KVM: SVM: Explicitly require FLUSHBYASID to enable SEV support

Add a sanity check that FLUSHBYASID is available if SEV is supported in
hardware, as SEV (and beyond) guests are bound to a single ASID, i.e. KVM
can't "flush" by assigning a new, fresh ASID to the guest.  If FLUSHBYASID
isn't supported for some bizarre reason, KVM would completely fail to do
TLB flushes for SEV+ guests (see pre_svm_run() and pre_sev_run()).

Cc: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20231018193617.1895752-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 4900c078045acc1bf437859f46e9acbe9c66b0b4..d0c580607f009d73292ee4acbbc2f5ab5998dfc4 100644 (file)
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -2191,10 +2191,13 @@ void __init sev_hardware_setup(void)
        /*
         * SEV must obviously be supported in hardware.  Sanity check that the
         * CPU supports decode assists, which is mandatory for SEV guests to
-        * support instruction emulation.
+        * support instruction emulation.  Ditto for flushing by ASID, as SEV
+        * guests are bound to a single ASID, i.e. KVM can't rotate to a new
+        * ASID to effect a TLB flush.
         */
        if (!boot_cpu_has(X86_FEATURE_SEV) ||
-           WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_DECODEASSISTS)))
+           WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_DECODEASSISTS)) ||
+           WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_FLUSHBYASID)))
                goto out;
 
        /* Retrieve SEV CPUID information */