Re: [PATCH 15/28] KVM: VMX: enable use of MBEC

[Sean Christopherson]

On Tue, May 05, 2026, Paolo Bonzini wrote:
> @@ -7823,6 +7830,11 @@ u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
>  	return (MTRR_TYPE_WRBACK << VMX_EPT_MT_EPTE_SHIFT);
>  }
>  
> +bool vmx_tdp_has_smep(struct kvm *kvm)
> +{
> +	return enable_mbec;
> +}
> +
>  static void vmcs_set_secondary_exec_control(struct vcpu_vmx *vmx, u32 new_ctl)
>  {
>  	/*
> @@ -8622,6 +8634,8 @@ __init int vmx_hardware_setup(void)
>  
>  	if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
>  		enable_ept_ad_bits = 0;
> +	if (!cpu_has_ept_mbec() || !enable_ept)
> +		enable_mbec = 0;
>  
>  	if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
>  		enable_unrestricted_guest = 0;
> diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> index db84e8001da5..0a4e263c4095 100644
> --- a/arch/x86/kvm/vmx/vmx.h
> +++ b/arch/x86/kvm/vmx/vmx.h
> @@ -567,6 +567,7 @@ static inline u8 vmx_get_rvi(void)
>  	 SECONDARY_EXEC_ENABLE_VMFUNC |					\
>  	 SECONDARY_EXEC_BUS_LOCK_DETECTION |				\
>  	 SECONDARY_EXEC_NOTIFY_VM_EXITING |				\
> +	 SECONDARY_EXEC_MODE_BASED_EPT_EXEC |				\
>  	 SECONDARY_EXEC_ENCLS_EXITING |					\
>  	 SECONDARY_EXEC_EPT_VIOLATION_VE)
>  
> diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
> index d09abeac2b56..69cf276be88e 100644
> --- a/arch/x86/kvm/vmx/x86_ops.h
> +++ b/arch/x86/kvm/vmx/x86_ops.h
> @@ -103,6 +103,7 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
>  int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
>  int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr);
>  u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio);
> +bool vmx_tdp_has_smep(struct kvm *kvm);

As suggested in v5, can we do this?

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 60dd1b5e9520..cc14a6b96681 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7839,11 +7839,6 @@ u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
        return (MTRR_TYPE_WRBACK << VMX_EPT_MT_EPTE_SHIFT);
 }
 
-bool vmx_tdp_has_smep(struct kvm *kvm)
-{
-       return enable_mbec;
-}
-
 static void vmcs_set_secondary_exec_control(struct vcpu_vmx *vmx, u32 new_ctl)
 {
        /*
diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
index 69cf276be88e..409858074246 100644
--- a/arch/x86/kvm/vmx/x86_ops.h
+++ b/arch/x86/kvm/vmx/x86_ops.h
@@ -4,6 +4,7 @@
 
 #include <linux/kvm_host.h>
 
+#include "capabilities.h"
 #include "x86.h"
 
 __init int vmx_hardware_setup(void);
@@ -103,7 +104,11 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
 int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
 int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr);
 u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio);
-bool vmx_tdp_has_smep(struct kvm *kvm);
+
+static inline bool vmx_tdp_has_smep(struct kvm *kvm)
+{
+       return enable_mbec;
+}
 
 void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
                       u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code);