From nobody Thu Apr 2 20:09:43 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0D293A6416 for ; Thu, 26 Mar 2026 18:18:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549112; cv=none; b=mDYCF5ANfuE+ovSBDQrSwDoWk1+PeZBuPmO8mfL7PTOQl9z6YAs6jCbpbVbsK/r6Wh6iIJuLpggdeBsvmErAibE8Ep5+Vz19UOA6h05EGQYoCsd+72LshTTaYnotBN/iywRiksDJgMg7KOFB7byu0V294fHTVW5T7Q2qw5IHdcE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549112; c=relaxed/simple; bh=qRhFsWjjq1QHV4ESmJrlgg2iUUx+Ynq+/rCxF1atDMs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hsJFi6FD7c6MiP8heQx19lS+cf3MyxsgzweriBu1CohsRTvEWk2MZ91SeDgt33nYPRCYeLU1zPTufuLp8cGhk4oG4eocjoCCKq3G+qZIWIo78UKXrDdnIl5sEGvSsSFPpSh3Uk4rRc8trDjppEbhLkR40uTUr17+0baWGGz0HX4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=f/wfCaL3; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=p5HrN07O; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="f/wfCaL3"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="p5HrN07O" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774549109; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NsBEtpThqUJXE21zAYs9X1eFe9CQW/ThT95VzOz+wKU=; b=f/wfCaL3FE0NH4FaH1aovFkvmUrB1oWBML7ZYubPSRpuvtyXxhflYrm3esCDNIqN590ALX d28Owg8Y56fXddven7so6321OMq5LvoalI6OdDYFftZXLBeMBAsdcqGp6bQ6Z98oP2DRxA BrNA5hs03N9b5HH2Z0Q9+PxV8sZ2HV0= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-562-YbWwW8IPMYOMjsoSygVHvQ-1; Thu, 26 Mar 2026 14:18:27 -0400 X-MC-Unique: YbWwW8IPMYOMjsoSygVHvQ-1 X-Mimecast-MFC-AGG-ID: YbWwW8IPMYOMjsoSygVHvQ_1774549106 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-48532df52c5so11942695e9.1 for ; Thu, 26 Mar 2026 11:18:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774549105; x=1775153905; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NsBEtpThqUJXE21zAYs9X1eFe9CQW/ThT95VzOz+wKU=; b=p5HrN07O0RWfOWRCHl0quHrLxOzOv/5IyG2h4HLVQiziCWRmgCYbaN8ny/ylb7UYA3 Zg5dZ+m5i7etH9WOoUDQ3a/1P+kLCziKRHAHop9KeyKsW7p2ZkcZXouFqcC0zDDatLcS oN81ktMZZfYC08HeVNwRIVD9erD3mMQDo/g7oE03PrhbDKpDZYd0Ad5isiBsEMTOXAeX DlGHTPsZV7n46Ys8+sPXgn1XzgQp6b1EMgfjbL6yEH3o6PYeogQWUDmV7oinCXarPEKV +2sC2+It0t/m1GplNRpxjI0gy701meGwPiFE2IvS9KeAuPreUW+aJivbQ7+4P8broWvD 9GQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774549105; x=1775153905; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=NsBEtpThqUJXE21zAYs9X1eFe9CQW/ThT95VzOz+wKU=; b=kYkOnbUHf7loypBzG7OhcDKvecGlZfc9zi83VF/u6sPflAlbjEr3IvOhvH4li8hk3l qiXw/66PKDh/8acr00YG6rw5yBT+oubYic2Ex+EeDkf56oGHrkbb8W7WyS0VgIzbBxxc kjzuOMpZmSLn8h6MkseOQWMiJHi3lsv5wWLscE7zJZNid7oHh/md5Ut8SFleD+l5u6+f 39pGMW47BS8VK4DrNBttXITPXfyDQJdVe8/BUSJVCqPtn22DPlEv2ydI8zQHdNDTSXsM QrQlf2F0ANzU1ft0OH4P5NWfB0aPoL+xfyAxS2qQIN5y+JbPym9mDI4xYmGlRkaBkTJ8 UeLw== X-Gm-Message-State: AOJu0YyaHnsiaTj+Rzj9ROd86qzDgksGLdeEbSi9YP7o5ioo7jRjEdbA