Messages in this thread Patch in this message | | | From | "Huang, Kai" <> | Subject | Re: [RFC PATCH] x86/virt/tdx: Disable KEXEC in the presence of TDX | Date | Thu, 18 Jan 2024 21:31:24 +0000 |
| |
On Thu, 2024-01-18 at 18:01 +0200, Nikolay Borisov wrote: > TDX doesn't currently support kexec so disable the latter when TDX > is detected at boot time. If kexec must absolutely be supported then > TDX can be disabled from the bios. > > Making this decision at run time rather than as a compile time option > allows distribution kernels to have both enabled and delegate to the > user whether they want to use TDX/Kexec. > > Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
Hi Nikolay,
Thanks for the patch.
I am working in progress on patches to make kexec() work with TDX. I plan to send them out soon (e.g., next week), but I think perhaps your patch is reasonable before that is merged.
Acked-by: Kai Huang <kai.huang@intel.com>
> --- > > Sending as RFC as I don't know the reason why initially it was decided to > enforce the incompaibility between kexec/tdx at build time rather than runtime. > > arch/x86/Kconfig | 1 - > arch/x86/virt/vmx/tdx/tdx.c | 6 ++++++ > include/linux/kexec.h | 1 + > kernel/kexec_core.c | 5 +++++ > 4 files changed, 12 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > index 92c03cb99b3e..6c2b620b40d8 100644 > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -1973,7 +1973,6 @@ config INTEL_TDX_HOST > depends on X86_X2APIC > select ARCH_KEEP_MEMBLOCK > depends on CONTIG_ALLOC > - depends on !KEXEC_CORE > depends on X86_MCE > help > Intel Trust Domain Extensions (TDX) protects guest VMs from malicious > diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c > index 4d6826a76f78..270090bd7b5e 100644 > --- a/arch/x86/virt/vmx/tdx/tdx.c > +++ b/arch/x86/virt/vmx/tdx/tdx.c > @@ -20,6 +20,7 @@ > #include <linux/memblock.h> > #include <linux/memory.h> > #include <linux/minmax.h> > +#include <linux/kexec.h> > #include <linux/sizes.h> > #include <linux/pfn.h> > #include <linux/align.h> > @@ -1473,6 +1474,11 @@ void __init tdx_init(void) > return; > } > > +#ifdef CONFIG_KEXEC_CORE > + kexec_disable(); > + pr_info("Disable Kexec. Turn off TDX in the BIOS to use KEXEC.\n"); > +#endif > + > #if defined(CONFIG_ACPI) && defined(CONFIG_SUSPEND) > pr_info("Disable ACPI S3. Turn off TDX in the BIOS to use ACPI S3.\n"); > acpi_suspend_lowlevel = NULL; > diff --git a/include/linux/kexec.h b/include/linux/kexec.h > index 8227455192b7..c434c8569242 100644 > --- a/include/linux/kexec.h > +++ b/include/linux/kexec.h > @@ -500,6 +500,7 @@ static inline int crash_hotplug_memory_support(void) { return 0; } > static inline unsigned int crash_get_elfcorehdr_size(void) { return 0; } > #endif > > +extern void kexec_disable(void); > #else /* !CONFIG_KEXEC_CORE */ > struct pt_regs; > struct task_struct; > diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c > index be5642a4ec49..8d3a2a04ff4d 100644 > --- a/kernel/kexec_core.c > +++ b/kernel/kexec_core.c > @@ -927,6 +927,11 @@ struct kimage *kexec_image; > struct kimage *kexec_crash_image; > static int kexec_load_disabled; > > +void kexec_disable(void) > +{ > + kexec_load_disabled = 1; > +} > + > #ifdef CONFIG_SYSCTL > static int kexec_limit_handler(struct ctl_table *table, int write, > void *buffer, size_t *lenp, loff_t *ppos) > -- > 2.34.1 > >
| |