From: Jim Mattson <jmattson@google.com>
To: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Joerg Roedel <joro@8bytes.org>, kvm list <kvm@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 2/4] KVM: SVM: Refuse to load kvm_amd if NX support is not available
Date: Tue, 15 Jun 2021 15:30:33 -0700 [thread overview]
Message-ID: <CALMp9eRxA0zk9abXp-YwGJwO2QX-EvPfkS=CCCeLKFAcPx7soQ@mail.gmail.com> (raw)
In-Reply-To: <20210615164535.2146172-3-seanjc@google.com>
On Tue, Jun 15, 2021 at 9:45 AM Sean Christopherson <seanjc@google.com> wrote:
>
> Refuse to load KVM if NX support is not available. Shadow paging has
> assumed NX support since commit 9167ab799362 ("KVM: vmx, svm: always run
> with EFER.NXE=1 when shadow paging is active"), and NPT has assumed NX
> support since commit b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation").
> While the NX huge pages mitigation should not be enabled by default for
> AMD CPUs, it can be turned on by userspace at will.
>
> Unlike Intel CPUs, AMD does not provide a way for firmware to disable NX
> support, and Linux always sets EFER.NX=1 if it is supported. Given that
> it's extremely unlikely that a CPU supports NPT but not NX, making NX a
> formal requirement is far simpler than adding requirements to the
> mitigation flow.
>
> Fixes: 9167ab799362 ("KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active")
> Fixes: b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation")
> Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
next prev parent reply other threads:[~2021-06-15 22:30 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-15 16:45 [PATCH 0/4] KVM: x86: Require EFER.NX support unless EPT is on Sean Christopherson
2021-06-15 16:45 ` [PATCH 1/4] KVM: VMX: Refuse to load kvm_intel if EPT and NX are disabled Sean Christopherson
2021-06-15 22:26 ` Jim Mattson
2021-06-15 16:45 ` [PATCH 2/4] KVM: SVM: Refuse to load kvm_amd if NX support is not available Sean Christopherson
2021-06-15 22:30 ` Jim Mattson [this message]
2021-06-15 16:45 ` [PATCH 3/4] KVM: x86: WARN and reject loading KVM if NX is supported but not enabled Sean Christopherson
2021-06-15 22:39 ` Jim Mattson
2021-06-18 10:27 ` Paolo Bonzini
2021-06-24 22:33 ` Sean Christopherson
2021-06-25 9:04 ` Paolo Bonzini
2021-07-07 12:09 ` Naresh Kamboju
2021-07-07 12:09 ` Naresh Kamboju
2021-07-07 14:15 ` Paolo Bonzini
2021-06-15 16:45 ` [PATCH 4/4] KVM: x86: Simplify logic to handle lack of host NX support Sean Christopherson
2021-06-15 22:58 ` Jim Mattson
2021-06-15 23:33 ` Sean Christopherson
2021-06-18 10:31 ` Paolo Bonzini
2021-06-18 10:32 ` [PATCH 0/4] KVM: x86: Require EFER.NX support unless EPT is on Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALMp9eRxA0zk9abXp-YwGJwO2QX-EvPfkS=CCCeLKFAcPx7soQ@mail.gmail.com' \
--to=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.