 2 20:09:44 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0E633A5E6C for ; Thu, 26 Mar 2026 18:18:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549095; cv=none; b=OG8OiwIPiyragpCWuElNEyGGT0ROKJrv64jq2Y3wvkNhZaKwMzVUglCwr/dxZjHuhUothfNuvFUOOnUcz4kxO6B5BcNfnGLhDEC01m9uKS5yxORHUrHg7w0NVbNCcNE/ZrGNaRH87pGvfPG7rB1Oll8DWEnFsXYDAYgp3pCdi3Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549095; c=relaxed/simple; bh=8jc9qasPQEJtjMNrB6TSw8n8P34GibmcgRAgDSNYJZg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Iji+85ggWlcCKB5HIzo/5aZzhhxmATOD1WuHfS4zUCex41WhNNfq66ZAht1cA6MolW16V2MWyaAD+9EnHLJgFaJCKUHv+MxRyywi4vmN1xONFMaBsXe4R83wZjlGiLFGc+EkEVf1W9ERPrji13QGHDm7UztgH/3geymgh77S5yk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Dz//aLTW; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=OL0V3ZKy; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Dz//aLTW"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="OL0V3ZKy" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774549091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oSdMfPXfsmtQMuSqhfU0sdTptN3/E4detZ+Ck4ZdAzw=; b=Dz//aLTWylRMYt0hqobaDh1YyftU5wFONNQNQubsssL6DY0BCcfqpw+8DKiFgf7VNDrVj1 L09iKqPqTyiB6g2rDxnJYyank3EaLYo4aF2uJ3upWUwwep0euMIlkVJx91/dUi5+jYM31I LpSZePv/+1bI5tUEyerhLveNmAhTwvE= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-479-fHW_yB_aOjiSrIXjwppULw-1; Thu, 26 Mar 2026 14:18:09 -0400 X-MC-Unique: fHW_yB_aOjiSrIXjwppULw-1 X-Mimecast-MFC-AGG-ID: fHW_yB_aOjiSrIXjwppULw_1774549088 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-43b9b8e3af6so112765f8f.0 for ; Thu, 26 Mar 2026 11:18:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774549087; x=1775153887; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oSdMfPXfsmtQMuSqhfU0sdTptN3/E4detZ+Ck4ZdAzw=; b=OL0V3ZKyGV+o46L0eE99uQLNClKT1O9pQEQpSPvFEo78uzj2szx48NUxDy4+2DGZou EZFatAlg2P91EDbESq/RMbQrorMIqcn4MqUpNIlNgsHXGgo6+cWg5oJ2BHmKX4Yav2aN QBXoNt2PnSthvH0TdCaPWFZnCVCbfIfWwQssTr10UDujxB2M6DNM7r3r+t9rbQMpHs/O j739Ca3YwDGtxLKOcDNnayX2PPbQ6AaPM9kLPbeDU3x8ZrC9s16nh45rNdW3dsgxyBTy vDvmSDVSniMiBB84ZUEqRNwM/unolsfR1F6Nr4F7Bs+foRiWFlFszNAx2zgdmNH0uJIr 1vog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774549087; x=1775153887; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=oSdMfPXfsmtQMuSqhfU0sdTptN3/E4detZ+Ck4ZdAzw=; b=FEnI99xyDGONZCncBzQ9w3pjFQEtwdbiZwHoukz4SJHGXmDzG/3xaEmkkHXqGZCJnk gYODd/sH7YQPkBdDXASDQOXEOmwvsA46pbXPqdvchB1Ugpf9l6VPsxSzYKLa74e+fikM ryKBDkGOhFw9BizBya6Lk7jCLxWUIpv8gyiL/uHPfcKJlnvnJZINX5VopO9yscnCPcV9 feSlfud6UpSO7JgzBnCXD98dzSEyRnJNZExquk6sn7tUv7D2lbkhoCIXPg9oK7OE4Mxh EkSErvlZ1BnLxmAkd7VWX/SBL0iijQPzCUHAhX1j4fZj4Xm+3uj/McNB6yNjIDB0A/37 y1Yw== X-Gm-Message-State: AOJu0YwecLYLAwvs2TR8GngAE+WShTLPrNCLCnXeDltGAv/9/qDxBb0Q wyc/rumVPVaRaFOO2lLfso1B9fa6ow1JrRlKtvVwFp95Z/cRNpqYuzCQjj7hz7QJWRtU5gOP/+G IHgzzVzvego6Mr97HTHW1XFLa1sMJONzSZ1EX0rSvteJndVky/pPVQGZ3Dmf5QsO/lO1jDIy/L9 XIRcOszt78THI7mhhczVSOB9LfW0u2gi61KJ8ZA4DD2Zs9IABv6A== X-Gm-Gg: ATEYQzzaJr97lxA8kd80RZb5tAwZFqYw1BH1r8+ORKiwbXOg0xkIDaxZOnBhTQczd+t 