From 9c0d518eb8dc69430e6a8d767bd101dad19b846a Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 5 Mar 2024 11:56:31 +0100 Subject: [PATCH] x86/HVM: hide SVM/VMX when their enabling is prohibited by firmware MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ... or we fail to enable the functionality on the BSP for other reasons. The only place where hardware announcing the feature is recorded is the raw CPU policy/featureset. Inspired by https://lore.kernel.org/all/20230921114940.957141-1-pbonzini@redhat.com/. Signed-off-by: Jan Beulich Acked-by: Roger Pau Monné master commit: 0b5f149338e35a795bf609ce584640b0977f9e6c master date: 2024-01-09 14:06:34 +0100 --- xen/arch/x86/hvm/svm/svm.c | 1 + xen/arch/x86/hvm/vmx/vmcs.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c index fd32600ae3..3c17464550 100644 --- a/xen/arch/x86/hvm/svm/svm.c +++ b/xen/arch/x86/hvm/svm/svm.c @@ -1669,6 +1669,7 @@ const struct hvm_function_table * __init start_svm(void) if ( _svm_cpu_up(true) ) { + setup_clear_cpu_cap(X86_FEATURE_SVM); printk("SVM: failed to initialise.\n"); return NULL; } diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index bcbecc6945..b5ecc51b43 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -2163,6 +2163,23 @@ int __init vmx_vmcs_init(void) if ( !ret ) register_keyhandler('v', vmcs_dump, "dump VT-x VMCSs", 1); + else + { + setup_clear_cpu_cap(X86_FEATURE_VMX); + + /* + * _vmx_vcpu_up() may have made it past feature identification. + * Make sure all dependent features are off as well. + */ + vmx_basic_msr = 0; + vmx_pin_based_exec_control = 0; + vmx_cpu_based_exec_control = 0; + vmx_secondary_exec_control = 0; + vmx_vmexit_control = 0; + vmx_vmentry_control = 0; + vmx_ept_vpid_cap = 0; + vmx_vmfunc = 0; + } return ret; }