From: Ștefan Șicleru <ssicleru@xxxxxxxxxxxxxxx> shadow_present_mask is not 0ull if #VE support is enabled. If #VE support is enabled, shadow_present_mask is updated in vmx_enable_tdp() with VMX_EPT_SUPPRESS_VE_BIT. Signed-off-by: Ștefan Șicleru <ssicleru@xxxxxxxxxxxxxxx> Signed-off-by: Adalbert Lazăr <alazar@xxxxxxxxxxxxxxx> --- arch/x86/kvm/mmu/mmu.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 810e22f41306..28ab4a1ba25a 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -1601,7 +1601,13 @@ static bool spte_write_protect(u64 *sptep, bool pt_protect) static bool spte_read_protect(u64 *sptep) { u64 spte = *sptep; - bool exec_only_supported = (shadow_present_mask == 0ull); + bool exec_only_supported; + + if (kvm_ve_supported) + exec_only_supported = + (shadow_present_mask == VMX_EPT_SUPPRESS_VE_BIT); + else + exec_only_supported = (shadow_present_mask == 0ull); rmap_printk("rmap_read_protect: spte %p %llx\n", sptep, *sptep);