Re: [PATCH 01/28] KVM: TDX/VMX: rework EPT_VIOLATION_EXEC_FOR_RING3_LIN into PROT_MASK

[mlevitsk]

On Tue, 2026-05-05 at 21:51 +0200, Paolo Bonzini wrote:
> From: Jon Kohler <jon@xxxxxxxxxxx>
> 
> EPT exit qualification bit 6 is used when mode-based execute control
> is enabled, and reflects user executable addresses. Rework name to
> reflect the intention and add to EPT_VIOLATION_PROT_MASK, which allows
> simplifying the return evaluation in
> tdx_is_sept_violation_unexpected_pending a pinch.
> 
> Rework handling in __vmx_handle_ept_violation to unconditionally clear
> EPT_VIOLATION_PROT_USER_EXEC until MBEC is implemented, as suggested by
> Sean [1].
> 
> Note: Intel SDM Table 29-7 defines bit 6 as:
>   If the "mode-based execute control" VM-execution control is 0, the
>   value of this bit is undefined. If that control is 1, this bit is the
>   logical-AND of bit 10 in the EPT paging-structure entries used to
>   translate the guest-physical address of the access causing the EPT
>   violation. In this case, it indicates whether the guest-physical
>   address was executable for user-mode linear addresses.
> 
> [1] https://lore.kernel.org/all/aCJDzU1p_SFNRIJd@xxxxxxxxxx/
> 
> Suggested-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> Signed-off-by: Jon Kohler <jon@xxxxxxxxxxx>
> Message-ID: <20251223054806.1611168-2-jon@xxxxxxxxxxx>
> Tested-by: David Riley <d.riley@xxxxxxxxxxx>
> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> ---
>  arch/x86/include/asm/vmx.h | 5 +++--
>  arch/x86/kvm/vmx/common.h  | 9 +++++++--
>  arch/x86/kvm/vmx/tdx.c     | 2 +-
>  3 files changed, 11 insertions(+), 5 deletions(-)
> 
> diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
> index 37080382df54..b2291a766e3f 100644
> --- a/arch/x86/include/asm/vmx.h
> +++ b/arch/x86/include/asm/vmx.h
> @@ -608,10 +608,11 @@ enum vm_entry_failure_code {
>  #define EPT_VIOLATION_PROT_READ BIT(3)
>  #define EPT_VIOLATION_PROT_WRITE BIT(4)
>  #define EPT_VIOLATION_PROT_EXEC BIT(5)
> -#define EPT_VIOLATION_EXEC_FOR_RING3_LIN BIT(6)
> +#define EPT_VIOLATION_PROT_USER_EXEC BIT(6)
>  #define EPT_VIOLATION_PROT_MASK (EPT_VIOLATION_PROT_READ  | \
>   EPT_VIOLATION_PROT_WRITE | \
> - EPT_VIOLATION_PROT_EXEC)
> + EPT_VIOLATION_PROT_EXEC  | \
> + EPT_VIOLATION_PROT_USER_EXEC)
>  #define EPT_VIOLATION_GVA_IS_VALID BIT(7)
>  #define EPT_VIOLATION_GVA_TRANSLATED BIT(8)
>  
> diff --git a/arch/x86/kvm/vmx/common.h b/arch/x86/kvm/vmx/common.h
> index 412d0829d7a2..adf925500b9e 100644
> --- a/arch/x86/kvm/vmx/common.h
> +++ b/arch/x86/kvm/vmx/common.h
> @@ -94,8 +94,13 @@ static inline int __vmx_handle_ept_violation(struct kvm_vcpu *vcpu, gpa_t gpa,
>   /* Is it a fetch fault? */
>   error_code |= (exit_qualification & EPT_VIOLATION_ACC_INSTR)
>         ? PFERR_FETCH_MASK : 0;
> - /* ept page table entry is present? */
> - error_code |= (exit_qualification & EPT_VIOLATION_PROT_MASK)
> + /*
> + * ept page table entry is present?
> + * note: unconditionally clear USER_EXEC until mode-based
> + * execute control is implemented
> + */
> + error_code |= (exit_qualification &
> +        (EPT_VIOLATION_PROT_MASK & ~EPT_VIOLATION_PROT_USER_EXEC))
>         ? PFERR_PRESENT_MASK : 0;
>  
>   if (exit_qualification & EPT_VIOLATION_GVA_IS_VALID)
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 1e47c194af53..89f9fe30435d 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -1845,7 +1845,7 @@ static inline bool tdx_is_sept_violation_unexpected_pending(struct kvm_vcpu *vcp
>   if (eeq_type != TDX_EXT_EXIT_QUAL_TYPE_PENDING_EPT_VIOLATION)
>   return false;
>  
> - return !(eq & EPT_VIOLATION_PROT_MASK) && !(eq & EPT_VIOLATION_EXEC_FOR_RING3_LIN);
> + return !(eq & EPT_VIOLATION_PROT_MASK);
>  }
>  
>  static int tdx_handle_ept_violation(struct kvm_vcpu *vcpu)

Looks OK to me,

Reviewed-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Best regards,
	Maxim Levitsky