7//OZj2F8YGtA4MEdoANWx2TS1xjAxJYDSezdCl7sNdq25HJTPDcaVAoGYgJ8qO1TRD5MpV5QGs xIyN9F4NJDik7XFhg+8H93g89rO+krGlbodK3JhoewUSINx2hFLNnj9m2xzy3kGr+qzk6OBBtxg 2N0EHJ3PsTCreizBmaFEiVAJHuxus/s/MozC2vpxsHaNwZbghhtmBqEDEyrROYx8utc/6/qx2mY tKSB1+0jdB0WaVqwkIO7FV1gbNkKodruKyln7AA0+E+DsyM0ZeMrjggnF3pY4DR6vUjDP6o0DeG s/vzX/E2F4Gak6AMzz3pLiY6nCOxuEv8w84XRUklMrS9jxECVsL53Fye5s99N5Y50Ql/qehL58q crNaOGUy4LcbNBYA7YEuqLLcw8 X-Received: by 2002:a05:6000:40cd:b0:43b:4aba:8f38 with SMTP id ffacd0b85a97d-43b88a956b7mr13404586f8f.47.1774549086905; Thu, 26 Mar 2026 11:18:06 -0700 (PDT) X-Received: by 2002:a05:6000:40cd:b0:43b:4aba:8f38 with SMTP id ffacd0b85a97d-43b88a956b7mr13404514f8f.47.1774549086254; Thu, 26 Mar 2026 11:18:06 -0700 (PDT) Received: from [192.168.10.48] ([151.49.85.67]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b919dfb54sm9816606f8f.31.2026.03.26.11.18.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Mar 2026 11:18:04 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Jon Kohler , Nikunj A Dadhania , Amit Shah , Sean Christopherson , Marcelo Tosatti Subject: [PATCH 15/24] KVM: x86/mmu: add support for MBEC to EPT page table walks Date: Thu, 26 Mar 2026 19:17:13 +0100 Message-ID: <20260326181723.218115-16-pbonzini@redhat.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260326181723.218115-1-pbonzini@redhat.com> References: <20260326181723.218115-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Extend the page walker to support moving bit 10 of the PTEs into ACC_USER_EXEC_MASK and bit 6 of the exit qualification of EPT violation VM exits. Note that while mmu_has_mbec()/cr4_smep affect the interpretation of ACC_USER_EXEC_MASK and add bit 10 as a "present bit" in guest EPT page table entries, they do not affect how KVM operates on SPTEs. That's because the MMU uses explicit ACC_USER_EXEC_MASK/shadow_xu_mask even for the non-nested EPT; the only difference is that ACC_USER_EXEC_MASK and ACC_EXEC_MASK will always be set in tandem outside the nested scenario. Signed-off-by: Paolo Bonzini --- arch/x86/kvm/mmu/mmu.c | 13 +++++++++++-- arch/x86/kvm/mmu/paging_tmpl.h | 27 +++++++++++++++++++++------ 2 files changed, 32 insertions(+), 8 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index e768aeb05886..cd2418fe8708 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -5551,7 +5551,6 @@ static void update_permission_bitmask(struct kvm_mmu = *mmu, bool ept) { unsigned byte; =20 - const u16 x =3D ACC_BITS_MASK(ACC_EXEC_MASK); const u16 w =3D ACC_BITS_MASK(ACC_WRITE_MASK); const u16 r =3D ACC_BITS_MASK(ACC_READ_MASK); =20 @@ -5592,8 +5591,18 @@ static void update_permission_bitmask(struct kvm_mmu= *mmu, bool ept) u16 smapf =3D 0; =20 if (ept) { - ff =3D (pfec & PFERR_FETCH_MASK) ? (u16)~x : 0; + const u16 xs =3D ACC_BITS_MASK(ACC_EXEC_MASK); + const u16 xu =3D ACC_BITS_MASK(ACC_USER_EXEC_MASK); + + if (pfec & PFERR_FETCH_MASK) { + /* Ignore XU unless MBEC is enabled. */ + if (cr4_smep) + ff =3D pfec & PFERR_USER_MASK ? (u16)~xu : (u16)~xs; + else + ff =3D (u16)~xs; + } } else { + const u16 