Re: [PATCH 0/3] Resolve problems with kexec identity mapping

[Borislav Petkov]

On Mon, Jul 08, 2024 at 08:17:43PM +0200, Ard Biesheuvel wrote:
> Happy to assist, but I'm not sure I follow the approach here.
> 
> In the context of a confidential VM, I don't think the page fault
> handler is ever an acceptable approach. kexec should filter out config
> tables that it doesn't recognize, and map the ones that it does (note
> that EFI config tables have no standardized header with a length, so
> mapping tables it does *not* recognize is not feasible to begin with).
> 
> All these games with on-demand paging may have made sense for 64-bit
> kernels booting in 32-bit mode (which can only map the first 4G of
> RAM), but in a confiidential VM context with measurement/attestation
> etc I think the cure is worse than the disease.

See upthread. I think this is about AMD server machines which support SEV
baremetal and not about SEV-ES/SNP guests which must do attestation.

Steve?

AFAIR, there was some kink that we have to parse the blob regardless which
I didn't like either but I'd need to refresh with Tom and see whether we can
solve it differently after all. Perhaps check X86_FEATURE_HYPERVISOR or so...

Thx for offering to help still - appreciated! :-)

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette