linux-kernel - Re: [PATCH 0/3] Resolve problems with kexec identity mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <40ed4296-e9ef-423d-a40b-889334eebcd4@amd.com>
Date: Fri, 21 Jun 2024 14:41:35 -0500
From: "Kalra, Ashish" <ashish.kalra@....com>
To: Borislav Petkov <bp@...en8.de>, Steve Wahl <steve.wahl@....com>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>,
 Andy Lutomirski <luto@...nel.org>, Peter Zijlstra <peterz@...radead.org>,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
 linux-kernel@...r.kernel.org, Pavin Joseph <me@...injoseph.com>,
 Eric Hagberg <ehagberg@...il.com>, Simon Horman <horms@...ge.net.au>,
 Eric Biederman <ebiederm@...ssion.com>, Dave Young <dyoung@...hat.com>,
 Sarah Brofeldt <srhb@....dk>, Russ Anderson <rja@....com>,
 Dimitri Sivanich <sivanich@....com>,
 Hou Wenlong <houwenlong.hwl@...group.com>,
 Andrew Morton <akpm@...ux-foundation.org>, Baoquan He <bhe@...hat.com>,
 Yuntao Wang <ytcoode@...il.com>, Bjorn Helgaas <bhelgaas@...gle.com>,
 Joerg Roedel <jroedel@...e.de>, Michael Roth <michael.roth@....com>
Subject: Re: [PATCH 0/3] Resolve problems with kexec identity mapping

On 6/21/2024 8:17 AM, Borislav Petkov wrote:

> On Mon, Jun 17, 2024 at 10:10:32AM -0500, Steve Wahl wrote:
>> The first, hardest step is locate a system that is AMD based, SEV
>> capable, with a BIOS that chooses to locate the CC_BLOB at addresses
>> that do not share a 2M page with other chunks of memory the kernel
>> currently adds to the kexec identity map. I.e. This is a stroke of
>> luck,
> Ya think?
>
> It is more likely that I win the lottery than finding such a beast. ;-\
>
>> and for all I know could depend on configuration such as memory
>> size in addition to motherboard and BIOS version.  However, it does
>> not seem to change from boot to boot; as system that has the problem
>> seems to be consistent about it.
>>
>> Second, boot linux including the "nogbpages" command line option.
>>
>> Third, kexec -l <kernel image> --append=<command line options>
>> --initrd=<initrd>.
>>
>> Fourth, kexec -e.
>>
>> Systems that have this problem successfully kexec without the
>> "nogbpages" parameter, but fail and do a full reboot with the
>> "nogbpages" parameter.  
>>
>> I wish I could be more exact,
> Yes, this doesn't really explain what the culprit is.
>
> So, your 0th message says:
>
> "But the community chose instead to avoid referencing this memory on
> non-AMD systems where the problem was reported.
>
>     commit bee6cf1a80b5 ("x86/sev: Do not try to parse for the CC blob
>                           on non-AMD hardware")"
>
> But that patch fixes !AMD systems.
>
> Now you're basically saying that there are some AMD machines out there where
> the EFI config table doesn't get mapped because it is somewhere else, outside
> of the range of a 2M page or 1G page.
>
> Or even if it is, "nogbpages" supplied on the cmdline would cause the
> "overlapping 2M and 1G mapping to not happen, leaving the EFI config table
> unmapped.

>From the instructions to reproduce this issue, it looks it is only reproducible on some AMD systems with the "nogbpages" parameter supplied on the kexec-ed kernel's command line, so supplying "nogbpages" is essential to reproduce this, but then "nogbpages" as mentioned makes sense on Atom processors mainly and those are already safe due to the following commit/patch:

commit bee6cf1a80b5 ("x86/sev: Do not try to parse for the CC blob
                          on non-AMD hardware")

The question is why would you want to use "nogbpages" on AMD systems and then find one of this system which does not have EFI config table mapped as it is outside the range of a 2M or 1G page.

Thanks, Ashish

>
> Am I on the right track here?
>