linux-kernel - Re: [RFC PATCH] x86/virt/tdx: Disable KEXEC in the presence of TDX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 19 Jan 2024 02:49:16 +0200
From: Nikolay Borisov <nik.borisov@...e.com>
To: "Huang, Kai" <kai.huang@...el.com>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "kirill.shutemov@...ux.intel.com" <kirill.shutemov@...ux.intel.com>
Cc: "linux-coco@...ts.linux.dev" <linux-coco@...ts.linux.dev>,
 "x86@...nel.org" <x86@...nel.org>,
 "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>
Subject: Re: [RFC PATCH] x86/virt/tdx: Disable KEXEC in the presence of TDX

[Adding Kirill as he has a series in flight about KEXEC]

On 18.01.24 г. 23:31 ч., Huang, Kai wrote:
> On Thu, 2024-01-18 at 18:01 +0200, Nikolay Borisov wrote:
>> TDX doesn't currently support kexec so disable the latter when TDX
>> is detected at boot time. If kexec must absolutely be supported then
>> TDX can be disabled from the bios.
>>
>> Making this decision at run time rather than as a compile time option
>> allows distribution kernels to have both enabled and delegate to the
>> user whether they want to use TDX/Kexec.
>>
>> Signed-off-by: Nikolay Borisov <nik.borisov@...e.com>
> 
> Hi Nikolay,
> 
> Thanks for the patch.
> 
> I am working in progress on patches to make kexec() work with TDX.  I plan to
> send them out soon (e.g., next week), but I think perhaps your patch is
> reasonable before that is merged.

I thought Kirill's series rectifies this ?


> 
> Acked-by: Kai Huang <kai.huang@...el.com>
> 
>> ---
>>
>> Sending as RFC as I don't know the reason why initially it was decided to
>> enforce the incompaibility between kexec/tdx at build time rather than runtime.
>>
>>   arch/x86/Kconfig            | 1 -
>>   arch/x86/virt/vmx/tdx/tdx.c | 6 ++++++
>>   include/linux/kexec.h       | 1 +
>>   kernel/kexec_core.c         | 5 +++++
>>   4 files changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>> index 92c03cb99b3e..6c2b620b40d8 100644
>> --- a/arch/x86/Kconfig
>> +++ b/arch/x86/Kconfig
>> @@ -1973,7 +1973,6 @@ config INTEL_TDX_HOST
>>   	depends on X86_X2APIC
>>   	select ARCH_KEEP_MEMBLOCK
>>   	depends on CONTIG_ALLOC
>> -	depends on !KEXEC_CORE
>>   	depends on X86_MCE
>>   	help
>>   	  Intel Trust Domain Extensions (TDX) protects guest VMs from malicious
>> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
>> index 4d6826a76f78..270090bd7b5e 100644
>> --- a/arch/x86/virt/vmx/tdx/tdx.c
>> +++ b/arch/x86/virt/vmx/tdx/tdx.c
>> @@ -20,6 +20,7 @@
>>   #include <linux/memblock.h>
>>   #include <linux/memory.h>
>>   #include <linux/minmax.h>
>> +#include <linux/kexec.h>
>>   #include <linux/sizes.h>
>>   #include <linux/pfn.h>
>>   #include <linux/align.h>
>> @@ -1473,6 +1474,11 @@ void __init tdx_init(void)
>>   		return;
>>   	}
>>
>> +#ifdef CONFIG_KEXEC_CORE
>> +	kexec_disable();
>> +	pr_info("Disable Kexec. Turn off TDX in the BIOS to use KEXEC.\n");
>> +#endif
>> +
>>   #if defined(CONFIG_ACPI) && defined(CONFIG_SUSPEND)
>>   	pr_info("Disable ACPI S3. Turn off TDX in the BIOS to use ACPI S3.\n");
>>   	acpi_suspend_lowlevel = NULL;
>> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
>> index 8227455192b7..c434c8569242 100644
>> --- a/include/linux/kexec.h
>> +++ b/include/linux/kexec.h
>> @@ -500,6 +500,7 @@ static inline int crash_hotplug_memory_support(void) { return 0; }
>>   static inline unsigned int crash_get_elfcorehdr_size(void) { return 0; }
>>   #endif
>>
>> +extern void kexec_disable(void);
>>   #else /* !CONFIG_KEXEC_CORE */
>>   struct pt_regs;
>>   struct task_struct;
>> diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
>> index be5642a4ec49..8d3a2a04ff4d 100644
>> --- a/kernel/kexec_core.c
>> +++ b/kernel/kexec_core.c
>> @@ -927,6 +927,11 @@ struct kimage *kexec_image;
>>   struct kimage *kexec_crash_image;
>>   static int kexec_load_disabled;
>>
>> +void kexec_disable(void)
>> +{
>> +	kexec_load_disabled = 1;
>> +}
>> +
>>   #ifdef CONFIG_SYSCTL
>>   static int kexec_limit_handler(struct ctl_table *table, int write,
>>   			       void *buffer, size_t *lenp, loff_t *ppos)
>> --
>> 2.34.1
>>
>>
>