linux-kernel - Re: [PATCH 0/3] Resolve problems with kexec identity mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZnmMdEWDtRIqpZ5T@swahl-home.5wahls.com>
Date: Mon, 24 Jun 2024 10:10:44 -0500
From: Steve Wahl <steve.wahl@....com>
To: "Kalra, Ashish" <ashish.kalra@....com>
Cc: Borislav Petkov <bp@...en8.de>, Steve Wahl <steve.wahl@....com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        linux-kernel@...r.kernel.org, Pavin Joseph <me@...injoseph.com>,
        Eric Hagberg <ehagberg@...il.com>, Simon Horman <horms@...ge.net.au>,
        Eric Biederman <ebiederm@...ssion.com>, Dave Young <dyoung@...hat.com>,
        Sarah Brofeldt <srhb@....dk>, Russ Anderson <rja@....com>,
        Dimitri Sivanich <sivanich@....com>,
        Hou Wenlong <houwenlong.hwl@...group.com>,
        Andrew Morton <akpm@...ux-foundation.org>, Baoquan He <bhe@...hat.com>,
        Yuntao Wang <ytcoode@...il.com>, Bjorn Helgaas <bhelgaas@...gle.com>,
        Joerg Roedel <jroedel@...e.de>, Michael Roth <michael.roth@....com>
Subject: Re: [PATCH 0/3] Resolve problems with kexec identity mapping

On Fri, Jun 21, 2024 at 02:41:35PM -0500, Kalra, Ashish wrote:
> On 6/21/2024 8:17 AM, Borislav Petkov wrote:
> 
> > On Mon, Jun 17, 2024 at 10:10:32AM -0500, Steve Wahl wrote:
> >> The first, hardest step is locate a system that is AMD based, SEV
> >> capable, with a BIOS that chooses to locate the CC_BLOB at addresses
> >> that do not share a 2M page with other chunks of memory the kernel
> >> currently adds to the kexec identity map. I.e. This is a stroke of
> >> luck,
> > Ya think?
> >
> > It is more likely that I win the lottery than finding such a beast. ;-\
> >
> >> and for all I know could depend on configuration such as memory
> >> size in addition to motherboard and BIOS version.  However, it does
> >> not seem to change from boot to boot; as system that has the problem
> >> seems to be consistent about it.
> >>
> >> Second, boot linux including the "nogbpages" command line option.
> >>
> >> Third, kexec -l <kernel image> --append=<command line options>
> >> --initrd=<initrd>.
> >>
> >> Fourth, kexec -e.
> >>
> >> Systems that have this problem successfully kexec without the
> >> "nogbpages" parameter, but fail and do a full reboot with the
> >> "nogbpages" parameter.  
> >>
> >> I wish I could be more exact,
> > Yes, this doesn't really explain what the culprit is.
> >
> > So, your 0th message says:
> >
> > "But the community chose instead to avoid referencing this memory on
> > non-AMD systems where the problem was reported.
> >
> >     commit bee6cf1a80b5 ("x86/sev: Do not try to parse for the CC blob
> >                           on non-AMD hardware")"
> >
> > But that patch fixes !AMD systems.
> >
> > Now you're basically saying that there are some AMD machines out there where
> > the EFI config table doesn't get mapped because it is somewhere else, outside
> > of the range of a 2M page or 1G page.
> >
> > Or even if it is, "nogbpages" supplied on the cmdline would cause the
> > "overlapping 2M and 1G mapping to not happen, leaving the EFI config table
> > unmapped.
> 
> From the instructions to reproduce this issue, it looks it is only reproducible on some AMD systems with the "nogbpages" parameter supplied on the kexec-ed kernel's command line, so supplying "nogbpages" is essential to reproduce this, but then "nogbpages" as mentioned makes sense on Atom processors mainly and those are already safe due to the following commit/patch:
> 
> commit bee6cf1a80b5 ("x86/sev: Do not try to parse for the CC blob
>                           on non-AMD hardware")
> 
> The question is why would you want to use "nogbpages" on AMD systems and then find one of this system which does not have EFI config table mapped as it is outside the range of a 2M or 1G page.

"nogbpages" uses 2M pages exclusively and illustrates the same problem
that would/did surface with patch #3 that uses a combination of 2M and
1G pages.  This is the source of the regression that caused patch #3
to be reverted after it previously got into the mainline.

I'm not sure there is currently a reason to use it other than this
illustration.  If a reason to use it did arise, though, you would hit
this problem.

Thanks,

--> Steve Wahl

-- 
Steve Wahl, Hewlett Packard Enterprise