These are final 3 patches of the series for making VMX/SVM support in Xen configurable: https://lore.kernel.org/xen-devel/cover.1722333634.git.Sergiy_Kibrik@epam.com/ Minor changes comparing to v5, changelogs are provided per-patch. -Sergiy Sergiy Kibrik (1): x86/vmx: guard access to cpu_has_vmx_* in common code Xenia Ragiadakou (2): ioreq: do not build arch_vcpu_ioreq_completion() for non-VMX configurations x86/hvm: make AMD-V and Intel VT-x support configurable xen/Kconfig | 6 ++ xen/arch/arm/ioreq.c | 6 -- xen/arch/x86/Kconfig | 19 +++++- xen/arch/x86/hvm/ioreq.c | 2 + xen/arch/x86/include/asm/hvm/vmx/vmcs.h | 90 ++++++++++++++++--------- xen/include/xen/ioreq.h | 10 +++ 6 files changed, 95 insertions(+), 38 deletions(-) -- 2.25.1 There're several places in common code, outside of arch/x86/hvm/vmx, where cpu_has_vmx_* get accessed without checking whether VMX supported first. These macros rely on global variables defined in vmx code, so when VMX support is disabled accesses to these variables turn into build failures. To overcome these failures, build-time check is done before accessing global variables, so that DCE would remove these variables. Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com> Acked-by: Paul Durrant <paul@xen.org> CC: Andrew Cooper <andrew.cooper3@citrix.com> CC: Jan Beulich <jbeulich@suse.com> --- changes in v6: - guard all of cpu_has_vmx_* macros changes in v5: - change kconfig option name VMX -> INTEL_VMX - do not change .c files, only modify macros in vmcs.h changes in v4: - use IS_ENABLED(CONFIG_VMX) instead of using_vmx --- xen/arch/x86/include/asm/hvm/vmx/vmcs.h | 90 ++++++++++++++++--------- 1 file changed, 60 insertions(+), 30 deletions(-) diff --git a/xen/arch/x86/include/asm/hvm/vmx/vmcs.h b/xen/arch/x86/include/asm/hvm/vmx/vmcs.h index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/include/asm/hvm/vmx/vmcs.h +++ b/xen/arch/x86/include/asm/hvm/vmx/vmcs.h @@ -XXX,XX +XXX,XX @@ extern u64 vmx_ept_vpid_cap; #define VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL #define cpu_has_wbinvd_exiting \ - (vmx_secondary_exec_control & SECONDARY_EXEC_WBINVD_EXITING) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_WBINVD_EXITING) #define cpu_has_vmx_virtualize_apic_accesses \ - (vmx_secondary_exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) #define cpu_has_vmx_tpr_shadow \ - (vmx_cpu_based_exec_control & CPU_BASED_TPR_SHADOW) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_cpu_based_exec_control & CPU_BASED_TPR_SHADOW) #define cpu_has_vmx_vnmi \ - (vmx_pin_based_exec_control & PIN_BASED_VIRTUAL_NMIS) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_pin_based_exec_control & PIN_BASED_VIRTUAL_NMIS) #define cpu_has_vmx_msr_bitmap \ - (vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_MSR_BITMAP) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_MSR_BITMAP) #define cpu_has_vmx_secondary_exec_control \ - (vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) #define cpu_has_vmx_tertiary_exec_control \ - (vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_TERTIARY_CONTROLS) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_TERTIARY_CONTROLS) #define cpu_has_vmx_ept \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) #define cpu_has_vmx_dt_exiting \ - (vmx_secondary_exec_control & SECONDARY_EXEC_DESCRIPTOR_TABLE_EXITING) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_DESCRIPTOR_TABLE_EXITING) #define cpu_has_vmx_rdtscp \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_RDTSCP) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_RDTSCP) #define cpu_has_vmx_vpid \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID) #define cpu_has_monitor_trap_flag \ - (vmx_cpu_based_exec_control & CPU_BASED_MONITOR_TRAP_FLAG) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_cpu_based_exec_control & CPU_BASED_MONITOR_TRAP_FLAG) #define cpu_has_vmx_pat \ - (vmx_vmentry_control & VM_ENTRY_LOAD_GUEST_PAT) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_vmentry_control & VM_ENTRY_LOAD_GUEST_PAT) #define cpu_has_vmx_efer \ - (vmx_vmentry_control & VM_ENTRY_LOAD_GUEST_EFER) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_vmentry_control & VM_ENTRY_LOAD_GUEST_EFER) #define cpu_has_vmx_unrestricted_guest \ - (vmx_secondary_exec_control & SECONDARY_EXEC_UNRESTRICTED_GUEST) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_UNRESTRICTED_GUEST) #define vmx_unrestricted_guest(v) \ ((v)->arch.hvm.vmx.secondary_exec_control & \ SECONDARY_EXEC_UNRESTRICTED_GUEST) #define cpu_has_vmx_ple \ - (vmx_secondary_exec_control & SECONDARY_EXEC_PAUSE_LOOP_EXITING) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_PAUSE_LOOP_EXITING) #define cpu_has_vmx_invpcid \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_INVPCID) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_INVPCID) #define cpu_has_vmx_apic_reg_virt \ - (vmx_secondary_exec_control & SECONDARY_EXEC_APIC_REGISTER_VIRT) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_APIC_REGISTER_VIRT) #define cpu_has_vmx_virtual_intr_delivery \ - (vmx_secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) #define cpu_has_vmx_virtualize_x2apic_mode \ - (vmx_secondary_exec_control & SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE) #define cpu_has_vmx_posted_intr_processing \ - (vmx_pin_based_exec_control & PIN_BASED_POSTED_INTERRUPT) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_pin_based_exec_control & PIN_BASED_POSTED_INTERRUPT) #define cpu_has_vmx_vmcs_shadowing \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VMCS_SHADOWING) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VMCS_SHADOWING) #define cpu_has_vmx_vmfunc \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VM_FUNCTIONS) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VM_FUNCTIONS) #define cpu_has_vmx_virt_exceptions \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VIRT_EXCEPTIONS) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VIRT_EXCEPTIONS) #define cpu_has_vmx_pml \ - (vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_PML) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_PML) #define cpu_has_vmx_mpx \ - ((vmx_vmexit_control & VM_EXIT_CLEAR_BNDCFGS) && \ + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + (vmx_vmexit_control & VM_EXIT_CLEAR_BNDCFGS) && \ (vmx_vmentry_control & VM_ENTRY_LOAD_BNDCFGS)) #define cpu_has_vmx_xsaves \ - (vmx_secondary_exec_control & SECONDARY_EXEC_XSAVES) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_XSAVES) #define cpu_has_vmx_tsc_scaling \ - (vmx_secondary_exec_control & SECONDARY_EXEC_TSC_SCALING) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_TSC_SCALING) #define cpu_has_vmx_bus_lock_detection \ - (vmx_secondary_exec_control & SECONDARY_EXEC_BUS_LOCK_DETECTION) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_BUS_LOCK_DETECTION) #define cpu_has_vmx_notify_vm_exiting \ - (vmx_secondary_exec_control & SECONDARY_EXEC_NOTIFY_VM_EXITING) + (IS_ENABLED(CONFIG_INTEL_VMX) && \ + vmx_secondary_exec_control & SECONDARY_EXEC_NOTIFY_VM_EXITING) #define VMCS_RID_TYPE_MASK 0x80000000U -- 2.25.1 From: Xenia Ragiadakou <burzalodowa@gmail.com> VIO_realmode_completion is specific to vmx realmode and thus the function arch_vcpu_ioreq_completion() has actual handling work only in VMX-enabled build, as for the rest x86 and ARM build configurations it is basically a stub. Here a separate configuration option ARCH_IOREQ_COMPLETION introduced that tells whether the platform we're building for requires any specific ioreq completion handling. As of now only VMX has such requirement, so the option is selected by INTEL_VMX, for other configurations a generic default stub is provided (it is ARM's version of arch_vcpu_ioreq_completion() moved to common header). Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com> CC: Julien Grall <julien@xen.org> CC: Jan Beulich <jbeulich@suse.com> --- changes in v6: - rename option ARCH_IOREQ_COMPLETION -> ARCH_VCPU_IOREQ_COMPLETION - put a comment with brief option's description changes in v5: - introduce ARCH_IOREQ_COMPLETION option & put arch_vcpu_ioreq_completion() under it - description changed changes in v4: - move whole arch_vcpu_ioreq_completion() under CONFIG_VMX and remove ARM's variant of this handler, as Julien suggested --- xen/Kconfig | 6 ++++++ xen/arch/arm/ioreq.c | 6 ------ xen/arch/x86/Kconfig | 1 + xen/arch/x86/hvm/ioreq.c | 2 ++ xen/include/xen/ioreq.h | 10 ++++++++++ 5 files changed, 19 insertions(+), 6 deletions(-) diff --git a/xen/Kconfig b/xen/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/Kconfig +++ b/xen/Kconfig @@ -XXX,XX +XXX,XX @@ config LTO config ARCH_SUPPORTS_INT128 bool +# +# For platforms that require specific handling of ioreq completion events +# +config ARCH_VCPU_IOREQ_COMPLETION + bool + source "Kconfig.debug" diff --git a/xen/arch/arm/ioreq.c b/xen/arch/arm/ioreq.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/arm/ioreq.c +++ b/xen/arch/arm/ioreq.c @@ -XXX,XX +XXX,XX @@ bool arch_ioreq_complete_mmio(void) return false; } -bool arch_vcpu_ioreq_completion(enum vio_completion completion) -{ - ASSERT_UNREACHABLE(); - return true; -} - /* * The "legacy" mechanism of mapping magic pages for the IOREQ servers * is x86 specific, so the following hooks don't need to be implemented on Arm: diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -XXX,XX +XXX,XX @@ config AMD_SVM config INTEL_VMX def_bool HVM + select ARCH_VCPU_IOREQ_COMPLETION config XEN_SHSTK bool "Supervisor Shadow Stacks" diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/hvm/ioreq.c +++ b/xen/arch/x86/hvm/ioreq.c @@ -XXX,XX +XXX,XX @@ bool arch_ioreq_complete_mmio(void) return handle_mmio(); } +#ifdef CONFIG_VCPU_ARCH_IOREQ_COMPLETION bool arch_vcpu_ioreq_completion(enum vio_completion completion) { switch ( completion ) @@ -XXX,XX +XXX,XX @@ bool arch_vcpu_ioreq_completion(enum vio_completion completion) return true; } +#endif static gfn_t hvm_alloc_legacy_ioreq_gfn(struct ioreq_server *s) { diff --git a/xen/include/xen/ioreq.h b/xen/include/xen/ioreq.h index XXXXXXX..XXXXXXX 100644 --- a/xen/include/xen/ioreq.h +++ b/xen/include/xen/ioreq.h @@ -XXX,XX +XXX,XX @@ void ioreq_domain_init(struct domain *d); int ioreq_server_dm_op(struct xen_dm_op *op, struct domain *d, bool *const_op); bool arch_ioreq_complete_mmio(void); + +#ifdef CONFIG_VCPU_ARCH_IOREQ_COMPLETION bool arch_vcpu_ioreq_completion(enum vio_completion completion); +#else +static inline bool arch_vcpu_ioreq_completion(enum vio_completion completion) +{ + ASSERT_UNREACHABLE(); + return true; +} +#endif + int arch_ioreq_server_map_pages(struct ioreq_server *s); void arch_ioreq_server_unmap_pages(struct ioreq_server *s); void arch_ioreq_server_enable(struct ioreq_server *s); -- 2.25.1 From: Xenia Ragiadakou <burzalodowa@gmail.com> Provide the user with configuration control over the cpu virtualization support in Xen by making AMD_SVM and INTEL_VMX options user selectable. To preserve the current default behavior, both options depend on HVM and default to value of HVM. To prevent users from unknowingly disabling virtualization support, make the controls user selectable only if EXPERT is enabled. No functional change intended. Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Jan Beulich <jbeulich@suse.com> --- changes in v6: - "default y" instead of "default HVM" changes in v5: - change kconfig option name SVM/VMX -> AMD_SVM/INTEL_VMX changes in v3: - only tags added --- xen/arch/x86/Kconfig | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -XXX,XX +XXX,XX @@ config HVM If unsure, say Y. config AMD_SVM - def_bool HVM + bool "AMD-V" if EXPERT + depends on HVM + default y + help + Enables virtual machine extensions on platforms that implement the + AMD Virtualization Technology (AMD-V). + If your system includes a processor with AMD-V support, say Y. + If in doubt, say Y. config INTEL_VMX - def_bool HVM + bool "Intel VT-x" if EXPERT + depends on HVM + default y select ARCH_VCPU_IOREQ_COMPLETION + help + Enables virtual machine extensions on platforms that implement the + Intel Virtualization Technology (Intel VT-x). + If your system includes a processor with Intel VT-x support, say Y. + If in doubt, say Y. config XEN_SHSTK bool "Supervisor Shadow Stacks" -- 2.25.1 These are final 2 patches of the series for making VMX/SVM support in Xen configurable: https://lore.kernel.org/xen-devel/cover.1723110344.git.Sergiy_Kibrik@epam.com/ Minor changes comparing to v6, changelogs are provided per-patch. -Sergiy Xenia Ragiadakou (2): ioreq: do not build arch_vcpu_ioreq_completion() for non-VMX configurations x86/hvm: make AMD-V and Intel VT-x support configurable xen/Kconfig | 7 +++++++ xen/arch/arm/ioreq.c | 6 ------ xen/arch/x86/Kconfig | 19 +++++++++++++++++-- xen/arch/x86/hvm/ioreq.c | 2 ++ xen/include/xen/ioreq.h | 10 ++++++++++ 5 files changed, 36 insertions(+), 8 deletions(-) -- 2.25.1 From: Xenia Ragiadakou <burzalodowa@gmail.com> VIO_realmode_completion is specific to vmx realmode and thus the function arch_vcpu_ioreq_completion() has actual handling work only in VMX-enabled build, as for the rest x86 and ARM build configurations it is basically a stub. Here a separate configuration option ARCH_VCPU_IOREQ_COMPLETION introduced that tells whether the platform we're building for requires any specific ioreq completion handling. As of now only VMX has such requirement, so the option is selected by INTEL_VMX, for other configurations a generic default stub is provided (it is ARM's version of arch_vcpu_ioreq_completion() moved to common header). Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com> Acked-by: Jan Beulich <jbeulich@suse.com> CC: Julien Grall <julien@xen.org> --- changes in v7: - comment in Kconfig adjusted - fixed patch description - updated tags changes in v6: - rename option ARCH_IOREQ_COMPLETION -> ARCH_VCPU_IOREQ_COMPLETION - put a comment with brief option's description changes in v5: - introduce ARCH_IOREQ_COMPLETION option & put arch_vcpu_ioreq_completion() under it - description changed --- xen/Kconfig | 7 +++++++ xen/arch/arm/ioreq.c | 6 ------ xen/arch/x86/Kconfig | 1 + xen/arch/x86/hvm/ioreq.c | 2 ++ xen/include/xen/ioreq.h | 10 ++++++++++ 5 files changed, 20 insertions(+), 6 deletions(-) diff --git a/xen/Kconfig b/xen/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/Kconfig +++ b/xen/Kconfig @@ -XXX,XX +XXX,XX @@ config LTO config ARCH_SUPPORTS_INT128 bool +# +# For platforms that require specific handling of per-vCPU ioreq completion +# events +# +config ARCH_VCPU_IOREQ_COMPLETION + bool + source "Kconfig.debug" diff --git a/xen/arch/arm/ioreq.c b/xen/arch/arm/ioreq.