linux-kernel - Re: [PATCH] KVM: x86: disable on 32-bit unless CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Sep 2022 10:10:53 +0300
From:   Maxim Levitsky <mlevitsk@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Cc:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Subject: Re: [PATCH] KVM: x86: disable on 32-bit unless CONFIG_BROKEN

On Tue, 2022-09-27 at 17:07 +0000, Sean Christopherson wrote:
> On Mon, Sep 26, 2022, Paolo Bonzini wrote:
> > 32-bit KVM has extra complications in the code due to:
> > 
> > - different ways to write 64-bit values in VMCS
> > 
> > - different handling of DS and ES selectors as well as FS/GS bases
> > 
> > - lack of CR8 and EFER
> > 
> > - lack of XFD
> > 
> 
> More for the list:
> 
>   - SVM is effectively restricted to PAE kernels due to NX requirements
> 
> > - impossibility of writing 64-bit PTEs atomically
> 
> It's not impossible, just ugly.  KVM could use CMPXCHG8B to do all of the accesses
> for the TDP MMU, including the non-atomic reads and writes.
> 
> > The last is the big one, because it prevents from using the TDP MMU
> > unconditionally.
> 
> As above, if the TDP MMU really is the sticking point, that's solvable.
> 
> The real justification for deprecating 32-bit KVM is that, outside of KVM developers,
> literally no one uses 32-bit KVM.  I.e. any amount of effort that is required to
> continue supporting 32-bit kernels is a complete waste of resources.
> 

I also think that outside KVM developers nobody should be using KVM on 32 bit host.

However for _developement_ I think that 32 bit KVM support is very useful, as it
allows to smoke test the support for 32 bit nested hypervisors, which I do once in a while,
and can even probably be useful to some users (e.g running some legacy stuff in a VM,
which includes a hypervisor, especially to run really legacy OSes / custom bare metal software,
using an old hypervisor) - or in other words, 32 bit nested KVM is mostly useless, but
other 32 bit nested hypervisors can be useful.

Yes, I can always use an older 32 bit kernel in a guest with KVM support, but as long
as current kernel works, it is useful to use the same kernel on host and guest.

Best regards,
	Maxim Levitsky