Re: [PATCH 15/28] KVM: VMX: enable use of MBEC

[David Riley]

see inline.

On 4/30/26 5:10 PM, Paolo Bonzini wrote:
> [...]
>
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 337bbfecc021..72a75fa33c93 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -114,6 +114,9 @@ module_param(emulate_invalid_guest_state, bool, 0444);
>   static bool __read_mostly fasteoi = 1;
>   module_param(fasteoi, bool, 0444);
>   
> +bool __read_mostly enable_mbec = 1;
> +module_param_named(mbec, enable_mbec, bool, 0444);
> +
>   module_param(enable_apicv, bool, 0444);
>   module_param(enable_ipiv, bool, 0444);
>   
> @@ -2773,6 +2776,7 @@ static int setup_vmcs_config(struct vmcs_config *vmcs_conf,
>   			return -EIO;
>   
>   		vmx_cap->ept = 0;
> +		_cpu_based_2nd_exec_control &= ~SECONDARY_EXEC_MODE_BASED_EPT_EXEC;
>   		_cpu_based_2nd_exec_control &= ~SECONDARY_EXEC_EPT_VIOLATION_VE;
>   	}
>   	if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) &&
> @@ -4735,6 +4739,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx)
>   	 */
>   	exec_control &= ~SECONDARY_EXEC_ENABLE_VMFUNC;
>   
> +	if (!enable_mbec)
> +		exec_control &= ~SECONDARY_EXEC_MODE_BASED_EPT_EXEC;
> +
>   	/* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
>   	 * in vmx_set_cr4.  */
>   	exec_control &= ~SECONDARY_EXEC_DESC;
> @@ -7823,6 +7830,11 @@ u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
>   	return (MTRR_TYPE_WRBACK << VMX_EPT_MT_EPTE_SHIFT);
>   }
>   
> +bool vmx_tdp_has_smep(struct kvm *kvm)
> +{
> +	return enable_mbec;
> +}
> +
>   static void vmcs_set_secondary_exec_control(struct vcpu_vmx *vmx, u32 new_ctl)
>   {
>   	/*
> @@ -8622,6 +8634,8 @@ __init int vmx_hardware_setup(void)
>   
>   	if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
>   		enable_ept_ad_bits = 0;
> +	if (!cpu_has_ept_mbec() || !enable_ept)
> +		enable_mbec = 0;
>   
>   	if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
>   		enable_unrestricted_guest = 0;
> @@ -8683,7 +8697,7 @@ __init int vmx_hardware_setup(void)
>   	set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
>   
>   	if (enable_ept)
> -		kvm_mmu_set_ept_masks(enable_ept_ad_bits);
> +		kvm_mmu_set_ept_masks(enable_ept_ad_bits, enable_mbec);
This patch introduces a build failure for me on v7.1-rc2
(and v7.1-rc1) due to a function signature mismatch for
kvm_mmu_set_ept_masks.

In this patch, the call site in arch/x86/kvm/vmx/vmx.c is updated to
pass two arguments:
kvm_mmu_set_ept_masks(enable_ept_ad_bits, enable_mbec);

However, the definition in arch/x86/kvm/mmu/spte.c and the declaration
in arch/x86/kvm/mmu.h appear to have remained single-argument
functions:
void kvm_mmu_set_ept_masks(bool has_ad_bits);

This results in:
error: too many arguments to function ‘kvm_mmu_set_ept_masks’

>   	else
>   		vt_x86_ops.get_mt_mask = NULL;
>   
> diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> index db84e8001da5..0a4e263c4095 100644
> --- a/arch/x86/kvm/vmx/vmx.h
> +++ b/arch/x86/kvm/vmx/vmx.h
> @@ -567,6 +567,7 @@ static inline u8 vmx_get_rvi(void)
>   	 SECONDARY_EXEC_ENABLE_VMFUNC |					\
>   	 SECONDARY_EXEC_BUS_LOCK_DETECTION |				\
>   	 SECONDARY_EXEC_NOTIFY_VM_EXITING |				\
> +	 SECONDARY_EXEC_MODE_BASED_EPT_EXEC |				\
>   	 SECONDARY_EXEC_ENCLS_EXITING |					\
>   	 SECONDARY_EXEC_EPT_VIOLATION_VE)
>   
> diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
> index d09abeac2b56..69cf276be88e 100644
> --- a/arch/x86/kvm/vmx/x86_ops.h
> +++ b/arch/x86/kvm/vmx/x86_ops.h
> @@ -103,6 +103,7 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
>   int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
>   int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr);
>   u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio);
> +bool vmx_tdp_has_smep(struct kvm *kvm);
>   
>   void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
>   		       u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code);