[PATCHv7 5/5] arm64: Hook up the ZBOOT support as vmlinuz
From: Jeremy Linton
Add the previously defined _probe() and _usage() routines
to the kexec file types table, and build the new module.
It should be noted that this "vmlinuz" support reuses the
"Image" support to actually load the resulting image after
it has been decompressed to a temporary file.
Signed-off-by: Jeremy Linton
Signed-off-by: Pingfan Liu
To: kexec@lists.infradead.org
Cc: ho...@verge.net.au
Cc: a...@kernel.org
Cc: jeremy.lin...@arm.com
---
kexec/arch/arm64/Makefile | 3 ++-
kexec/arch/arm64/kexec-arm64.c | 1 +
kexec/arch/arm64/kexec-arm64.h | 6 ++
3 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/kexec/arch/arm64/Makefile b/kexec/arch/arm64/Makefile
index 9d9111c..59212f1 100644
--- a/kexec/arch/arm64/Makefile
+++ b/kexec/arch/arm64/Makefile
@@ -15,7 +15,8 @@ arm64_KEXEC_SRCS += \
kexec/arch/arm64/kexec-arm64.c \
kexec/arch/arm64/kexec-elf-arm64.c \
kexec/arch/arm64/kexec-uImage-arm64.c \
- kexec/arch/arm64/kexec-image-arm64.c
+ kexec/arch/arm64/kexec-image-arm64.c \
+ kexec/arch/arm64/kexec-vmlinuz-arm64.c
arm64_UIMAGE = kexec/kexec-uImage.c
diff --git a/kexec/arch/arm64/kexec-arm64.c b/kexec/arch/arm64/kexec-arm64.c
index a830ec7..4a67b0d 100644
--- a/kexec/arch/arm64/kexec-arm64.c
+++ b/kexec/arch/arm64/kexec-arm64.c
@@ -74,6 +74,7 @@ struct file_type file_type[] = {
{"vmlinux", elf_arm64_probe, elf_arm64_load, elf_arm64_usage},
{"Image", image_arm64_probe, image_arm64_load, image_arm64_usage},
{"uImage", uImage_arm64_probe, uImage_arm64_load, uImage_arm64_usage},
+ {"vmlinuz", pez_arm64_probe, pez_arm64_load, pez_arm64_usage},
};
int file_types = sizeof(file_type) / sizeof(file_type[0]);
diff --git a/kexec/arch/arm64/kexec-arm64.h b/kexec/arch/arm64/kexec-arm64.h
index d29b1b3..95fb5c2 100644
--- a/kexec/arch/arm64/kexec-arm64.h
+++ b/kexec/arch/arm64/kexec-arm64.h
@@ -44,6 +44,12 @@ int uImage_arm64_load(int argc, char **argv, const char
*buf, off_t len,
struct kexec_info *info);
void uImage_arm64_usage(void);
+int pez_arm64_probe(const char *kernel_buf, off_t kernel_size);
+int pez_arm64_load(int argc, char **argv, const char *buf, off_t len,
+ struct kexec_info *info);
+void pez_arm64_usage(void);
+
+
extern off_t initrd_base;
extern off_t initrd_size;
--
2.31.1
___
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
[PATCHv7 0/5] arm64: zboot support
From: root As more complicated capsule kernel format occurs like zboot, where the compressed kernel is stored as a payload. The straight forward decompression can not meet the demand. As the first step, on aarch64, reading in the kernel file in a probe method and decide how to unfold the content by the method itself. This series consists of two parts [1/5], simplify the current aarch64 image probe [2-5/5], return the kernel fd by the image load interface, and let the handling of zboot image built on it. (Thanks for Dave Young, who contributes the original idea and the code) To ease the review, a branch is also available at https://github.com/pfliu/kexec-tools.git branch zbootV7 To: kexec@lists.infradead.org Cc: Dave Young Cc: ho...@verge.net.au Cc: a...@kernel.org Cc: jeremy.lin...@arm.com --- v6 -> v7 Fix the included file issue in dist v5 -> v6 introduce kexec_info.kernel_fd and return the fd through image load interface. Jeremy Linton (3): kexec/zboot: Add arch independent zboot support arm64: Add ZBOOT PE containing compressed image support arm64: Hook up the ZBOOT support as vmlinuz Pingfan Liu (2): kexec/arm64: Simplify the code for zImage kexec: Introduce a member kernel_fd in kexec_info include/Makefile | 1 + include/kexec-pe-zboot.h | 15 ++ kexec/Makefile | 1 + kexec/arch/arm64/Makefile | 2 +- kexec/arch/arm64/image-header.h| 1 + kexec/arch/arm64/kexec-arm64.c | 2 +- kexec/arch/arm64/kexec-arm64.h | 8 +- kexec/arch/arm64/kexec-image-arm64.c | 2 +- kexec/arch/arm64/kexec-vmlinuz-arm64.c | 110 kexec/arch/arm64/kexec-zImage-arm64.c | 226 - kexec/kexec-pe-zboot.c | 131 ++ kexec/kexec.c | 50 -- kexec/kexec.h | 1 + 13 files changed, 299 insertions(+), 251 deletions(-) create mode 100644 include/kexec-pe-zboot.h create mode 100644 kexec/arch/arm64/kexec-vmlinuz-arm64.c delete mode 100644 kexec/arch/arm64/kexec-zImage-arm64.c create mode 100644 kexec/kexec-pe-zboot.c -- 2.31.1 ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
[PATCHv7 1/5] kexec/arm64: Simplify the code for zImage
Inside zimage_probe(), it uncompresses the kernel and performs some
check, similar to image_probe(). Taking a close look, the uncompressing
has already executed before the image probe is called. What is missing
here is to provide a fd, pointing to an uncompressed kernel image.
This patch creates a memfd based on the result produced by
slurp_decompress_file(), and finally simplify the logical of the probe
for aarch64.
The credit goes to the Dave Young, who contributes the original code.
Signed-off-by: Pingfan Liu
Co-authored-by: Dave Young
To: kexec@lists.infradead.org
Cc: ho...@verge.net.au
Cc: a...@kernel.org
Cc: jeremy.lin...@arm.com
---
kexec/arch/arm64/Makefile | 3 +-
kexec/arch/arm64/kexec-arm64.c| 1 -
kexec/arch/arm64/kexec-arm64.h| 6 -
kexec/arch/arm64/kexec-image-arm64.c | 2 +-
kexec/arch/arm64/kexec-zImage-arm64.c | 226 --
kexec/kexec.c | 42 +++--
6 files changed, 26 insertions(+), 254 deletions(-)
delete mode 100644 kexec/arch/arm64/kexec-zImage-arm64.c
diff --git a/kexec/arch/arm64/Makefile b/kexec/arch/arm64/Makefile
index d27c8ee..9d9111c 100644
--- a/kexec/arch/arm64/Makefile
+++ b/kexec/arch/arm64/Makefile
@@ -15,8 +15,7 @@ arm64_KEXEC_SRCS += \
kexec/arch/arm64/kexec-arm64.c \
kexec/arch/arm64/kexec-elf-arm64.c \
kexec/arch/arm64/kexec-uImage-arm64.c \
- kexec/arch/arm64/kexec-image-arm64.c \
- kexec/arch/arm64/kexec-zImage-arm64.c
+ kexec/arch/arm64/kexec-image-arm64.c
arm64_UIMAGE = kexec/kexec-uImage.c
diff --git a/kexec/arch/arm64/kexec-arm64.c b/kexec/arch/arm64/kexec-arm64.c
index ec6df4b..a830ec7 100644
--- a/kexec/arch/arm64/kexec-arm64.c
+++ b/kexec/arch/arm64/kexec-arm64.c
@@ -74,7 +74,6 @@ struct file_type file_type[] = {
{"vmlinux", elf_arm64_probe, elf_arm64_load, elf_arm64_usage},
{"Image", image_arm64_probe, image_arm64_load, image_arm64_usage},
{"uImage", uImage_arm64_probe, uImage_arm64_load, uImage_arm64_usage},
- {"zImage", zImage_arm64_probe, zImage_arm64_load, zImage_arm64_usage},
};
int file_types = sizeof(file_type) / sizeof(file_type[0]);
diff --git a/kexec/arch/arm64/kexec-arm64.h b/kexec/arch/arm64/kexec-arm64.h
index 5eb9fc0..d29b1b3 100644
--- a/kexec/arch/arm64/kexec-arm64.h
+++ b/kexec/arch/arm64/kexec-arm64.h
@@ -44,12 +44,6 @@ int uImage_arm64_load(int argc, char **argv, const char
*buf, off_t len,
struct kexec_info *info);
void uImage_arm64_usage(void);
-int zImage_arm64_probe(const char *kernel_buf, off_t kernel_size);
-int zImage_arm64_load(int argc, char **argv, const char *kernel_buf,
- off_t kernel_size, struct kexec_info *info);
-void zImage_arm64_usage(void);
-
-
extern off_t initrd_base;
extern off_t initrd_size;
diff --git a/kexec/arch/arm64/kexec-image-arm64.c
b/kexec/arch/arm64/kexec-image-arm64.c
index aa8f2e2..a196747 100644
--- a/kexec/arch/arm64/kexec-image-arm64.c
+++ b/kexec/arch/arm64/kexec-image-arm64.c
@@ -114,6 +114,6 @@ exit:
void image_arm64_usage(void)
{
printf(
-" An ARM64 binary image, uncompressed, big or little endian.\n"
+" An ARM64 binary image, compressed or not, big or little endian.\n"
" Typically an Image file.\n\n");
}
diff --git a/kexec/arch/arm64/kexec-zImage-arm64.c
b/kexec/arch/arm64/kexec-zImage-arm64.c
deleted file mode 100644
index 6ee82ff..000
--- a/kexec/arch/arm64/kexec-zImage-arm64.c
+++ /dev/null
@@ -1,226 +0,0 @@
-/*
- * ARM64 kexec zImage (Image.gz) support.
- *
- * Several distros use 'make zinstall' rule inside
- * 'arch/arm64/boot/Makefile' to install the arm64
- * Image.gz compressed file inside the boot destination
- * directory (for e.g. /boot).
- *
- * Currently we cannot use kexec_file_load() to load vmlinuz
- * (or Image.gz).
- *
- * To support Image.gz, we should:
- * a). Copy the contents of Image.gz to a temporary file.
- * b). Decompress (gunzip-decompress) the contents inside the
- * temporary file.
- * c). Pass the 'fd' of the temporary file to the kernel space.
- *
- * So basically the kernel space still gets a decompressed
- * kernel image to load via kexec-tools.
- */
-
-#define _GNU_SOURCE
-
-#include
-#include
-#include
-#include
-#include "crashdump-arm64.h"
-#include "image-header.h"
-#include "kexec.h"
-#include "kexec-arm64.h"
-#include "kexec-syscall.h"
-#include "kexec-zlib.h"
-#include "arch/options.h"
-
-#define FILENAME_IMAGE "/tmp/ImageXX"
-
-/* Returns:
- * -1 : in case of error/invalid format (not a valid Image.gz format.
- * fd : File descriptor of the temp file containing the decompressed
- * Image.
- */
-int zImage_arm64_probe(const char *kernel_buf, off_t kernel_size)
-{
- int ret = -1;
- int fd = 0;
- int kernel_fd = 0;
- char *fname = NULL;
- char *kernel_uncompressed_buf = NULL;
- const struct arm64_image_header *h;
-
- if (!is_zlib_file(kernel_buf, _size)) {
-
[PATCHv7 4/5] arm64: Add ZBOOT PE containing compressed image support
From: Jeremy Linton
The kernel EFI stub ZBOOT feature creates a PE that
contains a compressed linux kernel image. The stub
when run in a valid UEFI environment then decompresses
the resulting image and executes it.
Support these image formats with kexec as well to avoid
having to keep an alternate kernel image around.
This patch adds a the _probe(), _load() and usage() routines needed for
kexec to understand this format.
Signed-off-by: Jeremy Linton
[Modified by Pingfan to export kernel fd with load method]
Signed-off-by: Pingfan Liu
To: kexec@lists.infradead.org
Cc: ho...@verge.net.au
Cc: a...@kernel.org
Cc: jeremy.lin...@arm.com
---
kexec/arch/arm64/image-header.h| 1 +
kexec/arch/arm64/kexec-vmlinuz-arm64.c | 110 +
2 files changed, 111 insertions(+)
create mode 100644 kexec/arch/arm64/kexec-vmlinuz-arm64.c
diff --git a/kexec/arch/arm64/image-header.h b/kexec/arch/arm64/image-header.h
index 158d411..26bb02f 100644
--- a/kexec/arch/arm64/image-header.h
+++ b/kexec/arch/arm64/image-header.h
@@ -37,6 +37,7 @@ struct arm64_image_header {
static const uint8_t arm64_image_magic[4] = {'A', 'R', 'M', 0x64U};
static const uint8_t arm64_image_pe_sig[2] = {'M', 'Z'};
+static const uint8_t arm64_pe_machtype[6] = {'P','E', 0x0, 0x0, 0x64, 0xAA};
static const uint64_t arm64_image_flag_be = (1UL << 0);
static const uint64_t arm64_image_flag_page_size = (3UL << 1);
static const uint64_t arm64_image_flag_placement = (1UL << 3);
diff --git a/kexec/arch/arm64/kexec-vmlinuz-arm64.c
b/kexec/arch/arm64/kexec-vmlinuz-arm64.c
new file mode 100644
index 000..c0ee47c
--- /dev/null
+++ b/kexec/arch/arm64/kexec-vmlinuz-arm64.c
@@ -0,0 +1,110 @@
+/*
+ * ARM64 PE compressed Image (vmlinuz, ZBOOT) support.
+ *
+ * Several distros use 'make zinstall' rule inside
+ * 'arch/arm64/boot/Makefile' to install the arm64
+ * ZBOOT compressed file inside the boot destination
+ * directory (for e.g. /boot).
+ *
+ * Currently we cannot use kexec_file_load() to load vmlinuz
+ * PE images that self decompress.
+ *
+ * To support ZBOOT, we should:
+ * a). Copy the compressed contents of vmlinuz to a temporary file.
+ * b). Decompress (gunzip-decompress) the contents inside the
+ * temporary file.
+ * c). Validate the resulting image and write it back to the
+ * temporary file.
+ * d). Pass the 'fd' of the temporary file to the kernel space.
+ *
+ * Note this, module doesn't provide a _load() function instead
+ * relying on image_arm64_load() to load the resulting decompressed
+ * image.
+ *
+ * So basically the kernel space still gets a decompressed
+ * kernel image to load via kexec-tools.
+ */
+
+#define _GNU_SOURCE
+#include
+#include
+#include
+#include "kexec-arm64.h"
+#include
+#include "arch/options.h"
+
+static int kernel_fd = -1;
+
+/* Returns:
+ * -1 : in case of error/invalid format (not a valid PE+compressed ZBOOT
format.
