From: Arvind Sankar <nivedita@alum.mit.edu>
To: "Andersen, John" <john.s.andersen@intel.com>
Cc: Andy Lutomirski <luto@kernel.org>,
Jonathan Corbet <corbet@lwn.net>,
Paolo Bonzini <pbonzini@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
X86 ML <x86@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>,
Shuah Khan <shuah@kernel.org>,
"Christopherson, Sean J" <sean.j.christopherson@intel.com>,
Liran Alon <liran.alon@oracle.com>,
Andrew Jones <drjones@redhat.com>,
Rick Edgecombe <rick.p.edgecombe@intel.com>,
Kristen Carlson Accardi <kristen@linux.intel.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
mchehab+huawei@kernel.org, Greg KH <gregkh@linuxfoundation.org>,
"Paul E. McKenney" <paulmck@kernel.org>,
pawan.kumar.gupta@linux.intel.com,
Juergen Gross <jgross@suse.com>,
Mike Kravetz <mike.kravetz@oracle.com>,
Oliver Neukum <oneukum@suse.com>,
Peter Zijlstra <peterz@infradead.org>,
Fenghua Yu <fenghua.yu@intel.com>,
reinette.chatre@intel.com, vineela.tummalapalli@intel.com,
Dave Hansen <dave.hansen@linux.intel.com>,
Arjan van de Ven <arjan@linux.intel.com>,
caoj.fnst@cn.fujitsu.com, Baoquan He <bhe@redhat.com>,
Arvind Sankar <nivedita@alum.mit.edu>,
Kees Cook <keescook@chromium.org>,
Geremy Condra <geremy.condra@intel.com>,
Dan Williams <dan.j.williams@intel.com>,
eric.auger@redhat.com, aaronlewis@google.com,
Peter Xu <peterx@redhat.com>,
makarandsonare@google.com,
"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
kvm list <kvm@vger.kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: Re: [PATCH 4/4] X86: Use KVM CR pin MSRs
Date: Sat, 4 Jul 2020 11:11:21 -0400 [thread overview]
Message-ID: <20200704151121.GA1611291@rani.riverdale.lan> (raw)
In-Reply-To: <20200703214814.GA25@0e1a9e0069b7>
On Fri, Jul 03, 2020 at 09:48:14PM +0000, Andersen, John wrote:
> > > Is there a plan for fixing this for real? I'm wondering if there is a
> > > sane weakening of this feature that still allows things like kexec.
> > >
> >
> > I'm pretty sure kexec can be fixed. I had it working at one point, I'm
> > currently in the process of revalidating this. The issue was though that
> > kexec only worked within the guest, not on the physical host, which I suspect
> > is related to the need for supervisor pages to be mapped, which seems to be
> > required before enabling SMAP (based on what I'd seen with the selftests and
> > unittests). I was also just blindly turning on the bits without checking for
> > support when I'd tried this, so that could have been the issue too.
> >
> > I think most of the changes for just blindly enabling the bits were in
> > relocate_kernel, secondary_startup_64, and startup_32.
> >
>
> So I have a naive fix for kexec which has only been tested to work under KVM.
> When tested on a physical host, it did not boot when SMAP or UMIP were set.
> Undoubtedly it's not the correct way to do this, as it skips CPU feature
> identification, opting instead for blindly setting the bits. The physical host
> I tested this on does not have UMIP so that's likely why it failed to boot when
> UMIP gets set blindly. Within kvm-unit-tests, the test for SMAP maps memory as
> supervisor pages before enabling SMAP. I suspect this is why setting SMAP
> blindly causes the physical host not to boot.
>
> Within trampoline_32bit_src() if I add more instructions I get an error
> about "attempt to move .org backwards", which as I understand it means
> there are only so many instructions allowed in each of those functions.
>
> My suspicion is that someone with more knowledge of this area has a good
> idea on how best to handle this. Feedback would be much appreciated.
