| Message ID | 20200731205116.14891-1-sean.j.christopherson@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [RFC] KVM: SVM: Disallow SEV if NPT is disabled | expand |
On 7/31/20 3:51 PM, Sean Christopherson wrote: > Forcefully turn off SEV if NPT is disabled, e.g. via module param. SEV > requires NPT as the C-bit only exists if NPT is active. > > Fixes: e9df09428996f ("KVM: SVM: Add sev module_param") > Cc: stable@vger.kernel.org > Cc: Tom Lendacky <thomas.lendacky@amd.com> > Cc: Brijesh Singh <brijesh.singh@amd.com> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> > --- > > RFC as it's entirely possible that I am completely misunderstanding how > SEV works. Compile tested only. Reviewed-By: Brijesh Singh <brijesh.singh@amd.com> > > arch/x86/kvm/svm/svm.c | 14 +++++++------- > 1 file changed, 7 insertions(+), 7 deletions(-) > > diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c > index 783330d0e7b88..e30629593458b 100644 > --- a/arch/x86/kvm/svm/svm.c > +++ b/arch/x86/kvm/svm/svm.c > @@ -860,8 +860,14 @@ static __init int svm_hardware_setup(void) > kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE); > } > > + if (!boot_cpu_has(X86_FEATURE_NPT)) > + npt_enabled = false; > + > + if (npt_enabled && !npt) > + npt_enabled = false; > + > if (sev) { > - if (boot_cpu_has(X86_FEATURE_SEV) && > + if (boot_cpu_has(X86_FEATURE_SEV) && npt_enabled && > IS_ENABLED(CONFIG_KVM_AMD_SEV)) { > r = sev_hardware_setup(); > if (r) > @@ -879,12 +885,6 @@ static __init int svm_hardware_setup(void) > goto err; > } > > - if (!boot_cpu_has(X86_FEATURE_NPT)) > - npt_enabled = false; > - > - if (npt_enabled && !npt) > - npt_enabled = false; > - > kvm_configure_mmu(npt_enabled, PG_LEVEL_1G); > pr_info("kvm: Nested Paging %sabled\n", npt_enabled ? "en" : "dis"); >
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 783330d0e7b88..e30629593458b 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -860,8 +860,14 @@ static __init int svm_hardware_setup(void) kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE); } + if (!boot_cpu_has(X86_FEATURE_NPT)) + npt_enabled = false; + + if (npt_enabled && !npt) + npt_enabled = false; + if (sev) { - if (boot_cpu_has(X86_FEATURE_SEV) && + if (boot_cpu_has(X86_FEATURE_SEV) && npt_enabled && IS_ENABLED(CONFIG_KVM_AMD_SEV)) { r = sev_hardware_setup(); if (r) @@ -879,12 +885,6 @@ static __init int svm_hardware_setup(void) goto err; } - if (!boot_cpu_has(X86_FEATURE_NPT)) - npt_enabled = false; - - if (npt_enabled && !npt) - npt_enabled = false; - kvm_configure_mmu(npt_enabled, PG_LEVEL_1G); pr_info("kvm: Nested Paging %sabled\n", npt_enabled ? "en" : "dis");
Forcefully turn off SEV if NPT is disabled, e.g. via module param. SEV requires NPT as the C-bit only exists if NPT is active. Fixes: e9df09428996f ("KVM: SVM: Add sev module_param") Cc: stable@vger.kernel.org Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> --- RFC as it's entirely possible that I am completely misunderstanding how SEV works. Compile tested only. arch/x86/kvm/svm/svm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)