From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2E423DEFF8 for ; Mon, 13 Apr 2026 14:34:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776090897; cv=none; b=C0uy7kuh+YWqdMwISMd3xPeeD34UrAs79XzlRO5h2FkXrqAvAQAVA4DZF5cjssIta0RPtydIMa//F4TNGo1vWo/JWi09uyzj8Ry00th0fJWsOjxPYAWeT15Udi+5f2GE3lWx53JlJxaHHtopjSX7vm5NagsHJsv2w8bB8Tr7if4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776090897; c=relaxed/simple; bh=3ZVGiZhzTzahD4e+xRmtN7L5I3k7dB0kRkuOOarM81Q=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=hZMv7reTpTbACkiMrWqVuIV0YGlvaf631MQerFj0/3VyiQUBN69gFp56Ai+fDBT+XEz1/ssK1UUSU+ZxBULTk/RhPiCzzMl9RyQygib7O7vB2fF8zSDWTl0tuqE7Wxi2Q90A4Xu93JQh0LeXEyA4FIbE6qdxONGTT5V2cwUtlQ4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bjZYztc5; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bjZYztc5" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-c7424d91b2dso2417833a12.1 for ; Mon, 13 Apr 2026 07:34:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1776090895; x=1776695695; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=ZW0AqtNfWwb1r9T7I/1Ii6MtY9uMCJRRKsKeqxzBiJo=; b=bjZYztc5Ie6KRS6LQ1TBuEdIZ91ChoXsx4H1Mza7+rqjD2cYPDwyR0/4PhJUWQQrHw 2ZSOev+nnKlfrpZHhwT5yIa7PYAw2ZSwdmlM4x2Gp7xogDPjgHhQsucmYIsEBoX5YRTe 78HEStiNiUhVnbqx/pJnl7MQXkSajfotmLU5rQCcP80nvNdcUBYlAN8W4ZgEENActEvG GLtBtWyu7yOfJxvRE0eeS3gceSEUtnmvjZnNXcNQwHEuWBQLRKAq/A/gKhhS9X4NcEqW HQ+IkDbI/L+96m5AOfbYlBNxEETPSQr9EWgAuojV8U8kWA3ZArqIsrAcu9cYT8XSIm3G ICow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776090895; x=1776695695; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ZW0AqtNfWwb1r9T7I/1Ii6MtY9uMCJRRKsKeqxzBiJo=; b=Mdr9xZ0HMtTN6M2phnDLhDYHne3mgpb/Gb+31xgbVMaPTC2R4NPAc4WhOxxKFR3H60 JW1iY/bJvOMamDmKOC005CaSaa6F6ROkrW9QJRiZ1gjnm3DZfNBBUUy2bV9X0e/CalZi euRRuFwdkRtCO77uRu9K9ja/gAd+Ev7SwvfBf9b1pV0Gz8J1IOlzn0P+sKQg0NB+x52w 5+42wRtruAC/tU+q19ziWOkE2mpecwv71sQ2mnGWtDudfTk3qOmZ39PXzykeApRB9rg9 oWWDs8GVmkHTxkMNGqwR9/2n0XNF/ArBmrymgiB20COSUbl2e2089EkYMyvbKs4xopbl 2WDw== X-Gm-Message-State: AOJu0YyKHUmLWN68tgf6RYItcO8LVWtydx4kk0HXMwQKr4VmoNRSKEir m3PX2Hcs/jRwNQRWq/J4L+fP653syLsRh98+zwTyaOrqabK3dJV5lQIuOIeBSRagQol5KRTlhTJ TZG9bLg== X-Received: from pfbk21.prod.google.com ([2002:a05:6a00:b015:b0:82c:6cfd:5945]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:3987:b0:81f:3afe:281e with SMTP id d2e1a72fcca58-82f0c12fbd5mr13707289b3a.3.1776090894947; Mon, 13 Apr 2026 07:34:54 -0700 (PDT) Date: Mon, 13 Apr 2026 07:34:50 -0700 In-Reply-To: <20260409191341.1932853-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260409191341.1932853-1-seanjc@google.com> X-Mailer: git-send-email 2.53.0.1213.gd9a14994de-goog Message-ID: <177609085957.2326016.18202561572546817951.b4-ty@google.com> Subject: Re: [PATCH] x86/virt: Treat SVM as unsupported when running as an SEV+ guest From: Sean Christopherson To: Sean Christopherson , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: linux-kernel@vger.kernel.org, Srikanth Aithal Content-Type: text/plain; charset="utf-8" On Thu, 09 Apr 2026 12:13:41 -0700, Sean Christopherson wrote: > When running as an SEV+ guest, treat SVM as unsupported even if CPUID (and > other reporting, e.g. MSRs) enumerate support for SVM, as KVM doesn't > support nested virtualization within an SEV VM (KVM would need to > explicitly share all VMCBs and other assets with the untrusted host), let > alone running nested VMs within SEV-ES+ guests (e.g. emulating VMLOAD, > VMSAVE, and VMRUN all require access to guest register state). And outside > of KVM, there is no in-tree user of SVM enabling. > > [...] Applied to kvm-x86 vmxon (last week, forgot to send "thanks"). [1/1] x86/virt: Treat SVM as unsupported when running as an SEV+ guest https://github.com/kvm-x86/linux/commit/e30aa03d032d -- https://github.com/kvm-x86/linux/tree/next