KVM: SVM: Mark module parameters as __ro_after_init for security and performance

Browse source

SVM module parameters such as avic, sev_enabled, npt_enabled, and
pause_filter_thresh are configured exclusively during initialization
(via kernel command line) and remain constant throughout runtime.
Additionally, sev_supported_vmsa_features and svm_gp_erratum_intercept,
while not exposed as module parameters, share the same initialization
pattern and runtime constancy.

Mark these variables with '__ro_after_init' to:
- Harden against accidental or malicious runtime modification
- Enable compiler and CPU optimizations (improved caching, branch prediction)
- Align with kernel security best practices for init-only configuration

The exception is 'iopm_base', which retains '__read_mostly' as it requires
updates during module unloading.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://patch.msgid.link/20260202095004.1765-1-lirongqing@baidu.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

...

This commit is contained in:

Li RongQing 2026-02-02 04:50:04 -05:00 • committed by Sean Christopherson

parent 11439c4635

commit 52de184bad

3 changed files with 22 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

arch/x86/kvm/svm/avic.c

View file

8

arch/x86/kvm/svm/sev.c

View file

32

arch/x86/kvm/svm/svm.c

View file