+ */
+int pez_arm64_probe(const char *kernel_buf, off_t kernel_size)
+{
+ int ret = -1;
+ const struct arm64_image_header *h;
+ char *buf;
+ off_t buf_sz;
+
+ buf = (char *)kernel_buf;
+ buf_sz = kernel_size;
+ if (!buf)
+ return -1;
+ h = (const struct arm64_image_header *)buf;
+
+ dbgprintf("%s: PROBE.\n", __func__);
+ if (buf_sz < sizeof(struct arm64_image_header)) {
+ dbgprintf("%s: Not large enough to be a PE image.\n", __func__);
+ return -1;
+ }
+ if (!arm64_header_check_pe_sig(h)) {
+ dbgprintf("%s: Not an PE image.\n", __func__);
+ return -1;
+ }
+
+ if (buf_sz < sizeof(struct arm64_image_header) + h->pe_header) {
+ dbgprintf("%s: PE image offset larger than image.\n", __func__);
+ return -1;
+ }
+
+ if (memcmp([h->pe_header],
+ arm64_pe_machtype, sizeof(arm64_pe_machtype))) {
+ dbgprintf("%s: PE header doesn't match machine type.\n",
__func__);
+ return -1;
+ }
+
+ ret = pez_prepare(buf, buf_sz, _fd);
+
+ if (!ret) {
+ /* validate the arm64 specific header */
+ struct arm64_image_header hdr_check;
+ if (read(kernel_fd, _check, sizeof(hdr_check)) !=
sizeof(hdr_check))
+ goto bad_header;
+
+ lseek(kernel_fd, 0, SEEK_SET);
+
+ if (!arm64_header_check_magic(_check)) {
+ dbgprintf("%s: Bad arm64 image header.\n", __func__);
+ goto bad_header;
+ }
+ }
+
+ return ret;
+bad_header:
+ close(kernel_fd);
+ free(buf);
+ return -1;
+}
+
+int pez_arm64_load(int argc, char **argv, const char *buf, off_t len,
+ struct kexec_info *info)
+{
+ info->kernel_fd = kernel_fd;
+ return image_arm64_load(argc, argv, buf, len, info);
+}
+
+void pez_arm64_usage(void)
+{
+ printf(
+" An ARM64 vmlinuz, PE image of a compressed, little
[PATCHv7 3/5] kexec/zboot: Add arch independent zboot support
From: Jeremy Linton
The linux kernel CONFIG_ZBOOT option creates
self decompressing PE kernel images. So this means
that kexec should have a generic understanding of
the format which may be used by multiple arches.
So lets add an arch independent validation
and decompression routine.
Signed-off-by: Jeremy Linton
[Modified by Pingfan to export kernel fd]
Signed-off-by: Pingfan Liu
To: kexec@lists.infradead.org
Cc: ho...@verge.net.au
Cc: a...@kernel.org
Cc: jeremy.lin...@arm.com
---
include/Makefile | 1 +
include/kexec-pe-zboot.h | 15 +
kexec/Makefile | 1 +
kexec/kexec-pe-zboot.c | 131 +++
4 files changed, 148 insertions(+)
create mode 100644 include/kexec-pe-zboot.h
create mode 100644 kexec/kexec-pe-zboot.c
diff --git a/include/Makefile b/include/Makefile
index 621ce9f..cd88a26 100644
--- a/include/Makefile
+++ b/include/Makefile
@@ -1,6 +1,7 @@
dist += include/Makefile \
include/config.h\
include/config.h.in \
+ include/kexec-pe-zboot.h\
include/kexec-uImage.h \
include/x86/x86-linux.h \
include/x86/mb_info.h \
diff --git a/include/kexec-pe-zboot.h b/include/kexec-pe-zboot.h
new file mode 100644
index 000..c588ca2
--- /dev/null
+++ b/include/kexec-pe-zboot.h
@@ -0,0 +1,15 @@
+#ifndef __KEXEC_PE_ZBOOT_H__
+#define __KEXEC_PE_ZBOOT_H__
+
+/* see drivers/firmware/efi/libstub/zboot-header.S */
+struct linux_pe_zboot_header {
+ uint32_t mz_magic;
+uint32_t image_type;
+uint32_t payload_offset;
+uint32_t payload_size;
+uint32_t reserved[2];
+uint32_t compress_type;
+};
+
+int pez_prepare(const char *crude_buf, off_t buf_sz, int *kernel_fd);
+#endif
diff --git a/kexec/Makefile b/kexec/Makefile
index 8a52e8d..11682bf 100644
--- a/kexec/Makefile
+++ b/kexec/Makefile
@@ -17,6 +17,7 @@ KEXEC_SRCS_base += kexec/kexec-elf-exec.c
KEXEC_SRCS_base += kexec/kexec-elf-core.c
KEXEC_SRCS_base += kexec/kexec-elf-rel.c
KEXEC_SRCS_base += kexec/kexec-elf-boot.c
+KEXEC_SRCS_base += kexec/kexec-pe-zboot.c
KEXEC_SRCS_base += kexec/kexec-iomem.c
KEXEC_SRCS_base += kexec/firmware_memmap.c
KEXEC_SRCS_base += kexec/crashdump.c
diff --git a/kexec/kexec-pe-zboot.c b/kexec/kexec-pe-zboot.c
new file mode 100644
index 000..2f2e052
--- /dev/null
+++ b/kexec/kexec-pe-zboot.c
@@ -0,0 +1,131 @@
+/*
+ * Generic PE compressed Image (vmlinuz, ZBOOT) support.
+ *
+ * Several distros use 'make zinstall' with CONFIG_ZBOOT
+ * enabled to create UEFI PE images that contain
+ * a decompressor and a compressed kernel image.
+ *
+ * Currently we cannot use kexec_file_load() to load vmlinuz
+ * PE images that self decompress.
+ *
+ * To support ZBOOT, we should:
+ * a). Copy the compressed contents of vmlinuz to a temporary file.
+ * b). Decompress (gunzip-decompress) the contents inside the
+ * temporary file.
+ * c). Validate the resulting image and write it back to the
+ * temporary file.
+ * d). Pass the 'fd' of the temporary file to the kernel space.
+ *
+ * This module contains the arch independent code for the above,
+ * arch specific PE and image checks should wrap calls
+ * to functions in this module.
+ */
+
+#define _GNU_SOURCE
+#include
+#include
+#include
+#include
+#include
+#include "kexec.h"
+#include
+
+#define FILENAME_IMAGE "/tmp/ImageXX"
+
+/*
+ * Returns -1 : in case of error/invalid format (not a valid PE+compressed
ZBOOT format.
+ *
+ * crude_buf: the content, which is read from the kernel file without any
processing
+ */
+int pez_prepare(const char *crude_buf, off_t buf_sz, int *kernel_fd)
+{
+ int ret = -1;
+ int fd = 0;
+ char *fname = NULL;
+ char *kernel_uncompressed_buf = NULL;
+ off_t decompressed_size = 0;
+ const struct linux_pe_zboot_header *z;
+
+ z = (const struct linux_pe_zboot_header *)(crude_buf);
+
+ if (memcmp(>image_type, "zimg", sizeof(z->image_type))) {
+ dbgprintf("%s: PE doesn't contain a compressed kernel.\n",
__func__);
+ return -1;
+ }
+
+ /*
+* At the moment its possible to create images with more compression
+* algorithms than are supported here, error out if we detect that.