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/arm/ioreq.c +++ b/xen/arch/arm/ioreq.c @@ -XXX,XX +XXX,XX @@ bool arch_ioreq_complete_mmio(void) return false; } -bool arch_vcpu_ioreq_completion(enum vio_completion completion) -{ - ASSERT_UNREACHABLE(); - return true; -} - /* * The "legacy" mechanism of mapping magic pages for the IOREQ servers * is x86 specific, so the following hooks don't need to be implemented on Arm: diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -XXX,XX +XXX,XX @@ config AMD_SVM config INTEL_VMX def_bool HVM + select ARCH_VCPU_IOREQ_COMPLETION config XEN_SHSTK bool "Supervisor Shadow Stacks" diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/hvm/ioreq.c +++ b/xen/arch/x86/hvm/ioreq.c @@ -XXX,XX +XXX,XX @@ bool arch_ioreq_complete_mmio(void) return handle_mmio(); } +#ifdef CONFIG_VCPU_ARCH_IOREQ_COMPLETION bool arch_vcpu_ioreq_completion(enum vio_completion completion) { switch ( completion ) @@ -XXX,XX +XXX,XX @@ bool arch_vcpu_ioreq_completion(enum vio_completion completion) return true; } +#endif static gfn_t hvm_alloc_legacy_ioreq_gfn(struct ioreq_server *s) { diff --git a/xen/include/xen/ioreq.h b/xen/include/xen/ioreq.h index XXXXXXX..XXXXXXX 100644 --- a/xen/include/xen/ioreq.h +++ b/xen/include/xen/ioreq.h @@ -XXX,XX +XXX,XX @@ void ioreq_domain_init(struct domain *d); int ioreq_server_dm_op(struct xen_dm_op *op, struct domain *d, bool *const_op); bool arch_ioreq_complete_mmio(void); + +#ifdef CONFIG_VCPU_ARCH_IOREQ_COMPLETION bool arch_vcpu_ioreq_completion(enum vio_completion completion); +#else +static inline bool arch_vcpu_ioreq_completion(enum vio_completion completion) +{ + ASSERT_UNREACHABLE(); + return true; +} +#endif + int arch_ioreq_server_map_pages(struct ioreq_server *s); void arch_ioreq_server_unmap_pages(struct ioreq_server *s); void arch_ioreq_server_enable(struct ioreq_server *s); -- 2.25.1 From: Xenia Ragiadakou <burzalodowa@gmail.com> Provide the user with configuration control over the cpu virtualization support in Xen by making AMD_SVM and INTEL_VMX options user selectable. To preserve the current default behavior, both options depend on HVM and default to value of HVM. To prevent users from unknowingly disabling virtualization support, make the controls user selectable only if EXPERT is enabled. No functional change intended. Signed-off-by: Xenia Ragiadakou <burzalodowa@gmail.com> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Jan Beulich <jbeulich@suse.com> --- changes in v6: - "default y" instead of "default HVM" changes in v5: - change kconfig option name SVM/VMX -> AMD_SVM/INTEL_VMX changes in v3: - only tags added --- xen/arch/x86/Kconfig | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -XXX,XX +XXX,XX @@ config HVM If unsure, say Y. config AMD_SVM - def_bool HVM + bool "AMD-V" if EXPERT + depends on HVM + default y + help + Enables virtual machine extensions on platforms that implement the + AMD Virtualization Technology (AMD-V). + If your system includes a processor with AMD-V support, say Y. + If in doubt, say Y. config INTEL_VMX - def_bool HVM + bool "Intel VT-x" if EXPERT + depends on HVM + default y select ARCH_VCPU_IOREQ_COMPLETION + help + Enables virtual machine extensions on platforms that implement the + Intel Virtualization Technology (Intel VT-x). + If your system includes a processor with Intel VT-x support, say Y. + If in doubt, say Y. config XEN_SHSTK bool "Supervisor Shadow Stacks" -- 2.25.1