Received-SPF: pass (google.com: domain of linux-kernel+bounces-147325-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <20240412173532.3481264-1-pbonzini@redhat.com> <20240412173532.3481264-5-pbonzini@redhat.com>
 <Zh0mocWeGCGWmBvA@chao-email>
In-Reply-To: <Zh0mocWeGCGWmBvA@chao-email>
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 16 Apr 2024 19:41:25 +0200
Message-ID: <CABgObfaV416+wRoRLJzEU6q5D4CJcLh=Ja-K_OBrf6LBnU=KiA@mail.gmail.com>
Subject: Re: [PATCH 04/10] KVM: x86/mmu: Add Suppress VE bit to EPT shadow_mmio_mask/shadow_present_mask
To: Chao Gao <chao.gao@intel.com>
Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, 
	Isaku Yamahata <isaku.yamahata@intel.com>, Xiaoyao Li <xiaoyao.li@intel.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Apr 15, 2024 at 3:08=E2=80=AFPM Chao Gao <chao.gao@intel.com> wrote=
:
>
> >+++ b/arch/x86/include/asm/vmx.h
> >@@ -514,6 +514,7 @@ enum vmcs_field {
> > #define VMX_EPT_IPAT_BIT                      (1ull << 6)
> > #define VMX_EPT_ACCESS_BIT                    (1ull << 8)
> > #define VMX_EPT_DIRTY_BIT                     (1ull << 9)
> >+#define VMX_EPT_SUPPRESS_VE_BIT                       (1ull << 63)
> > #define VMX_EPT_RWX_MASK                        (VMX_EPT_READABLE_MASK =
|       \
> >                                                VMX_EPT_WRITABLE_MASK | =
      \
> >                                                VMX_EPT_EXECUTABLE_MASK)
> >diff --git a/arch/x86/kvm/mmu/spte.c b/arch/x86/kvm/mmu/spte.c
> >index 6c7ab3aa6aa7..d97c4725c0b7 100644
> >--- a/arch/x86/kvm/mmu/spte.c
> >+++ b/arch/x86/kvm/mmu/spte.c
> >@@ -413,7 +413,9 @@ void kvm_mmu_set_ept_masks(bool has_ad_bits, bool ha=
s_exec_only)
> >       shadow_dirty_mask       =3D has_ad_bits ? VMX_EPT_DIRTY_BIT : 0ul=
l;
> >       shadow_nx_mask          =3D 0ull;
> >       shadow_x_mask           =3D VMX_EPT_EXECUTABLE_MASK;
> >-      shadow_present_mask     =3D has_exec_only ? 0ull : VMX_EPT_READAB=
LE_MASK;
> >+      /* VMX_EPT_SUPPRESS_VE_BIT is needed for W or X violation. */
> >+      shadow_present_mask     =3D
> >+              (has_exec_only ? 0ull : VMX_EPT_READABLE_MASK) | VMX_EPT_=
SUPPRESS_VE_BIT;
>
> This change makes !shadow_present_mask checks in FNAME(sync_spte) and
> make_spte() pointless as shadow_present_mask will never be zero.

It makes them wrong, not pointless. :)

The checks verify that there are "some" bits that are different
between non-present and present PTEs. They need to remove
SHADOW_NONPRESENT_MASK from shadow_present_mask.

Paolo