linux-kernel - Re: [PATCH 4/7] x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bbad67640018eccc023d2afce313f3b5bc806cfb.camel@intel.com>
Date: Wed, 1 Oct 2025 21:19:13 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "Hansen, Dave" <dave.hansen@...el.com>, "Annapurve, Vishal"
	<vannapurve@...gle.com>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "tglx@...utronix.de"
	<tglx@...utronix.de>, "ashish.kalra@....com" <ashish.kalra@....com>,
	"thomas.lendacky@....com" <thomas.lendacky@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Chatre,
 Reinette" <reinette.chatre@...el.com>, "dwmw@...zon.co.uk"
	<dwmw@...zon.co.uk>, "pbonzini@...hat.com" <pbonzini@...hat.com>,
	"seanjc@...gle.com" <seanjc@...gle.com>, "Yamahata, Isaku"
	<isaku.yamahata@...el.com>, "kas@...nel.org" <kas@...nel.org>,
	"mingo@...hat.com" <mingo@...hat.com>, "nik.borisov@...e.com"
	<nik.borisov@...e.com>, "hpa@...or.com" <hpa@...or.com>,
	"peterz@...radead.org" <peterz@...radead.org>, "sagis@...gle.com"
	<sagis@...gle.com>, "Chen, Farrah" <farrah.chen@...el.com>, "Edgecombe, Rick
 P" <rick.p.edgecombe@...el.com>, "bp@...en8.de" <bp@...en8.de>,
	"binbin.wu@...ux.intel.com" <binbin.wu@...ux.intel.com>, "Gao, Chao"
	<chao.gao@...el.com>, "x86@...nel.org" <x86@...nel.org>, "Williams, Dan J"
	<dan.j.williams@...el.com>
Subject: Re: [PATCH 4/7] x86/kexec: Disable kexec/kdump on platforms with TDX
 partial write erratum

On Wed, 2025-10-01 at 11:00 -0700, Hansen, Dave wrote:
> On 10/1/25 10:17, Vishal Annapurve wrote:
> > And also mentions:
> > "Also note only the normal kexec needs to worry about this problem, but
> > not the crash kexec: 1) The kdump kernel only uses the special memory
> > reserved by the first kernel, and the reserved memory can never be used
> > by TDX in the first kernel; 2) The /proc/vmcore, which reflects the
> > first (crashed) kernel's memory, is only for read.  The read will never
> > "poison" TDX memory thus cause unexpected machine check (only partial
> > write does)."
> > 
> > What was the scenario that led to disabling kdump support altogether
> > given the above description?
> 
> I think it was purely out of convenience so that the disabling could be
> three lines of code.
> 
> I don't know off the top of my head if there's a simple enough way to
> disable kexec but not kdump. When I applied the thing, I was probably
> just considering kexec/kdump a monolithic thing and not thinking that
> folks would want one but not the other.
> 
> Kai, did you have any other motivations?

The "/proc/vmcore is only for read" is my understanding of how the kdump
kernel uses the /proc/vmcore.  I used to only disable kexec but allow
kdump to work (something like the diff below [*]), but during the internal
review we decided to just disable all since we cannot be sure whether it
is 100% true for all the kdump users.

This was raised by Vishal publicly before and was discussed here (in v3):

https://lore.kernel.org/kvm/f8dcbe257b3931aec9e199132b678bd7681b7efa.camel@intel.com/

[*]:

diff --git a/arch/x86/kernel/machine_kexec_64.c
b/arch/x86/kernel/machine_kexec_64.c
index 15088d14904f..c7af4aa7dd6b 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -356,10 +356,11 @@ int machine_kexec_prepare(struct kimage *image)
         * On those platforms the old kernel must reset TDX private
         * memory before jumping to the new kernel otherwise the new
         * kernel may see unexpected machine check.  For simplicity
-        * just fail kexec/kdump on those platforms.
+        * just fail kexec on those platforms.  Still allow kdump since
+        * the kdump kernel will only reads TDX memory but not write.
         */
-       if (boot_cpu_has_bug(X86_BUG_TDX_PW_MCE)) {
-               pr_info_once("Not allowed on platform with tdx_pw_mce
bug\n");
+       if (boot_cpu_has_bug(X86_BUG_TDX_PW_MCE) && image->type !=
KEXEC_TYPE_CRASH) {
+               pr_info_once("Kexec not allowed on platform with
tdx_pw_mce bug\n");
                return -EOPNOTSUPP;
        }