[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Zo1rugBl5WWy-1LJ@swahl-home.5wahls.com>
Date: Tue, 9 Jul 2024 11:56:26 -0500
From: Steve Wahl <steve.wahl@....com>
To: Borislav Petkov <bp@...en8.de>
Cc: Steve Wahl <steve.wahl@....com>, Ard Biesheuvel <ardb@...nel.org>,
Ashish Kalra <ashish.kalra@....com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Andy Lutomirski <luto@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
linux-kernel@...r.kernel.org, Pavin Joseph <me@...injoseph.com>,
Eric Hagberg <ehagberg@...il.com>, Simon Horman <horms@...ge.net.au>,
Eric Biederman <ebiederm@...ssion.com>, Dave Young <dyoung@...hat.com>,
Sarah Brofeldt <srhb@....dk>, Russ Anderson <rja@....com>,
Dimitri Sivanich <sivanich@....com>,
Hou Wenlong <houwenlong.hwl@...group.com>,
Andrew Morton <akpm@...ux-foundation.org>, Baoquan He <bhe@...hat.com>,
Yuntao Wang <ytcoode@...il.com>, Bjorn Helgaas <bhelgaas@...gle.com>,
Joerg Roedel <jroedel@...e.de>, Michael Roth <michael.roth@....com>
Subject: Re: [PATCH 0/3] Resolve problems with kexec identity mapping
On Tue, Jul 09, 2024 at 06:46:20PM +0200, Borislav Petkov wrote:
> On Tue, Jul 09, 2024 at 10:07:48AM -0500, Steve Wahl wrote:
> > I think perhaps the cover letter was also too verbose on the history
> > and unintentionally hid the information necesary to understand the
> > situation. I will try to make it more concise.
>
> Thanks.
>
> And while we're at it, I think we should do this too.
>
> Which should actually fix your issue too.
Ok, that one is interesting. I think you are right, it will fix the
problem as we would bail before calling find_cc_blob(), which is where
we get into trouble. (That call happens just outside the context
displayed by the diff below).
I will add it.
--> Steve
> ---
> diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
> index cd44e120fe53..a838cad72532 100644
> --- a/arch/x86/boot/compressed/sev.c
> +++ b/arch/x86/boot/compressed/sev.c
> @@ -484,6 +484,15 @@ static bool early_snp_init(struct boot_params *bp)
> {
> struct cc_blob_sev_info *cc_info;
>
> + /*
> + * Bail out if not running on a hypervisor (HV). If the HV
> + * doesn't set the bit, that's an easy SEV-* guest DOS but that
> + * HV has then bigger problems: the SEV-* guest simply won't
> + * start.
> + */
> + if (!(native_cpuid_ecx(1) & BIT(31)))
> + return false;
> +
> if (!bp)
> return false;
>
>
> --
> Regards/Gruss,
> Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette
--
Steve Wahl, Hewlett Packard Enterprise
Powered by blists - more mailing lists