[PATCH 09/28] KVM: x86/mmu: separate more EPT/non-EPT permission_fault()

Paolo Bonzini
2026-04-28T11:10:00Z

Now that EPT is not abusing anymore ACC_USER_MASK, move its
handling entirely in the !ept branch. Merge smepf and ff
into a single variable because EPT's "SMEP" (actually
MBEC) is defined differently.

Tested-by: David Riley <d.riley@proxmox.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
arch/x86/kvm/mmu/mmu.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index cd1f8a51867d..fc1b17e22ea2 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -5565,7 +5565,6 @@ static void update_permission_bitmask(struct kvm_mmu *mmu, bool ept)

const u16 x = ACC_BITS_MASK(ACC_EXEC_MASK);
const u16 w = ACC_BITS_MASK(ACC_WRITE_MASK);
- const u16 u = ACC_BITS_MASK(ACC_USER_MASK);
const u16 r = ACC_BITS_MASK(ACC_READ_MASK);

bool cr4_smep = is_cr4_smep(mmu);
@@ -5598,21 +5597,24 @@ static void update_permission_bitmask(struct kvm_mmu *mmu, bool ept)
/* Faults from writes to non-writable pages */
u16 wf = (pfec & PFERR_WRITE_MASK) ? (u16)~w : 0;
/* Faults from user mode accesses to supervisor pages */
- u16 uf = (pfec & PFERR_USER_MASK) ? (u16)~u : 0;
- /* Faults from fetches of non-executable pages*/
- u16 ff = (pfec & PFERR_FETCH_MASK) ? (u16)~x : 0;
- /* Faults from kernel mode fetches of user pages */
- u16 smepf = 0;
+ u16 uf = 0;
+ /* Faults from fetches of non-executable pages */
+ u16 ff = 0;
/* Faults from kernel mode accesses of user pages */
u16 smapf = 0;

- if (!ept) {
+ if (ept) {
+ ff = (pfec & PFERR_FETCH_MASK) ? (u16)~x : 0;
+ } else {
+ const u16 u = ACC_BITS_MASK(ACC_USER_MASK);
+
/* Faults from kernel mode accesses to user pages */
u16 kf = (pfec & PFERR_USER_MASK) ? 0 : u;

- /* Not really needed: !nx will cause pte.nx to fault */
- if (!efer_nx)
- ff = 0;
+ uf = (pfec & PFERR_USER_MASK) ? (u16)~u : 0;
+
+ if (efer_nx)
+ ff = (pfec & PFERR_FETCH_MASK) ? (u16)~x : 0;

/* Allow supervisor writes if !cr0.wp */
if (!cr0_wp)
@@ -5620,7 +5622,7 @@ static void update_permission_bitmask(struct kvm_mmu *mmu, bool ept)

/* Disallow supervisor fetches of user code if cr4.smep */
if (cr4_smep)
- smepf = (pfec & PFERR_FETCH_MASK) ? kf : 0;
+ ff |= (pfec & PFERR_FETCH_MASK) ? kf : 0;

/*
* SMAP:kernel-mode data accesses from user-mode
@@ -5641,7 +5643,7 @@ static void update_permission_bitmask(struct kvm_mmu *mmu, bool ept)
smapf = (pfec & (PFERR_RSVD_MASK|PFERR_FETCH_MASK)) ? 0 : kf;
}

- mmu->permissions[byte] = ff | uf | wf | rf | smepf | smapf;
+ mmu->permissions[byte] = ff | uf | wf | rf | smapf;
}
}

--
2.52.0