linux-kernel - Re: [PATCH 0/3] Resolve problems with kexec identity mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZnBR6MgS-jzjgA8A@swahl-home.5wahls.com>
Date: Mon, 17 Jun 2024 10:10:32 -0500
From: Steve Wahl <steve.wahl@....com>
To: Borislav Petkov <bp@...en8.de>
Cc: Steve Wahl <steve.wahl@....com>, Ashish Kalra <ashish.kalra@....com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        linux-kernel@...r.kernel.org, Pavin Joseph <me@...injoseph.com>,
        Eric Hagberg <ehagberg@...il.com>, Simon Horman <horms@...ge.net.au>,
        Eric Biederman <ebiederm@...ssion.com>, Dave Young <dyoung@...hat.com>,
        Sarah Brofeldt <srhb@....dk>, Russ Anderson <rja@....com>,
        Dimitri Sivanich <sivanich@....com>,
        Hou Wenlong <houwenlong.hwl@...group.com>,
        Andrew Morton <akpm@...ux-foundation.org>, Baoquan He <bhe@...hat.com>,
        Yuntao Wang <ytcoode@...il.com>, Bjorn Helgaas <bhelgaas@...gle.com>,
        Joerg Roedel <jroedel@...e.de>, Michael Roth <michael.roth@....com>
Subject: Re: [PATCH 0/3] Resolve problems with kexec identity mapping

On Sun, Jun 16, 2024 at 10:25:33PM +0200, Borislav Petkov wrote:
> On Thu, Jun 13, 2024 at 11:16:36AM -0500, Steve Wahl wrote:
> > The Atom was the prominent example of a platform that the code
> > introduced for SEV broke.  Unfortunately, the fix currently
> > implemented leaves things still broken for actual AMD SEV capable
> > processors when nogbpages is used,
> 
> Ok, how do I reproduce this?
> 
> Please give exact step-by-step directions.

The first, hardest step is locate a system that is AMD based, SEV
capable, with a BIOS that chooses to locate the CC_BLOB at addresses
that do not share a 2M page with other chunks of memory the kernel
currently adds to the kexec identity map.  I.e. This is a stroke of
luck, and for all I know could depend on configuration such as memory
size in addition to motherboard and BIOS version.  However, it does
not seem to change from boot to boot; as system that has the problem
seems to be consistent about it.

Second, boot linux including the "nogbpages" command line option.

Third, kexec -l <kernel image> --append=<command line options>
--initrd=<initrd>.

Fourth, kexec -e.

Systems that have this problem successfully kexec without the
"nogbpages" parameter, but fail and do a full reboot with the
"nogbpages" parameter.  

I wish I could be more exact, filling in <kernel image> and <command
line options> and <initrd> for you, but they must be tailored to the
needs of the particular system.

I do not have direct access to a system with this problem myself. I
have relied on others who reported the problem to reproduce it and
test my fix.

Thanks,

--> Steve Wahl

-- 
Steve Wahl, Hewlett Packard Enterprise