Re: [PATCH v2] x86: disable PKU when running on Apple Virtualization

[Ingo Molnar]

* Akihiro Suda <suda.gitsendemail@xxxxxxxxx> wrote:

> OSPKE seems broken on Apple Virtualization.
> 
>   WARNING: CPU: 0 PID: 1 at arch/x86/kernel/fpu/xstate.c:1003 get_xsave_addr_user+0x28/0x40
>   (...)
>   Call Trace:
>    <TASK>
>    ? get_xsave_addr_user+0x28/0x40
>    ? __warn.cold+0x8e/0xea
>    ? get_xsave_addr_user+0x28/0x40
>    ? report_bug+0xff/0x140
>    ? handle_bug+0x3b/0x70
>    ? exc_invalid_op+0x17/0x70
>    ? asm_exc_invalid_op+0x1a/0x20
>    ? get_xsave_addr_user+0x28/0x40
>    copy_fpstate_to_sigframe+0x1be/0x380
>    ? __put_user_8+0x11/0x20
>    get_sigframe+0xf1/0x280
>    x64_setup_rt_frame+0x67/0x2c0
>    arch_do_signal_or_restart+0x1b3/0x240
>    syscall_exit_to_user_mode+0xb0/0x130
>    do_syscall_64+0xab/0x1a0
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Tested on macOS 13.5.1 running on MacBook Pro 2020 with
> Intel(R) Core(TM) i7-1068NG7 CPU @ 2.30GHz.
> 
> Fixes: 70044df250d0 ("x86/pkeys: Update PKRU to enable all pkeys before XSAVE")
> Link: https://lore.kernel.org/regressions/CAG8fp8QvH71Wi_y7b7tgFp7knK38rfrF7rRHh-gFKqeS0gxY6Q@xxxxxxxxxxxxxx/T/#u
> Link: https://github.com/lima-vm/lima/issues/3334
> Signed-off-by: Akihiro Suda <akihiro.suda.cz@xxxxxxxxxxxxx>
> ---
> v2: check oem_table_id rather than oem_id for better robustness

So this is rather weird, but I've applied the quirk as it upgrades 
broken guest side code into a boot time warning.

> +	/*
> +	 * OSPKE seems broken on Apple Virtualization.
> +	 * https://lore.kernel.org/regressions/CAG8fp8QvH71Wi_y7b7tgFp7knK38rfrF7rRHh-gFKqeS0gxY6Q@xxxxxxxxxxxxxx/T/#u
> +	 *
> +	 * TODO: conditionally enable pku depending on the DMI BIOS version when Apple
> +	 * fixes the issue.
> +	 *
> +	 * However, this would be still not enough because DMI is missing when vmlinuz
> +	 * is directly loaded into VM.
> +	 */
> +	if (!memcmp(acpi_gbl_FADT.header.oem_table_id, "Apple Vz", 8)) {
> +		pr_info("pku: disabled on Apple Virtualization platform (Intel) due to a bug\n");
> +		pku_disabled = true;
> +	}

Note that I updated the comments here (the git log gives enough 
information), plus enclosed this into #ifdef CONFIG_ACPI, as 
acpi_gbl_FADT is not available on !CONFIG_ACPI builds.

Thanks,

	Ingo