You can simply increase the value of TRAMPOLINE_32BIT_CODE_SIZE in
pgtable.h, assuming you don't need a very large increase. There's one
page available for code + stack at present.
next prev parent reply other threads:[~2020-07-04 15:11 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-17 19:07 [PATCH 0/4] Paravirtualized Control Register pinning John Andersen
2020-06-17 19:07 ` [PATCH 1/4] X86: Update mmu_cr4_features during feature identification John Andersen
2020-06-18 14:09 ` Dave Hansen
2020-06-17 19:07 ` [PATCH 2/4] KVM: x86: Introduce paravirt feature CR0/CR4 pinning John Andersen
2020-06-18 14:18 ` Dave Hansen
2020-06-18 14:43 ` Andersen, John
2020-06-18 14:51 ` Dave Hansen
2020-07-07 21:12 ` Sean Christopherson
2020-07-07 21:48 ` Dave Hansen
2020-07-07 21:51 ` Paolo Bonzini
2020-07-09 15:44 ` Andersen, John
2020-07-09 15:56 ` Dave Hansen
2020-07-09 16:07 ` Andy Lutomirski
2020-07-09 16:22 ` Dave Hansen
2020-07-09 16:22 ` Dave Hansen
2020-07-09 16:27 ` Andy Lutomirski
2020-07-14 5:36 ` Andersen, John, Arvind Sankar
2020-07-14 5:36 ` Andersen, John, Arvind Sankar
2020-07-14 5:39 ` Andersen, John
2020-07-14 5:39 ` Andersen, John
2020-07-15 4:41 ` Sean Christopherson
2020-07-15 4:41 ` Sean Christopherson
2020-07-15 19:58 ` Andersen, John
2020-07-15 19:58 ` Andersen, John
2020-07-09 23:37 ` Kees Cook
2020-07-09 23:37 ` Kees Cook
2020-06-17 19:07 ` [PATCH 3/4] selftests: kvm: add test for CR pinning with SMM John Andersen
2020-06-17 19:07 ` [PATCH 4/4] X86: Use KVM CR pin MSRs John Andersen
2020-06-18 14:41 ` Dave Hansen
2020-06-18 15:26 ` Andersen, John
2020-06-18 15:38 ` Dave Hansen
2020-06-18 15:49 ` Andersen, John
2020-06-20 5:13 ` Andy Lutomirski
2020-06-20 5:13 ` Andy Lutomirski
2020-06-23 20:03 ` Andersen, John
2020-06-23 20:03 ` Andersen, John
2020-07-03 21:48 ` Andersen, John
2020-07-03 21:48 ` Andersen, John
2020-07-04 15:11 ` Arvind Sankar [this message]
2020-07-04 15:11 ` Arvind Sankar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200704151121.GA1611291@rani.riverdale.lan \
--to=nivedita@alum.mit.edu \
--cc=aaronlewis@google.com \
--cc=arjan@linux.intel.com \
--cc=bhe@redhat.com \
--cc=bp@alien8.de \
--cc=caoj.fnst@cn.fujitsu.com \
--cc=corbet@lwn.net \
--cc=dan.j.williams@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=drjones@redhat.com \
--cc=eric.auger@redhat.com \
--cc=fenghua.yu@intel.com \
--cc=geremy.condra@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=jgross@suse.com \
--cc=jmattson@google.com \
--cc=john.s.andersen@intel.com \
--cc=joro@8bytes.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=kristen@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=liran.alon@oracle.com \
--cc=luto@kernel.org \
--cc=makarandsonare@google.com \
--cc=mchehab+huawei@kernel.org \
--cc=mike.kravetz@oracle.com \
--cc=mingo@redhat.com \
--cc=oneukum@suse.com \
--cc=paulmck@kernel.org \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=pbonzini@redhat.com \
--cc=peterx@redhat.com \
--cc=peterz@infradead.org \
--cc=reinette.chatre@intel.com \
--cc=rick.p.edgecombe@intel.com \
--cc=sean.j.christopherson@intel.com \
--cc=shuah@kernel.org \
--cc=tglx@linutronix.de \
--cc=vineela.tummalapalli@intel.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.