https://github.com/torvalds/linux
Revision ccd85d90ce092bdb047a7f6580f3955393833b22 authored by Sean Christopherson on 02 February 2021, 21:20:17 UTC, committed by Paolo Bonzini on 03 February 2021, 09:30:37 UTC
Don't let KVM load when running as an SEV guest, regardless of what CPUID says. Memory is encrypted with a key that is not accessible to the host (L0), thus it's impossible for L0 to emulate SVM, e.g. it'll see garbage when reading the VMCB. Technically, KVM could decrypt all memory that needs to be accessible to the L0 and use shadow paging so that L0 does not need to shadow NPT, but exposing such information to L0 largely defeats the purpose of running as an SEV guest. This can always be revisited if someone comes up with a use case for running VMs inside SEV guests. Note, VMLOAD, VMRUN, etc... will also #GP on GPAs with C-bit set, i.e. KVM is doomed even if the SEV guest is debuggable and the hypervisor is willing to decrypt the VMCB. This may or may not be fixed on CPUs that have the SVME_ADDR_CHK fix. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com> Message-Id: <20210202212017.2486595-1-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 943dea8
Tip revision: ccd85d90ce092bdb047a7f6580f3955393833b22 authored by Sean Christopherson on 02 February 2021, 21:20:17 UTC
KVM: SVM: Treat SVM as unsupported when running as an SEV guest
KVM: SVM: Treat SVM as unsupported when running as an SEV guest
Tip revision: ccd85d9
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 16.3 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 71 bytes |
| .gitattributes | -rw-r--r-- | 62 bytes |
| .gitignore | -rw-r--r-- | 1.8 KB |
| .mailmap | -rw-r--r-- | 17.9 KB |
| COPYING | -rw-r--r-- | 496 bytes |
| CREDITS | -rw-r--r-- | 97.9 KB |
| Kbuild | -rw-r--r-- | 1.3 KB |
| Kconfig | -rw-r--r-- | 555 bytes |
| MAINTAINERS | -rw-r--r-- | 572.1 KB |
| Makefile | -rw-r--r-- | 62.9 KB |
| README | -rw-r--r-- | 727 bytes |
Computing file changes ...
