Re: [PATCH MANUALSEL 5.16 6/8] KVM: SVM: Explicitly require DECODEASSISTS to enable SEV support

Paolo Bonzini
2022-02-10T16:36:57Z

On 2/9/22 19:56, Sasha Levin wrote:
> From: Sean Christopherson <seanjc@google.com>
>
> [ Upstream commit c532f2903b69b775d27016511fbe29a14a098f95 ]
>
> Add a sanity check on DECODEASSIST being support if SEV is supported, as
> KVM cannot read guest private memory and thus relies on the CPU to
> provide the instruction byte stream on #NPF for emulation. The intent of
> the check is to document the dependency, it should never fail in practice
> as producing hardware that supports SEV but not DECODEASSISTS would be
> non-sensical.
>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
> Message-Id: <20220120010719.711476-5-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> arch/x86/kvm/svm/sev.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index be28831412209..932afd713a02c 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -2099,8 +2099,13 @@ void __init sev_hardware_setup(void)
> if (!sev_enabled || !npt_enabled)
> goto out;
>
> - /* Does the CPU support SEV? */
> - if (!boot_cpu_has(X86_FEATURE_SEV))
> + /*
> + * SEV must obviously be supported in hardware. Sanity check that the
> + * CPU supports decode assists, which is mandatory for SEV guests to
> + * support instruction emulation.
> + */
> + if (!boot_cpu_has(X86_FEATURE_SEV) ||
> + WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_DECODEASSISTS)))
> goto out;
>
> /* Retrieve SEV CPUID information */

NACK