[PATCH] x86/vmx: Fix VMEntry failure on ADL/SPR with shadow guests

[PATCH] x86/vmx: Fix VMEntry failure on ADL/SPR with shadow guests

[Andrew Cooper]

Paging Writeable depends on EPT, so must disabled in non-EPT guests like the
other EPT dependent features.  Otherwise, VMEntry fails with bad control
state.

Drop a piece of trailing whitepsace in context.

Fixes: ff10aa9d8f90 ("x86: Add Support for Paging-Write Feature")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Petr Beneš <w1benny@gmail.com>
CC: Tamas K Lengyel <tamas@tklengyel.com>
CC: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

This is the cause of the XTF Shadow failures in Gitlab CI.  Working run:

https://gitlab.com/xen-project/hardware/xen-staging/-/jobs/10133481327
---
 xen/arch/x86/hvm/vmx/vmcs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
index 59f4d1d86f02..57d49364db56 100644
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -1132,9 +1132,11 @@ static int construct_vmcs(struct vcpu *v)
     else
     {
         v->arch.hvm.vmx.secondary_exec_control &=
-            ~(SECONDARY_EXEC_ENABLE_EPT | 
+            ~(SECONDARY_EXEC_ENABLE_EPT |
               SECONDARY_EXEC_UNRESTRICTED_GUEST |
               SECONDARY_EXEC_ENABLE_INVPCID);
+        v->arch.hvm.vmx.tertiary_exec_control &=
+            ~(TERTIARY_EXEC_EPT_PAGING_WRITE);
         vmexit_ctl &= ~(VM_EXIT_SAVE_GUEST_PAT |
                         VM_EXIT_LOAD_HOST_PAT);
         vmentry_ctl &= ~VM_ENTRY_LOAD_GUEST_PAT;
-- 
2.39.5

Re: [PATCH] x86/vmx: Fix VMEntry failure on ADL/SPR with shadow guests

[Roger Pau Monné]

On Fri, May 23, 2025 at 05:05:58PM +0100, Andrew Cooper wrote:
> Paging Writeable depends on EPT, so must disabled in non-EPT guests like the
> other EPT dependent features.  Otherwise, VMEntry fails with bad control
> state.
> 
> Drop a piece of trailing whitepsace in context.
> 
> Fixes: ff10aa9d8f90 ("x86: Add Support for Paging-Write Feature")
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>

Thanks, Roger.