tZXACee2UrlZ/Q3SSbFKFWCLVM4SvlULMERPWqVCcKCgRNQOQywvM1D2xXAhHOSWOxC1U6UMj7+ T84s7PXDL1xmiVbvnQ3s1FWNoslzRyG+sBnciGLVW4BtLqWWrxSlDTdpy2bzVOlRflopNRsllNC TtgNRkmujFxiSWm/wsMaebtEiUIA8+rRXuYEnmRjBB8pPtHqCwNw== X-Gm-Gg: ATEYQzwOBN8pQZoPPIxDiB5jfRoDlgB+AjBHirLoxzBvCQyJ89HMt2fLxlvv21Uro6Q g4og5ytTEuBW6cxS0jr/7PeBwSqIIkDpcsH+wYBaMIQPE8iR9OcOdeu+aCh8c1+/iGvgkKzyXLM 4rXztj8kVYHuCnFpXtStfyvER9n+xgEbtfrMjozdLq0zakxjLyQBbhxkkb+uYSbxJXCPwQOH+0F t7oK/GYsFKRSadGp88BevEMak6QMmAZx67/bIFbs7c4GdWPMfge+hAxv3g3hEIOADERF5Q9m58A Pv0pr/S4i7MnwbZt55bZ0MaN/QHIX6UGFuW/VBm+9Gz0vWAjN+PvW97IIFobxISEXAQ+Q39NJdJ Ql9vOwshwxRWc7aL1WhYemZZpBo5F74APGf7sGtwPCjGz1/3RLuEftWIfNCOv5VhJ2hB+8M6up6 xwgdR/wO1l0K4bEYT3XlPDaWG5 X-Received: by 2002:a05:600c:37cc:b0:483:9139:4c1d with SMTP id 5b1f17b1804b1-48715ffc221mr140191855e9.14.1774549104885; Thu, 26 Mar 2026 11:18:24 -0700 (PDT) X-Received: by 2002:a05:600c:37cc:b0:483:9139:4c1d with SMTP id 5b1f17b1804b1-48715ffc221mr140191135e9.14.1774549104332; Thu, 26 Mar 2026 11:18:24 -0700 (PDT) Received: from [192.168.10.48] ([151.49.85.67]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48722be608bsm58243545e9.0.2026.03.26.11.18.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Mar 2026 11:18:23 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Jon Kohler , Nikunj A Dadhania , Amit Shah , Sean Christopherson , Marcelo Tosatti Subject: [PATCH 22/24] KVM: SVM: enable GMET and set it in MMU role Date: Thu, 26 Mar 2026 19:17:20 +0100 Message-ID: <20260326181723.218115-23-pbonzini@redhat.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260326181723.218115-1-pbonzini@redhat.com> References: <20260326181723.218115-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Set the GMET bit in the nested control field. This has effectively no impact as long as NPT page tables are changed to have U=3D0. Signed-off-by: Paolo Bonzini --- arch/x86/kvm/mmu/mmu.c | 6 +++++- arch/x86/kvm/svm/nested.c | 7 +++++-- arch/x86/kvm/svm/svm.c | 16 ++++++++++++++++ arch/x86/kvm/svm/svm.h | 1 + 4 files changed, 27 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index d9eb059d24de..51eb3e69f3a8 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -5836,7 +5836,6 @@ kvm_calc_tdp_mmu_root_page_role(struct kvm_vcpu *vcpu, { union kvm_mmu_page_role role =3D {0}; =20 - role.access =3D ACC_ALL; role.cr0_wp =3D true; role.cr4_smep =3D kvm_x86_call(tdp_has_smep)(vcpu->kvm); role.efer_nx =3D true; @@ -5847,6 +5846,11 @@ kvm_calc_tdp_mmu_root_page_role(struct kvm_vcpu *vcp= u, role.direct =3D true; role.has_4_byte_gpte =3D false; =20 + /* All TDP pages are supervisor-executable */ + role.access =3D ACC_ALL; + if (role.cr4_smep && shadow_user_mask) + role.access &=3D ~ACC_USER_MASK; + return role; } =20 diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 