Re: [PATCH 15/28] KVM: VMX: enable use of MBEC

David Riley
2026-05-05T10:02:38Z

see inline.

On 4/30/26 5:10 PM, Paolo Bonzini wrote:
> [...]
>
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 337bbfecc021..72a75fa33c93 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -114,6 +114,9 @@ module_param(emulate_invalid_guest_state, bool, 0444);
> static bool __read_mostly fasteoi = 1;
> module_param(fasteoi, bool, 0444);
>
> +bool __read_mostly enable_mbec = 1;
> +module_param_named(mbec, enable_mbec, bool, 0444);
> +
> module_param(enable_apicv, bool, 0444);
> module_param(enable_ipiv, bool, 0444);
>
> @@ -2773,6 +2776,7 @@ static int setup_vmcs_config(struct vmcs_config *vmcs_conf,
> return -EIO;
>
> vmx_cap->ept = 0;
> + _cpu_based_2nd_exec_control &= ~SECONDARY_EXEC_MODE_BASED_EPT_EXEC;
> _cpu_based_2nd_exec_control &= ~SECONDARY_EXEC_EPT_VIOLATION_VE;
> }
> if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) &&
> @@ -4735,6 +4739,9 @@ static u32 vmx_secondary_exec_control(struct vcpu_vmx *vmx)
> */
> exec_control &= ~SECONDARY_EXEC_ENABLE_VMFUNC;
>
> + if (!enable_mbec)
> + exec_control &= ~SECONDARY_EXEC_MODE_BASED_EPT_EXEC;
> +
> /* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
> * in vmx_set_cr4. */
> exec_control &= ~SECONDARY_EXEC_DESC;
> @@ -7823,6 +7830,11 @@ u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
> return (MTRR_TYPE_WRBACK << VMX_EPT_MT_EPTE_SHIFT);
> }
>
> +bool vmx_tdp_has_smep(struct kvm *kvm)
> +{
> + return enable_mbec;
> +}
> +
> static void vmcs_set_secondary_exec_control(struct vcpu_vmx *vmx, u32 new_ctl)
> {
> /*
> @@ -8622,6 +8634,8 @@ __init int vmx_hardware_setup(void)
>
> if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
> enable_ept_ad_bits = 0;
> + if (!cpu_has_ept_mbec() || !enable_ept)
> + enable_mbec = 0;
>
> if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
> enable_unrestricted_guest = 0;
> @@ -8683,7 +8697,7 @@ __init int vmx_hardware_setup(void)
> set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
>
> if (enable_ept)
> - kvm_mmu_set_ept_masks(enable_ept_ad_bits);
> + kvm_mmu_set_ept_masks(enable_ept_ad_bits, enable_mbec);
This patch introduces a build failure for me on v7.1-rc2
(and v7.1-rc1) due to a function signature mismatch for
kvm_mmu_set_ept_masks.

In this patch, the call site in arch/x86/kvm/vmx/vmx.c is updated to
pass two arguments:
kvm_mmu_set_ept_masks(enable_ept_ad_bits, enable_mbec);

However, the definition in arch/x86/kvm/mmu/spte.c and the declaration
in arch/x86/kvm/mmu.h appear to have remained single-argument
functions:
void kvm_mmu_set_ept_masks(bool has_ad_bits);

This results in:
error: too many arguments to function ‘kvm_mmu_set_ept_masks’

> else
> vt_x86_ops.get_mt_mask = NULL;
>
> diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> index db84e8001da5..0a4e263c4095 100644
> --- a/arch/x86/kvm/vmx/vmx.h
> +++ b/arch/x86/kvm/vmx/vmx.h
> @@ -567,6 +567,7 @@ static inline u8 vmx_get_rvi(void)
> SECONDARY_EXEC_ENABLE_VMFUNC | \
> SECONDARY_EXEC_BUS_LOCK_DETECTION | \
> SECONDARY_EXEC_NOTIFY_VM_EXITING | \
> + SECONDARY_EXEC_MODE_BASED_EPT_EXEC | \
> SECONDARY_EXEC_ENCLS_EXITING | \
> SECONDARY_EXEC_EPT_VIOLATION_VE)
>
> diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
> index d09abeac2b56..69cf276be88e 100644
> --- a/arch/x86/kvm/vmx/x86_ops.h
> +++ b/arch/x86/kvm/vmx/x86_ops.h
> @@ -103,6 +103,7 @@ void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
> int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
> int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr);
> u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio);
> +bool vmx_tdp_has_smep(struct kvm *kvm);
>
> void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
> u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code);