Commit 6af6142e authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: x86: Disable KVM_INTEL_PROVE_VE by default 



Disable KVM's "prove #VE" support by default, as it provides no functional
value, and even its sanity checking benefits are relatively limited.  I.e.
it should be fully opt-in even on debug kernels, especially since EPT
Violation #VE suppression appears to be buggy on some CPUs.

Opportunistically add a line in the help text to make it abundantly clear
that KVM_INTEL_PROVE_VE should never be enabled in a production
environment.

Suggested-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Message-ID: <20240518000430.1118488-10-seanjc@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent a5dc0c9b

arch/x86/kvm/Kconfig

+5 −3
Original line number Diff line number Diff line
@@ -97,15 +97,17 @@ config KVM_INTEL 


config KVM_INTEL_PROVE_VE

        bool "Check that guests do not receive #VE exceptions"

        default KVM_PROVE_MMU || DEBUG_KERNEL

        depends on KVM_INTEL

        depends on KVM_INTEL && EXPERT

        help



          Checks that KVM's page table management code will not incorrectly

          let guests receive a virtualization exception.  Virtualization

          exceptions will be trapped by the hypervisor rather than injected

          in the guest.



          Note: some CPUs appear to generate spurious EPT Violations #VEs

          that trigger KVM's WARN, in particular with eptad=0 and/or nested

          virtualization.



          If unsure, say N.



config X86_SGX_KVM