+*/
+ if (memcmp(>compress_type, "gzip", 4) &&
+ memcmp(>compress_type, "lzma", 4)) {
+ dbgprintf("%s: kexec can only decompress gziped and lzma
images.\n", __func__);
+ return -1;
+ }
+
+ if (buf_sz < z->payload_offset + z->payload_size) {
+ dbgprintf("%s: PE too small to contain complete payload.\n",
__func__);
+ return -1;
+ }
+
+ if (!(fname = strdup(FILENAME_IMAGE))) {
+ dbgprintf("%s: Can't duplicate strings\n", __func__);
+ return -1;
+ }
+
+ if ((fd = mkstemp(fname)) < 0) {
+
[PATCHv7 2/5] kexec: Introduce a member kernel_fd in kexec_info
Utilize the image load interface to export the kernel fd, which points
to the uncompressed kernel and will be passed to kexec_file_load.
The credit goes to the Dave Young, who contributes the original code.
Signed-off-by: Pingfan Liu
Co-authored-by: Dave Young
To: kexec@lists.infradead.org
Cc: ho...@verge.net.au
Cc: a...@kernel.org
Cc: jeremy.lin...@arm.com
---
kexec/kexec.c | 8
kexec/kexec.h | 1 +
2 files changed, 9 insertions(+)
diff --git a/kexec/kexec.c b/kexec/kexec.c
index d132eb5..c3b182e 100644
--- a/kexec/kexec.c
+++ b/kexec/kexec.c
@@ -1292,6 +1292,7 @@ static int do_kexec_file_load(int fileind, int argc, char
**argv,
info.kexec_flags = flags;
info.file_mode = 1;
+ info.kernel_fd = -1;
info.initrd_fd = -1;
if (!is_kexec_file_load_implemented())
@@ -1337,6 +1338,13 @@ static int do_kexec_file_load(int fileind, int argc,
char **argv,
return ret;
}
+ /*
+ * image type specific load functioin detect the capsule kernel type
+ * and create another fd for file load. For example the zboot kernel.
+ */
+ if (info.kernel_fd != -1)
+ kernel_fd = info.kernel_fd;
+
/*
* If there is no initramfs, set KEXEC_FILE_NO_INITRAMFS flag so that
* kernel does not return error with negative initrd_fd.
diff --git a/kexec/kexec.h b/kexec/kexec.h
index 0d820ad..ed3b499 100644
--- a/kexec/kexec.h
+++ b/kexec/kexec.h
@@ -164,6 +164,7 @@ struct kexec_info {
unsigned long file_mode :1;
/* Filled by kernel image processing code */
+ int kernel_fd;
int initrd_fd;
char *command_line;
int command_line_len;
--
2.31.1
___
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCHv6 3/5] kexec/zboot: Add arch independent zboot support
On Wed, Aug 2, 2023 at 8:33 PM Simon Horman wrote: > > On Wed, Aug 02, 2023 at 02:17:57PM +0200, Simon Horman wrote: > > On Wed, Aug 02, 2023 at 02:16:33PM +0200, Simon Horman wrote: > > > On Wed, Aug 02, 2023 at 05:53:59PM +0800, Pingfan Liu wrote: > > > > Hi Simon, > > > > > > > > Thanks for the try. Please see the comment below. > > > > > > > > On Tue, Aug 1, 2023 at 3:00 PM Simon Horman wrote: > > > > > > > > > > On Mon, Jul 24, 2023 at 10:21:40AM +0800, Pingfan Liu wrote: > > > > > > From: Jeremy Linton > > > > > > > > > > > > The linux kernel CONFIG_ZBOOT option creates > > > > > > self decompressing PE kernel images. So this means > > > > > > that kexec should have a generic understanding of > > > > > > the format which may be used by multiple arches. > > > > > > > > > > > > So lets add an arch independent validation > > > > > > and decompression routine. > > > > > > > > > > > > Signed-off-by: Jeremy Linton > > > > > > [Modified by Pingfan to export kernel fd] > > > > > > Signed-off-by: Pingfan Liu > > > > > > > > > > Hi Pingfan, > > > > > > > > > > unfortunately this causes a build failure on hppa. > > > > > > > > > > ../../kexec/kexec-pe-zboot.c:31:10: fatal error: kexec-pe-zboot.h: No > > > > > such file or directory > > > > >31 | #include > > > > > | ^~ > > > > > > > > > > Link: > > > > > https://github.com/horms/kexec-tools/actions/runs/5723580523/job/15508425790 > > > > > > > > > > > > > It is not related to cross-compiling. Actually, I have tried to > > > > simplify the test matrix, which limits the compilation only on x86_64. > > > > And I got the similar error [1] > > > > > > > > The workflow control file is [2], which clips out all arches except > > > > x86_64. But I can successfully build it on the Fedora system with the > > > > following bash script, which is based on the github's build log. So > > > > maybe it is a bug with the compiling tools? > > > > > > > > kexec_tools_dir="./" > > > > > > > > mkdir $kexec_tools_dir/_build \ > > > > $kexec_tools_dir/_build/sub \ > > > > $kexec_tools_dir/_inst \ > > > > $kexec_tools_dir/_dest > > > > chmod a-w $kexec_tools_dir > > > > test -d $kexec_tools_dir/_build > > > > INSTALL_BASE=$(cd $kexec_tools_dir/_inst && pwd | sed -e > > > > 's,^[^:\\/]:[\\/],/,') &&\ > > > > DESTDIR="$kexec_tools_dir/_dest" && \ > > > > cd $kexec_tools_dir/_build/sub && \ > > > > ../../configure \ > > > > \ > > > > --srcdir=../.. --prefix="$INSTALL_BASE" && \ > > > > make -j8 > > > > > > > > > > > > [1]: > > > > https://github.com/pfliu/kexec-tools/actions/runs/5737254109/job/15548520863 > > > > [2]: > > > > https://github.com/pfliu/kexec-tools/blob/zbootV6/.github/workflows/main.yml > > > > > > Thanks, > > > > > > I guess that kexec-pe-zboot.h is missing in the build environment for the > > > GitHub actions, but present in your Fedora environment. > > > > > > Could you take a look and see where your copy of kexec-pe-zboot.h > > > came from? > > > > Actually it seems to be added by this patch (sorry for not noticing)! > > So I guess it is an include path problem. > > I think I have found the problem. > The kexec-tools build system is a bit unusual, > and the new file, kexec-pe-zboot.h, was not included in distribution > tarballs. Thus the build failures. > Unexpectedly, and thank for your insight. > I think you can resolve that by squashing the following into this patch. > > diff --git a/include/Makefile b/include/Makefile > --- a/include/Makefile > +++ b/include/Makefile > @@ -1,6 +1,7 @@ > dist += include/Makefile \ > include/config.h\ > include/config.h.in \ > + include/kexec-pe-zboot.h\ > include/kexec-uImage.h \ > include/x86/x86-linux.h \ > include/x86/mb_info.h \ > After applying this patch, the github workflow successfully finished. I will send out V7 immediately. Appreciate for your kind help again. Thanks, Pingfan ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH 1/6] tpm: implement TPM2 function to get update counter
On Wed, 2023-08-02 at 06:58 +0300, Jarkko Sakkinen wrote: > > From long description I see zero motivation to ack this change, except > some heresay about IMA requiring it. Why does IMA need update_cnt and > why this is not documented to the long description? The motivation is to detect whether the IMA measurement list has been truncated, for whatever reason. A new IMA record should be defined containing the "pcrCounter" value. (I have not had a chance to review this patch set.) This new record would be a pre-req for both Tushar's "ima: measure events between kexec load and execute" patch set and Sush's proposal to trim the measurement list. (I haven't looked at it yet either.) -- thanks, Mimi ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH 1/6] tpm: implement TPM2 function to get update counter
