linux-kernel - Re: [PATCH 0/3] Resolve problems with kexec identity mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240709103742.GCZo0S9md7YyeevRN-@fat_crate.local>
Date: Tue, 9 Jul 2024 12:37:42 +0200
From: Borislav Petkov <bp@...en8.de>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Steve Wahl <steve.wahl@....com>, Ashish Kalra <ashish.kalra@....com>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	Andy Lutomirski <luto@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
	Pavin Joseph <me@...injoseph.com>,
	Eric Hagberg <ehagberg@...il.com>,
	Simon Horman <horms@...ge.net.au>,
	Eric Biederman <ebiederm@...ssion.com>,
	Dave Young <dyoung@...hat.com>, Sarah Brofeldt <srhb@....dk>,
	Russ Anderson <rja@....com>, Dimitri Sivanich <sivanich@....com>,
	Hou Wenlong <houwenlong.hwl@...group.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Baoquan He <bhe@...hat.com>, Yuntao Wang <ytcoode@...il.com>,
	Bjorn Helgaas <bhelgaas@...gle.com>, Joerg Roedel <jroedel@...e.de>,
	Michael Roth <michael.roth@....com>
Subject: Re: [PATCH 0/3] Resolve problems with kexec identity mapping

On Tue, Jul 09, 2024 at 08:49:43AM +0200, Ard Biesheuvel wrote:
> > Patch #2 adds the CC blob to the identity map as well, if present,
> > since if present it is also dereferenced before the page fault handler
> > can be put into place.  Given what's been discussed, this patch might
> > not be necessary; I don't know enough to say whether kexec-ing a new
> > kernel within a SEV guest makes sense.  I'm pretty certain it can
> > cause no harm, though.

No, keep it in the bag until it is really needed. No proactive "fixing".

> I'd prefer it if that is addressed within the context of the SEV guest
> work. The memory setup is quite intricate, and dealing with individual
> types of EFI config tables is something we should avoid in general. I
> still maintain that the best approach would be to map all of DRAM 1:1
> instead of mapping patches left and right (as this is what EFI does),
> but if we need to do so, let's keep it as generic as we possibly can.

Sure. There's the kink that coco guests need to accept memory first and
mapping it all is the least performant one. But we can deal with that later.

> I wasn't cc'ed on any of the patches so I don't know exactly what was
> discussed.
> 
> Please cc me and linux-efi@ on your next revision.

And please update your commit messages with what was discussed on this thread.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette