linux-kernel - [PATCH] KVM: x86: disable on 32-bit unless CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220926165112.603078-1-pbonzini@redhat.com>
Date:   Mon, 26 Sep 2022 12:51:12 -0400
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc:     seanjc@...gle.com
Subject: [PATCH] KVM: x86: disable on 32-bit unless CONFIG_BROKEN

32-bit KVM has extra complications in the code due to:

- different ways to write 64-bit values in VMCS

- different handling of DS and ES selectors as well as FS/GS bases

- lack of CR8 and EFER

- lack of XFD

- impossibility of writing 64-bit PTEs atomically

The last is the big one, because it prevents from using the TDP MMU
unconditionally.

Since 32-bit processors with virtualization extensions are a historical
curiosity, and even 32-bit userspace can only deal with small guests
due to limited address space, it makes sense to restrict KVM to 64-bit
hosts and kernels.

In preparation for that make 32-bit KVM depend on CONFIG_BROKEN, and
opportunistically rephrase the help message---processors with
virtualization extensions are supported even if they are not
"fairly recent".

Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
---
 arch/x86/kvm/Kconfig | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index e3cbd7706136..a107df22ffee 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -21,6 +21,7 @@ if VIRTUALIZATION
 config KVM
 	tristate "Kernel-based Virtual Machine (KVM) support"
 	depends on HAVE_KVM
+	depends on X86_64 || BROKEN
 	depends on HIGH_RES_TIMERS
 	depends on X86_LOCAL_APIC
 	select PREEMPT_NOTIFIERS
@@ -50,12 +51,13 @@ config KVM
 	select HAVE_KVM_PM_NOTIFIER if PM
 	help
 	  Support hosting fully virtualized guest machines using hardware
-	  virtualization extensions.  You will need a fairly recent
-	  processor equipped with virtualization extensions. You will also
-	  need to select one or more of the processor modules below.
+	  virtualization extensions. You will also need to select one or
+	  more of the processor modules below.
 
 	  This module provides access to the hardware capabilities through
-	  a character device node named /dev/kvm.
+	  a character device node named /dev/kvm.  You might have to enable
+	  virtualization extensions in the firmware setup if the device is
+	  not visible.
 
 	  To compile this as a module, choose M here: the module
 	  will be called kvm.
-- 
2.31.1