x =3D ACC_BITS_MASK(ACC_EXEC_MASK); const u16 u =3D ACC_BITS_MASK(ACC_USER_MASK); =20 /* Faults from kernel mode accesses to user pages */ diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h index 09e2e630d4b6..95aa1b4fc327 100644 --- a/arch/x86/kvm/mmu/paging_tmpl.h +++ b/arch/x86/kvm/mmu/paging_tmpl.h @@ -124,12 +124,17 @@ static inline void FNAME(protect_clean_gpte)(struct k= vm_mmu *mmu, unsigned *acce *access &=3D mask; } =20 -static inline int FNAME(is_present_gpte)(unsigned long pte) +static inline int FNAME(is_present_gpte)(struct kvm_mmu *mmu, + unsigned long pte) { #if PTTYPE !=3D PTTYPE_EPT return pte & PT_PRESENT_MASK; #else - return pte & 7; + /* + * For EPT, an entry is present if any of bits 2:0 are set. + * With mode-based execute control, bit 10 also indicates presence. + */ + return pte & (7 | (mmu_has_mbec(mmu) ? VMX_EPT_USER_EXECUTABLE_MASK : 0)); #endif } =20 @@ -152,7 +157,7 @@ static bool FNAME(prefetch_invalid_gpte)(struct kvm_vcp= u *vcpu, struct kvm_mmu_page *sp, u64 *spte, u64 gpte) { - if (!FNAME(is_present_gpte)(gpte)) + if (!FNAME(is_present_gpte)(vcpu->arch.mmu, gpte)) goto no_present; =20 /* Prefetch only accessed entries (unless A/D bits are disabled). */ @@ -173,10 +178,17 @@ static bool FNAME(prefetch_invalid_gpte)(struct kvm_v= cpu *vcpu, static inline unsigned FNAME(gpte_access)(u64 gpte) { unsigned access; + /* + * Set bits in ACC_*_MASK even if they might not be used in the + * actual checks. For example, if EFER.NX is clear permission_fault() + * will ignore ACC_EXEC_MASK, and if MBEC is disabled it will + * ignore ACC_USER_EXEC_MASK. + */ #if PTTYPE =3D=3D PTTYPE_EPT access =3D ((gpte & VMX_EPT_WRITABLE_MASK) ? ACC_WRITE_MASK : 0) | ((gpte & VMX_EPT_EXECUTABLE_MASK) ? ACC_EXEC_MASK : 0) | - ((gpte & VMX_EPT_READABLE_MASK) ? ACC_READ_MASK : 0); + ((gpte & VMX_EPT_READABLE_MASK) ? ACC_READ_MASK : 0) | + ((gpte & VMX_EPT_USER_EXECUTABLE_MASK) ? ACC_USER_EXEC_MASK : 0); #else /* * P is set here, so the page is always readable and W/U/!NX represent @@ -331,7 +343,7 @@ static int FNAME(walk_addr_generic)(struct guest_walker= *walker, if (walker->level =3D=3D PT32E_ROOT_LEVEL) { pte =3D mmu->get_pdptr(vcpu, (addr >> 30) & 3); trace_kvm_mmu_paging_element(pte, walker->level); - if (!FNAME(is_present_gpte)(pte)) + if (!FNAME(is_present_gpte)(mmu, pte)) goto error; --walker->level; } @@ -413,7 +425,7 @@ static int FNAME(walk_addr_generic)(struct guest_walker= *walker, */ pte_access =3D pt_access & (pte ^ walk_nx_mask); =20 - if (unlikely(!FNAME(is_present_gpte)(pte))) + if (unlikely(!FNAME(is_present_gpte)(mmu, pte))) goto error; =20 if (unlikely(FNAME(is_rsvd_bits_set)(mmu, pte, walker->level))) { @@ -518,6 +530,9 @@ static int FNAME(walk_addr_generic)(struct guest_walker= *walker, * ACC_*_MASK flags! */ walker->fault.exit_qualification |=3D EPT_VIOLATION_RWX_TO_PROT(pte_acce= ss); + if (mmu_has_mbec(mmu)) + walker->fault.exit_qualification |=3D + EPT_VIOLATION_USER_EXEC_TO_PROT(pte_access); } #endif walker->fault.address =3D addr; --=20 2.53.0