99edcca7ee64..4c7bc0e7f908 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -829,9 +829,12 @@ static void nested_vmcb02_prepare_control(struct vcpu_= svm *svm, /* Also overwritten later if necessary. */ vmcb02->control.tlb_ctl =3D TLB_CONTROL_DO_NOTHING; =20 - /* nested_cr3. */ - if (nested_npt_enabled(svm)) + /* Use vmcb01 MMU and format if guest does not use nNPT */ + if (nested_npt_enabled(svm)) { + vmcb02->control.nested_ctl &=3D ~SVM_NESTED_CTL_GMET_ENABLE; + nested_svm_init_mmu_context(vcpu); + } =20 vcpu->arch.tsc_offset =3D kvm_calc_nested_tsc_offset( vcpu->arch.l1_tsc_offset, diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e6477affac9a..1705e3cafcb0 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -135,6 +135,9 @@ module_param(pause_filter_count_max, ushort, 0444); bool npt_enabled =3D true; module_param_named(npt, npt_enabled, bool, 0444); =20 +bool gmet_enabled =3D true; +module_param_named(gmet, gmet_enabled, bool, 0444); + /* allow nested virtualization in KVM/SVM */ static int nested =3D true; module_param(nested, int, 0444); @@ -1170,6 +1173,10 @@ static void init_vmcb(struct kvm_vcpu *vcpu, bool in= it_event) save->g_pat =3D vcpu->arch.pat; save->cr3 =3D 0; } + + if (gmet_enabled) + control->nested_ctl |=3D SVM_NESTED_CTL_GMET_ENABLE; + svm->current_vmcb->asid_generation =3D 0; svm->asid =3D 0; =20 @@ -4475,6 +4482,11 @@ svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned = char *hypercall) hypercall[2] =3D 0xd9; } =20 +static bool svm_tdp_has_smep(struct kvm *kvm) +{ + return gmet_enabled; +} + /* * The kvm parameter can be NULL (module initialization, or invocation bef= ore * VM creation). Be sure to check the kvm parameter before using it. @@ -5224,6 +5236,7 @@ struct kvm_x86_ops svm_x86_ops __initdata =3D { .write_tsc_multiplier =3D svm_write_tsc_multiplier, =20 .load_mmu_pgd =3D svm_load_mmu_pgd, + .tdp_has_smep =3D svm_tdp_has_smep, =20 .check_intercept =3D svm_check_intercept, .handle_exit_irqoff =3D svm_handle_exit_irqoff, @@ -5464,6 +5477,9 @@ static __init int svm_hardware_setup(void) if (!boot_cpu_has(X86_FEATURE_NPT)) npt_enabled =3D false; =20 + if (!npt_enabled || !boot_cpu_has(X86_FEATURE_GMET)) + gmet_enabled =3D false; + /* Force VM NPT level equal to the host's paging level */ kvm_configure_mmu(npt_enabled, get_npt_level(), get_npt_level(), PG_LEVEL_1G); diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 6942e6b0eda6..41042379aa48 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -44,6 +44,7 @@ static inline struct page *__sme_pa_to_page(unsigned long= pa) #define IOPM_SIZE PAGE_SIZE * 3 #define MSRPM_SIZE PAGE_SIZE * 2 =20 +extern bool gmet_enabled; extern bool npt_enabled; extern int nrips; extern int vgif; --=20 2.53.0