Re: [PATCH 05/24] KVM: x86/mmu: Extend map_writable to a full ACC_* mask

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Generic bitwise masking of `pte_access` with `host_access` fails to clear the user-mode execution bit on EPT, allowing the guest user-mode to execute host-restricted non-executable mappings.
--

--- Patch [5]: [PATCH 05/24] KVM: x86/mmu: Extend map_writable to a full ACC_* mask ---
commit fbce49ecd47269b3bd1cd08c8c69aaddfb1e0d62
Author: Paolo Bonzini <pbonzini@redhat.com>

KVM: x86/mmu: Extend map_writable to a full ACC_* mask

This commit updates KVM page fault structures to use a full ACC_* mask
instead of a boolean map_writable field. This prepares the MMU to support
non-executable mappings from memory protection attributes, simplifying
make_spte() by directly passing the host_access mask.

> diff --git a/arch/x86/kvm/mmu/spte.c b/arch/x86/kvm/mmu/spte.c
> --- a/arch/x86/kvm/mmu/spte.c
> +++ b/arch/x86/kvm/mmu/spte.c

[ ... ]

> @@ -206,6 +206,11 @@ bool make_spte(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
>  	if (!prefetch || synchronizing)
>  		spte |= shadow_accessed_mask;
>  
> +	if (host_access & ACC_WRITE_MASK)
> +		spte |= shadow_host_writable_mask;
> +
> +	pte_access &= host_access;
> +

[Severity: Medium]
Will this bitwise AND logic inadvertently allow guest user-mode execution of
non-executable mappings on EPT?

Because ACC_USER_EXEC_MASK aliases ACC_USER_MASK in KVM, a host_access mask
that clears ACC_EXEC_MASK but retains ACC_USER_MASK (to permit guest
user-mode data accesses) will fail to clear ACC_USER_EXEC_MASK here.

When execution reaches the non-executable handling later in make_spte():

    } else {
        if (pte_access & ACC_EXEC_MASK)
            spte |= shadow_xs_mask;
        if (pte_access & ACC_USER_EXEC_MASK)
            spte |= shadow_xu_mask;
    }

Could this result in shadow_xu_mask being set, inadvertently granting guest
user-mode execution despite the host_access restriction when Mode-Based
Execute Control (MBEC) is enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716181456.402786-1-pbonzini@redhat.com?part=5