| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 26 Sep 2022 12:51:12 -0400 From: Paolo Bonzini <pbonzini@...hat.com> To: linux-kernel@...r.kernel.org, kvm@...r.kernel.org Cc: seanjc@...gle.com Subject: [PATCH] KVM: x86: disable on 32-bit unless CONFIG_BROKEN 32-bit KVM has extra complications in the code due to: - different ways to write 64-bit values in VMCS - different handling of DS and ES selectors as well as FS/GS bases - lack of CR8 and EFER - lack of XFD - impossibility of writing 64-bit PTEs atomically The last is the big one, because it prevents from using the TDP MMU unconditionally. Since 32-bit processors with virtualization extensions are a historical curiosity, and even 32-bit userspace can only deal with small guests due to limited address space, it makes sense to restrict KVM to 64-bit hosts and kernels. In preparation for that make 32-bit KVM depend on CONFIG_BROKEN, and opportunistically rephrase the help message---processors with virtualization extensions are supported even if they are not "fairly recent". Signed-off-by: Paolo Bonzini <pbonzini@...hat.com> --- arch/x86/kvm/Kconfig | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig index e3cbd7706136..a107df22ffee 100644 --- a/arch/x86/kvm/Kconfig +++ b/arch/x86/kvm/Kconfig @@ -21,6 +21,7 @@ if VIRTUALIZATION config KVM tristate "Kernel-based Virtual Machine (KVM) support" depends on HAVE_KVM + depends on X86_64 || BROKEN depends on HIGH_RES_TIMERS depends on X86_LOCAL_APIC select PREEMPT_NOTIFIERS @@ -50,12 +51,13 @@ config KVM select HAVE_KVM_PM_NOTIFIER if PM help Support hosting fully virtualized guest machines using hardware - virtualization extensions. You will need a fairly recent - processor equipped with virtualization extensions. You will also - need to select one or more of the processor modules below. + virtualization extensions. You will also need to select one or + more of the processor modules below. This module provides access to the hardware capabilities through - a character device node named /dev/kvm. + a character device node named /dev/kvm. You might have to enable + virtualization extensions in the firmware setup if the device is + not visible. To compile this as a module, choose M here: the module will be called kvm. -- 2.31.1
Powered by blists - more mailing lists