On 8/1/23 20:58, Jarkko Sakkinen wrote: On Wed Aug 2, 2023 at 12:01 AM EEST, Tushar Sugandhi wrote: Thanks for the response Jarkko. On 8/1/23 12:02, Jarkko Sakkinen wrote: The short summary is cryptic to say the least. Do you mean the patch subject line, or the description below? It is in the process documentation: https://www.kernel.org/doc/html/v6.3/process/submitting-patches.html#the-canonical-patch-format Sounds good. I will cleanup both the summary phrase and the patch description. "update counter" does not map it to have anything to do with PCRs. Agreed. I noticed that when I was testing the patches. The update counter is same for all PCRs. It was also the same for the two hash algo's I tested it for (SHA1 and SHA256). But the spec description and Kernel implementation requires to pass the pcr_idx and hash algo to PCR_Read command to get the update counter. I was referring to the fact that TPM2_PCR_Read does not have a field called "update counter" in its response but it has a field called "pcrUpdateCounter". Please refer to thigs that actually exist. In the long description you are in some occasions referring to the same object as: 1. "update counter" 2. "pcrUpdateCounter" 3. "PcrUpdateCounter" This is ambiguous and wrong. Thanks. I will consistently use pcrUpdateCounter going forward. >From long description I see zero motivation to ack this change, except some heresay about IMA requiring it. Why does IMA need update_cnt and why this is not documented to the long description? Since patch 2 of this series exposes the functionality to IMA, it is described in the long description of patch 2. But I can add the description here as well for completeness. But I can update tpm2_pcr_read() if you are ok with it. Please let me know. You can add "u32 *update_cnt". Sounds good. Will do. Btw, the function tpm2_pcr_read is not exposed directly to the other subsystems (like IMA). It is exposed via tpm_pcr_read. Do you want to expose tpm2_pcr_read directly, or do you want me to update the function signature of tpm_pcr_read as well? Updating the function signature of tpm_pcr_read as well - to return "u32 *update_cnt" seems like the right approach. In that case, I can set *update_cnt to say 0 or -1 for TPM1 (because pcrUpdateCounter is not available for TPM1). Please let me know what do you think. I will make the changes accordingly. I will also wait for IMA/Kexec maintainers to take a look at the remaining patches in this series, incorporate their feedback, and send the V2 of this series. Thanks again for your feedback. Really appreciate it. ~Tushar BR, Jarkko ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH v2] x86/kexec: Add EFI config table identity mapping for kexec kernel
On Wed, Aug 02, 2023 at 04:55:27PM +0200, Ard Biesheuvel wrote: > ... because now, entering via startup_32 is broken, given that it only > maps the kernel image itself and relies on the #PF handling for > everything else it accesses, including firmware tables. > > AFAICT this also means that entering via startup_32 is broken entirely > for any configuration that enables the cc blob config table check, > regardless of the platform. Lemme brain-dump what Tom and I just talked on IRC. That startup_32 entry path for SNP guests was used with old grubs which used to enter through there and not anymore, reportedly. Which means, that must've worked at some point but Joerg would know. CCed. Newer grubs enter through the 64-bit entry point and thus are fine - otherwise we would be seeing explosions left and right. So dependent on what we wanna do, if we kill the 32-bit path, we can kill the 32-bit C-bit verif code. But that's for later and an item on my TODO list. Thx. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH v2] x86/kexec: Add EFI config table identity mapping for kexec kernel
On Wed, 2 Aug 2023 at 15:59, Borislav Petkov wrote: > > On Wed, Aug 02, 2023 at 08:40:36AM -0500, Tom Lendacky wrote: > > Short of figuring out how to map page accesses earlier through the > > boot_page_fault IDT routine > > And you want to do that because? > ... because now, entering via startup_32 is broken, given that it only maps the kernel image itself and relies on the #PF handling for everything else it accesses, including firmware tables. AFAICT this also means that entering via startup_32 is broken entirely for any configuration that enables the cc blob config table check, regardless of the platform. ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH v2] x86/kexec: Add EFI config table identity mapping for kexec kernel
On Wed, Aug 02, 2023 at 08:40:36AM -0500, Tom Lendacky wrote: > Short of figuring out how to map page accesses earlier through the > boot_page_fault IDT routine And you want to do that because? -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH v2] x86/kexec: Add EFI config table identity mapping for kexec kernel
On 8/2/23 04:39, Borislav Petkov wrote:
On Wed, Aug 02, 2023 at 04:22:54PM +0800, Tao Liu wrote:
Thanks for the patch! I have tested it on the lenovo machine in the
past few days, no issue found, so the patch tests OK.
Thanks for testing!
Mike, Tom, the below ok this way?
Short of figuring out how to map page accesses earlier through the
boot_page_fault IDT routine, this seems reasonable.
Acked-by: Tom Lendacky
---
From: "Borislav Petkov (AMD)"
Date: Sun, 16 Jul 2023 20:22:20 +0200
Subject: [PATCH] x86/sev: Do not try to parse for the CC blob on non-AMD
hardware
Tao Liu reported a boot hang on an Intel Atom machine due to an unmapped
EFI config table. The reason being that the CC blob which contains the
CPUID page for AMD SNP guests is parsed for before even checking
whether the machine runs on AMD hardware.
Usually that's not a problem on !AMD hw - it simply won't find the CC
blob's GUID and return. However, if any parts of the config table
pointers array is not mapped, the kernel will #PF very early in the
decompressor stage without any opportunity to recover.
Therefore, do a superficial CPUID check before poking for the CC blob.
This will fix the current issue on real hardware. It would also work as
a guest on a non-lying hypervisor.
For the lying hypervisor, the check is done again, *after* parsing the
CC blob as the real CPUID page will be present then.
Clear the #VC handler in case SEV-{ES,SNP} hasn't been detected, as
a precaution.
Fixes: c01fce9cef84 ("x86/compressed: Add SEV-SNP feature detection/setup")
Reported-by: Tao Liu
Signed-off-by: Borislav Petkov (AMD)
Tested-by: Tao Liu
Cc:
Link: https://lore.kernel.org/r/20230601072043.24439-1-l...@redhat.com
---
arch/x86/boot/compressed/idt_64.c | 9 +++-
arch/x86/boot/compressed/sev.c| 37 +--
2 files changed, 43 insertions(+), 3 deletions(-)
diff --git a/arch/x86/boot/compressed/idt_64.c
b/arch/x86/boot/compressed/idt_64.c
index 6debb816e83d..3cdf94b41456 100644
--- a/arch/x86/boot/compressed/idt_64.c
+++ b/arch/x86/boot/compressed/idt_64.c
@@ -63,7 +63,14 @@ void load_stage2_idt(void)
set_idt_entry(X86_TRAP_PF, boot_page_fault);
#ifdef CONFIG_AMD_MEM_ENCRYPT
- set_idt_entry(X86_TRAP_VC, boot_stage2_vc);
+ /*
+* Clear the second stage #VC handler in case guest types
+* needing #VC have not been detected.
+*/
+ if (sev_status & BIT(1))
+ set_idt_entry(X86_TRAP_VC, boot_stage2_vc);
+ else
+ set_idt_entry(X86_TRAP_VC, NULL);
#endif
load_boot_idt(_idt_desc);
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
index 09dc8c187b3c..c3e343bd4760 100644
--- a/arch/x86/boot/compressed/sev.c
+++ b/arch/x86/boot/compressed/sev.c
@@ -404,13 +404,46 @@ void sev_enable(struct boot_params *bp)
if (bp)
bp->cc_blob_address = 0;
+ /*
+* Do an initial SEV capability check before snp_init() which
+* loads the CPUID page and the same checks afterwards are done
+* without the hypervisor and are trustworthy.
