On Wed, Jun 17, 2020 at 12:05 PM John Andersen <john.s.andersen@xxxxxxxxx> wrote: > Guests using the kexec system call currently do not support > paravirtualized control register pinning. This is due to early boot > code writing known good values to control registers, these values do > not contain the protected bits. This is due to CPU feature > identification being done at a later time, when the kernel properly > checks if it can enable protections. As such, the pv_cr_pin command line > option has been added which instructs the kernel to disable kexec in > favor of enabling paravirtualized control register pinning. crashkernel > is also disabled when the pv_cr_pin parameter is specified due to its > reliance on kexec. Is there a plan for fixing this for real? I'm wondering if there is a sane weakening of this feature that still allows things like kexec. What happens if a guest tries to reset? For that matter, what happens when a guest vCPU sends SIPI to another guest vCPU? The target CPU starts up in real mode, right? There's no SMEP or SMAP in real mode, and real mode has basically no security mitigations at all. PCID is an odd case. I see no good reason to pin it, and pinning PCID on prevents use of 32-bit mode.
