<fweisbec@xxxxxxxxx>,"Luis R . Rodriguez" <mcgrof@xxxxxxxxxx>,Stanislaw Gruszka <sgruszka@xxxxxxxxxx>,Peter Zijlstra <peterz@xxxxxxxxxxxxx>,Josh Poimboeuf <jpoimboe@xxxxxxxxxx>,Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>,Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx>,Joerg Roedel <joro@xxxxxxxxxx>, TF-8?B?UmFkaW0gS3LEjW3DocWZ?From: hpa@xxxxxxxxx Message-ID: <550F6209-025A-45E2-84E2-F00A3771C0B1@xxxxxxxxx> On March 14, 2017 2:20:19 PM PDT, Thomas Garnier <thgarnie@xxxxxxxxxx> wrote: >On Tue, Mar 14, 2017 at 2:04 PM, Pavel Machek <pavel@xxxxxx> wrote: >> On Tue 2017-03-14 10:05:08, Thomas Garnier wrote: >>> This patch makes the GDT remapped pages read-only to prevent >corruption. >>> This change is done only on 64-bit. >>> >>> The native_load_tr_desc function was adapted to correctly handle a >>> read-only GDT. The LTR instruction always writes to the GDT TSS >entry. >>> This generates a page fault if the GDT is read-only. This change >checks >>> if the current GDT is a remap and swap GDTs as needed. This function >was >>> tested by booting multiple machines and checking hibernation works >>> properly. >>> >>> KVM SVM and VMX were adapted to use the writeable GDT. On VMX, the >>> per-cpu variable was removed for functions to fetch the original >GDT. >>> Instead of reloading the previous GDT, VMX will reload the fixmap >GDT as >>> expected. For testing, VMs were started and restored on multiple >>> configurations. >>> >>> Signed-off-by: Thomas Garnier <thgarnie@xxxxxxxxxx> >> >> Can we get the same change for 32-bit, too? Growing differences >> between 32 and 64 bit are a bit of a problem... >> Pavel > >It was discussed on previous versions that 32-bit read-only support >would create issues that why it was favor for 64-bit only right now. > >> >> -- >> (english) http://www.livejournal.com/~pavelmachek >> (cesky, pictures) >http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html We can't make the GDT read-only on 32 bits since we use task switches for last-resort recovery. 64 bits has IST instead. -- Sent from my Android device with K-9 Mail. Please excuse my brevity. -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