+*
+* If the HV fakes SEV support, the guest will crash'n'burn
+* which is good enough.
+*/
+
+ /* Check for the SME/SEV support leaf */
+ eax = 0x8000;
+ ecx = 0;
+ native_cpuid(, , , );
+ if (eax < 0x801f)
+ return;
+
+ /*
+* Check for the SME/SEV feature:
+* CPUID Fn8000_001F[EAX]
+* - Bit 0 - Secure Memory Encryption support
+* - Bit 1 - Secure Encrypted Virtualization support
+* CPUID Fn8000_001F[EBX]
+* - Bits 5:0 - Pagetable bit position used to indicate encryption
+*/
+ eax = 0x801f;
+ ecx = 0;
+ native_cpuid(, , , );
+ /* Check whether SEV is supported */
+ if (!(eax & BIT(1)))
+ return;
+
/*
* Setup/preliminary detection of SNP. This will be sanity-checked
* against CPUID/MSR values later.
*/
snp = snp_init(bp);
- /* Check for the SME/SEV support leaf */
+ /* Now repeat the checks with the SNP CPUID table. */
+
+ /* Recheck the SME/SEV support leaf */
eax = 0x8000;
ecx = 0;
native_cpuid(, , , );
@@ -418,7 +451,7 @@ void sev_enable(struct boot_params *bp)
return;
/*
-* Check for the SME/SEV feature:
+* Recheck for the SME/SEV feature:
* CPUID Fn8000_001F[EAX]
* - Bit 0 - Secure Memory Encryption support
* - Bit 1 - Secure Encrypted Virtualization support
___
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCHv6 3/5] kexec/zboot: Add arch independent zboot support
On Wed, Aug 02, 2023 at 02:17:57PM +0200, Simon Horman wrote: > On Wed, Aug 02, 2023 at 02:16:33PM +0200, Simon Horman wrote: > > On Wed, Aug 02, 2023 at 05:53:59PM +0800, Pingfan Liu wrote: > > > Hi Simon, > > > > > > Thanks for the try. Please see the comment below. > > > > > > On Tue, Aug 1, 2023 at 3:00 PM Simon Horman wrote: > > > > > > > > On Mon, Jul 24, 2023 at 10:21:40AM +0800, Pingfan Liu wrote: > > > > > From: Jeremy Linton > > > > > > > > > > The linux kernel CONFIG_ZBOOT option creates > > > > > self decompressing PE kernel images. So this means > > > > > that kexec should have a generic understanding of > > > > > the format which may be used by multiple arches. > > > > > > > > > > So lets add an arch independent validation > > > > > and decompression routine. > > > > > > > > > > Signed-off-by: Jeremy Linton > > > > > [Modified by Pingfan to export kernel fd] > > > > > Signed-off-by: Pingfan Liu > > > > > > > > Hi Pingfan, > > > > > > > > unfortunately this causes a build failure on hppa. > > > > > > > > ../../kexec/kexec-pe-zboot.c:31:10: fatal error: kexec-pe-zboot.h: No > > > > such file or directory > > > >31 | #include > > > > | ^~ > > > > > > > > Link: > > > > https://github.com/horms/kexec-tools/actions/runs/5723580523/job/15508425790 > > > > > > > > > > It is not related to cross-compiling. Actually, I have tried to > > > simplify the test matrix, which limits the compilation only on x86_64. > > > And I got the similar error [1] > > > > > > The workflow control file is [2], which clips out all arches except > > > x86_64. But I can successfully build it on the Fedora system with the > > > following bash script, which is based on the github's build log. So > > > maybe it is a bug with the compiling tools? > > > > > > kexec_tools_dir="./" > > > > > > mkdir $kexec_tools_dir/_build \ > > > $kexec_tools_dir/_build/sub \ > > > $kexec_tools_dir/_inst \ > > > $kexec_tools_dir/_dest > > > chmod a-w $kexec_tools_dir > > > test -d $kexec_tools_dir/_build > > > INSTALL_BASE=$(cd $kexec_tools_dir/_inst && pwd | sed -e > > > 's,^[^:\\/]:[\\/],/,') &&\ > > > DESTDIR="$kexec_tools_dir/_dest" && \ > > > cd $kexec_tools_dir/_build/sub && \ > > > ../../configure \ > > > \ > > > --srcdir=../.. --prefix="$INSTALL_BASE" && \ > > > make -j8 > > > > > > > > > [1]: > > > https://github.com/pfliu/kexec-tools/actions/runs/5737254109/job/15548520863 > > > [2]: > > > https://github.com/pfliu/kexec-tools/blob/zbootV6/.github/workflows/main.yml > > > > Thanks, > > > > I guess that kexec-pe-zboot.h is missing in the build environment for the > > GitHub actions, but present in your Fedora environment. > > > > Could you take a look and see where your copy of kexec-pe-zboot.h > > came from? > > Actually it seems to be added by this patch (sorry for not noticing)! > So I guess it is an include path problem. I think I have found the problem. The kexec-tools build system is a bit unusual, and the new file, kexec-pe-zboot.h, was not included in distribution tarballs. Thus the build failures. I think you can resolve that by squashing the following into this patch. diff --git a/include/Makefile b/include/Makefile --- a/include/Makefile +++ b/include/Makefile @@ -1,6 +1,7 @@ dist += include/Makefile \ include/config.h\ include/config.h.in \ + include/kexec-pe-zboot.h\ include/kexec-uImage.h \ include/x86/x86-linux.h \ include/x86/mb_info.h \ ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCHv6 3/5] kexec/zboot: Add arch independent zboot support
On Wed, Aug 02, 2023 at 02:16:33PM +0200, Simon Horman wrote: > On Wed, Aug 02, 2023 at 05:53:59PM +0800, Pingfan Liu wrote: > > Hi Simon, > > > > Thanks for the try. Please see the comment below. > > > > On Tue, Aug 1, 2023 at 3:00 PM Simon Horman wrote: > > > > > > On Mon, Jul 24, 2023 at 10:21:40AM +0800, Pingfan Liu wrote: > > > > From: Jeremy Linton > > > > > > > > The linux kernel CONFIG_ZBOOT option creates > > > > self decompressing PE kernel images. So this means > > > > that kexec should have a generic understanding of > > > > the format which may be used by multiple arches. > > > > > > > > So lets add an arch independent validation > > > > and decompression routine. > > > > > > > > Signed-off-by: Jeremy Linton > > > > [Modified by Pingfan to export kernel fd] > > > > Signed-off-by: Pingfan Liu > > > > > > Hi Pingfan, > > > > > > unfortunately this causes a build failure on hppa. > > > > > > ../../kexec/kexec-pe-zboot.c:31:10: fatal error: kexec-pe-zboot.h: No > > > such file or directory > > >31 | #include > > > | ^~ > > > > > > Link: > > > https://github.com/horms/kexec-tools/actions/runs/5723580523/job/15508425790 > > > > > > > It is not related to cross-compiling. Actually, I have tried to > > simplify the test matrix, which limits the compilation only on x86_64. > > And I got the similar error [1] > > > > The workflow control file is [2], which clips out all arches except > > x86_64. But I can successfully build it on the Fedora system with the > > following bash script, which is based on the github's build log. So > > maybe it is a bug with the compiling tools? > > > > kexec_tools_dir="./" > > > > mkdir $kexec_tools_dir/_build \ > > $kexec_tools_dir/_build/sub \ > > $kexec_tools_dir/_inst \ > > $kexec_tools_dir/_dest > > chmod a-w $kexec_tools_dir > > test -d $kexec_tools_dir/_build > > INSTALL_BASE=$(cd $kexec_tools_dir/_inst && pwd | sed -e > > 's,^[^:\\/]:[\\/],/,') &&\ > > DESTDIR="$kexec_tools_dir/_dest" && \ > > cd $kexec_tools_dir/_build/sub && \ > > ../../configure \ > > \ > > --srcdir=../.. --prefix="$INSTALL_BASE" && \ > > make -j8 > > > > > > [1]: > > https://github.com/pfliu/kexec-tools/actions/runs/5737254109/job/15548520863 > > [2]: > > https://github.com/pfliu/kexec-tools/blob/zbootV6/.github/workflows/main.yml > > Thanks, > > I guess that kexec-pe-zboot.h is missing in the build environment for the > GitHub actions, but present in your Fedora environment. > > Could you take a look and see where your copy of kexec-pe-zboot.h > came from? Actually it seems to be added by this patch (sorry for not noticing)! So I guess it is an include path problem. ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCHv6 3/5] kexec/zboot: Add arch independent zboot support
