linux-kernel - Re: [PATCH v2] x86: disable PKU when running on Apple Virtualization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9MPmA-myNZxcc-E@gmail.com>
Date: Thu, 13 Mar 2025 18:02:16 +0100
From: Ingo Molnar <mingo@...nel.org>
To: Akihiro Suda <suda.gitsendemail@...il.com>
Cc: linux-kernel@...r.kernel.org, x86@...nel.org, suda.kyoto@...il.com,
	regressions@...ts.linux.dev, aruna.ramakrishna@...cle.com,
	tglx@...utronix.de, Akihiro Suda <akihiro.suda.cz@....ntt.co.jp>
Subject: Re: [PATCH v2] x86: disable PKU when running on Apple Virtualization


* Akihiro Suda <suda.gitsendemail@...il.com> wrote:

> OSPKE seems broken on Apple Virtualization.
> 
>   WARNING: CPU: 0 PID: 1 at arch/x86/kernel/fpu/xstate.c:1003 get_xsave_addr_user+0x28/0x40
>   (...)
>   Call Trace:
>    <TASK>
>    ? get_xsave_addr_user+0x28/0x40
>    ? __warn.cold+0x8e/0xea
>    ? get_xsave_addr_user+0x28/0x40
>    ? report_bug+0xff/0x140
>    ? handle_bug+0x3b/0x70
>    ? exc_invalid_op+0x17/0x70
>    ? asm_exc_invalid_op+0x1a/0x20
>    ? get_xsave_addr_user+0x28/0x40
>    copy_fpstate_to_sigframe+0x1be/0x380
>    ? __put_user_8+0x11/0x20
>    get_sigframe+0xf1/0x280
>    x64_setup_rt_frame+0x67/0x2c0
>    arch_do_signal_or_restart+0x1b3/0x240
>    syscall_exit_to_user_mode+0xb0/0x130
>    do_syscall_64+0xab/0x1a0
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Tested on macOS 13.5.1 running on MacBook Pro 2020 with
> Intel(R) Core(TM) i7-1068NG7 CPU @ 2.30GHz.
> 
> Fixes: 70044df250d0 ("x86/pkeys: Update PKRU to enable all pkeys before XSAVE")
> Link: https://lore.kernel.org/regressions/CAG8fp8QvH71Wi_y7b7tgFp7knK38rfrF7rRHh-gFKqeS0gxY6Q@mail.gmail.com/T/#u
> Link: https://github.com/lima-vm/lima/issues/3334
> Signed-off-by: Akihiro Suda <akihiro.suda.cz@....ntt.co.jp>
> ---
> v2: check oem_table_id rather than oem_id for better robustness

So this is rather weird, but I've applied the quirk as it upgrades 
broken guest side code into a boot time warning.

> +	/*
> +	 * OSPKE seems broken on Apple Virtualization.
> +	 * https://lore.kernel.org/regressions/CAG8fp8QvH71Wi_y7b7tgFp7knK38rfrF7rRHh-gFKqeS0gxY6Q@mail.gmail.com/T/#u
> +	 *
> +	 * TODO: conditionally enable pku depending on the DMI BIOS version when Apple
> +	 * fixes the issue.
> +	 *
> +	 * However, this would be still not enough because DMI is missing when vmlinuz
> +	 * is directly loaded into VM.
> +	 */
> +	if (!memcmp(acpi_gbl_FADT.header.oem_table_id, "Apple Vz", 8)) {
> +		pr_info("pku: disabled on Apple Virtualization platform (Intel) due to a bug\n");
> +		pku_disabled = true;
> +	}

Note that I updated the comments here (the git log gives enough 
information), plus enclosed this into #ifdef CONFIG_ACPI, as 
acpi_gbl_FADT is not available on !CONFIG_ACPI builds.

Thanks,

	Ingo