On Wed, Aug 02, 2023 at 05:53:59PM +0800, Pingfan Liu wrote: > Hi Simon, > > Thanks for the try. Please see the comment below. > > On Tue, Aug 1, 2023 at 3:00 PM Simon Horman wrote: > > > > On Mon, Jul 24, 2023 at 10:21:40AM +0800, Pingfan Liu wrote: > > > From: Jeremy Linton > > > > > > The linux kernel CONFIG_ZBOOT option creates > > > self decompressing PE kernel images. So this means > > > that kexec should have a generic understanding of > > > the format which may be used by multiple arches. > > > > > > So lets add an arch independent validation > > > and decompression routine. > > > > > > Signed-off-by: Jeremy Linton > > > [Modified by Pingfan to export kernel fd] > > > Signed-off-by: Pingfan Liu > > > > Hi Pingfan, > > > > unfortunately this causes a build failure on hppa. > > > > ../../kexec/kexec-pe-zboot.c:31:10: fatal error: kexec-pe-zboot.h: No such > > file or directory > >31 | #include > > | ^~ > > > > Link: > > https://github.com/horms/kexec-tools/actions/runs/5723580523/job/15508425790 > > > > It is not related to cross-compiling. Actually, I have tried to > simplify the test matrix, which limits the compilation only on x86_64. > And I got the similar error [1] > > The workflow control file is [2], which clips out all arches except > x86_64. But I can successfully build it on the Fedora system with the > following bash script, which is based on the github's build log. So > maybe it is a bug with the compiling tools? > > kexec_tools_dir="./" > > mkdir $kexec_tools_dir/_build \ > $kexec_tools_dir/_build/sub \ > $kexec_tools_dir/_inst \ > $kexec_tools_dir/_dest > chmod a-w $kexec_tools_dir > test -d $kexec_tools_dir/_build > INSTALL_BASE=$(cd $kexec_tools_dir/_inst && pwd | sed -e > 's,^[^:\\/]:[\\/],/,') &&\ > DESTDIR="$kexec_tools_dir/_dest" && \ > cd $kexec_tools_dir/_build/sub && \ > ../../configure \ > \ > --srcdir=../.. --prefix="$INSTALL_BASE" && \ > make -j8 > > > [1]: > https://github.com/pfliu/kexec-tools/actions/runs/5737254109/job/15548520863 > [2]: > https://github.com/pfliu/kexec-tools/blob/zbootV6/.github/workflows/main.yml Thanks, I guess that kexec-pe-zboot.h is missing in the build environment for the GitHub actions, but present in your Fedora environment. Could you take a look and see where your copy of kexec-pe-zboot.h came from? ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCHv6 3/5] kexec/zboot: Add arch independent zboot support
Hi Simon, Thanks for the try. Please see the comment below. On Tue, Aug 1, 2023 at 3:00 PM Simon Horman wrote: > > On Mon, Jul 24, 2023 at 10:21:40AM +0800, Pingfan Liu wrote: > > From: Jeremy Linton > > > > The linux kernel CONFIG_ZBOOT option creates > > self decompressing PE kernel images. So this means > > that kexec should have a generic understanding of > > the format which may be used by multiple arches. > > > > So lets add an arch independent validation > > and decompression routine. > > > > Signed-off-by: Jeremy Linton > > [Modified by Pingfan to export kernel fd] > > Signed-off-by: Pingfan Liu > > Hi Pingfan, > > unfortunately this causes a build failure on hppa. > > ../../kexec/kexec-pe-zboot.c:31:10: fatal error: kexec-pe-zboot.h: No such > file or directory >31 | #include > | ^~ > > Link: > https://github.com/horms/kexec-tools/actions/runs/5723580523/job/15508425790 > It is not related to cross-compiling. Actually, I have tried to simplify the test matrix, which limits the compilation only on x86_64. And I got the similar error [1] The workflow control file is [2], which clips out all arches except x86_64. But I can successfully build it on the Fedora system with the following bash script, which is based on the github's build log. So maybe it is a bug with the compiling tools? kexec_tools_dir="./" mkdir $kexec_tools_dir/_build \ $kexec_tools_dir/_build/sub \ $kexec_tools_dir/_inst \ $kexec_tools_dir/_dest chmod a-w $kexec_tools_dir test -d $kexec_tools_dir/_build INSTALL_BASE=$(cd $kexec_tools_dir/_inst && pwd | sed -e 's,^[^:\\/]:[\\/],/,') &&\ DESTDIR="$kexec_tools_dir/_dest" && \ cd $kexec_tools_dir/_build/sub && \ ../../configure \ \ --srcdir=../.. --prefix="$INSTALL_BASE" && \ make -j8 [1]: https://github.com/pfliu/kexec-tools/actions/runs/5737254109/job/15548520863 [2]: https://github.com/pfliu/kexec-tools/blob/zbootV6/.github/workflows/main.yml Thanks, Pingfan ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH v2] x86/kexec: Add EFI config table identity mapping for kexec kernel
On Wed, Aug 02, 2023 at 04:22:54PM +0800, Tao Liu wrote:
> Thanks for the patch! I have tested it on the lenovo machine in the
> past few days, no issue found, so the patch tests OK.
Thanks for testing!
Mike, Tom, the below ok this way?
---
From: "Borislav Petkov (AMD)"
Date: Sun, 16 Jul 2023 20:22:20 +0200
Subject: [PATCH] x86/sev: Do not try to parse for the CC blob on non-AMD
hardware
Tao Liu reported a boot hang on an Intel Atom machine due to an unmapped
EFI config table. The reason being that the CC blob which contains the
CPUID page for AMD SNP guests is parsed for before even checking
whether the machine runs on AMD hardware.
Usually that's not a problem on !AMD hw - it simply won't find the CC
blob's GUID and return. However, if any parts of the config table
pointers array is not mapped, the kernel will #PF very early in the
decompressor stage without any opportunity to recover.
Therefore, do a superficial CPUID check before poking for the CC blob.
This will fix the current issue on real hardware. It would also work as
a guest on a non-lying hypervisor.
For the lying hypervisor, the check is done again, *after* parsing the
CC blob as the real CPUID page will be present then.
Clear the #VC handler in case SEV-{ES,SNP} hasn't been detected, as
a precaution.
Fixes: c01fce9cef84 ("x86/compressed: Add SEV-SNP feature detection/setup")
Reported-by: Tao Liu
Signed-off-by: Borislav Petkov (AMD)
Tested-by: Tao Liu
Cc:
Link: https://lore.kernel.org/r/20230601072043.24439-1-l...@redhat.com
---
arch/x86/boot/compressed/idt_64.c | 9 +++-
arch/x86/boot/compressed/sev.c| 37 +--
2 files changed, 43 insertions(+), 3 deletions(-)
diff --git a/arch/x86/boot/compressed/idt_64.c
b/arch/x86/boot/compressed/idt_64.c
index 6debb816e83d..3cdf94b41456 100644
--- a/arch/x86/boot/compressed/idt_64.c
+++ b/arch/x86/boot/compressed/idt_64.c
@@ -63,7 +63,14 @@ void load_stage2_idt(void)
set_idt_entry(X86_TRAP_PF, boot_page_fault);
#ifdef CONFIG_AMD_MEM_ENCRYPT
- set_idt_entry(X86_TRAP_VC, boot_stage2_vc);
+ /*
+* Clear the second stage #VC handler in case guest types
+* needing #VC have not been detected.
+*/
+ if (sev_status & BIT(1))
+ set_idt_entry(X86_TRAP_VC, boot_stage2_vc);
+ else
+ set_idt_entry(X86_TRAP_VC, NULL);
#endif
load_boot_idt(_idt_desc);
diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c
index 09dc8c187b3c..c3e343bd4760 100644
--- a/arch/x86/boot/compressed/sev.c
+++ b/arch/x86/boot/compressed/sev.c
@@ -404,13 +404,46 @@ void sev_enable(struct boot_params *bp)
if (bp)
bp->cc_blob_address = 0;
+ /*
+* Do an initial SEV capability check before snp_init() which
+* loads the CPUID page and the same checks afterwards are done
+* without the hypervisor and are trustworthy.
+*
+* If the HV fakes SEV support, the guest will crash'n'burn
+* which is good enough.
+*/
+
+ /* Check for the SME/SEV support leaf */
+ eax = 0x8000;
+ ecx = 0;
+ native_cpuid(, , , );
+ if (eax < 0x801f)
+ return;
+
+ /*
+* Check for the SME/SEV feature:
+* CPUID Fn8000_001F[EAX]
+* - Bit 0 - Secure Memory Encryption support
+* - Bit 1 - Secure Encrypted Virtualization support
+* CPUID Fn8000_001F[EBX]
+* - Bits 5:0 - Pagetable bit position used to indicate encryption
+*/
+ eax = 0x801f;
+ ecx = 0;
+ native_cpuid(, , , );
+ /* Check whether SEV is supported */
+ if (!(eax & BIT(1)))
+ return;
+
/*
* Setup/preliminary detection of SNP. This will be sanity-checked
* against CPUID/MSR values later.
*/
snp = snp_init(bp);
- /* Check for the SME/SEV support leaf */
+ /* Now repeat the checks with the SNP CPUID table. */
+
+ /* Recheck the SME/SEV support leaf */
eax = 0x8000;
ecx = 0;
native_cpuid(, , , );
@@ -418,7 +451,7 @@ void sev_enable(struct boot_params *bp)
return;
/*
-* Check for the SME/SEV feature:
+* Recheck for the SME/SEV feature:
* CPUID Fn8000_001F[EAX]
* - Bit 0 - Secure Memory Encryption support
* - Bit 1 - Secure Encrypted Virtualization support
--
2.41.0
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
___
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
Re: [PATCH v2] x86/kexec: Add EFI config table identity mapping for kexec kernel
Hi Borislav, On Sat, Jul 29, 2023 at 12:56 AM Borislav Petkov wrote: > > On Thu, Jul 27, 2023 at 07:03:26PM +0800, Tao Liu wrote: > > Hi Borislav, > > > > Sorry for the late response. I spent some time retesting your patch > > against 6.5.0-rc1 and 6.5.0-rc3, and it is OK. So > > > > Reported-and-tested-by: Tao Liu > > > > And will we use this patch as a workaround or will we wait for a > > better solution as proposed by Michael? > > First of all, please do not top-post. > OK, thanks for the reminder. > And yes, here's a better one. I'd appreciate it you testing it. > Thanks for the patch! I have tested it on the lenovo machine in the past few days, no issue found, so the patch tests OK. Thanks, Tao Liu > Thx. > > --- > arch/x86/boot/compressed/idt_64.c | 5 - > arch/x86/boot/compressed/sev.c| 37 +-- > 2 files changed, 39 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/boot/compressed/idt_64.c > b/arch/x86/boot/compressed/idt_64.c > index 6debb816e83d..0f03ac12e2a6 100644 > --- a/arch/x86/boot/compressed/idt_64.c > +++ b/arch/x86/boot/compressed/idt_64.c > @@ -63,7 +63,10 @@ void load_stage2_idt(void) > set_idt_entry(X86_TRAP_PF, boot_page_fault); > > #ifdef CONFIG_AMD_MEM_ENCRYPT > - set_idt_entry(X86_TRAP_VC, boot_stage2_vc); > + if (sev_status & BIT(1)) > + set_idt_entry(X86_TRAP_VC, boot_stage2_vc); > + else > + set_idt_entry(X86_TRAP_VC, NULL); > #endif > > load_boot_idt(_idt_desc); > diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c > index 09dc8c187b3c..c3e343bd4760 100644 > --- a/arch/x86/boot/compressed/sev.c > +++ b/arch/x86/boot/compressed/sev.c > @@ -404,13 +404,46 @@ void sev_enable(struct boot_params *bp) > if (bp) > bp->cc_blob_address = 0; > > + /* > +* Do an initial SEV capability check before snp_init() which > +* loads the CPUID page and the same checks afterwards are done > +* without the hypervisor and are trustworthy. > +* > +* If the HV fakes SEV support, the guest will crash'n'burn > +* which is good enough. > +*/ > + > + /* Check for the SME/SEV support leaf */ > + eax = 0x8000; > + ecx = 0; > + native_cpuid(, , , ); > + if (eax < 0x801f) > + return; > + > + /* > +* Check for the SME/SEV feature: > +* CPUID Fn8000_001F[EAX] > +* - Bit 0 - Secure Memory Encryption support > +* - Bit 1 - Secure Encrypted Virtualization support > +* CPUID Fn8000_001F[EBX] > +* - Bits 5:0 - Pagetable bit position used to indicate encryption > +*/ > + eax = 0x801f; > + ecx = 0; > + native_cpuid(, , , ); > + /* Check whether SEV is supported */ > + if (!(eax & BIT(1))) > + return; > + > /* > * Setup/preliminary detection of SNP. This will be sanity-checked > * against CPUID/MSR values later. > */ > snp = snp_init(bp); > > - /* Check for the SME/SEV support leaf */ > + /* Now repeat the checks with the SNP CPUID table. */ > + > + /* Recheck the SME/SEV support leaf */ > eax = 0x8000; > ecx = 0; > native_cpuid(, , , ); > @@ -418,7 +451,7 @@ void sev_enable(struct boot_params *bp) > return; > > /* > -* Check for the SME/SEV feature: > +* Recheck for the SME/SEV feature: > * CPUID Fn8000_001F[EAX] > * - Bit 0 - Secure Memory Encryption support > * - Bit 1 - Secure Encrypted Virtualization support > -- > 2.41.0 > > -- > Regards/Gruss, > Boris. > > https://people.kernel.org/tglx/notes-about-netiquette > ___ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
