AMD SME + KASAN = doom

AMD SME + KASAN = doom

[Qian Cai]

CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y + KASAN (inline) will reset
the host right away after those lines on linux-next (the mainline has
the same problem when I tested a while back, so it seems never work),

Wrong EFI loader signature.
early console in extract_kernel
input_data: 0x000000000c7ad3a8
input_len: 0x0000000000aa5f4c
output: 0x0000000001000000
output_len: 0x000000000c1808cc
kernel_total_size: 0x000000000b62c000
needed_size: 0x000000000c200000
trampoline_32bit: 0x000000000008a000
booted via startup_32()
Physical KASLR using RDRAND RDTSC...
Virtual KASLR using RDRAND RDTSC...

Decompressing Linux... Parsing ELF... Performing relocations... done.
Booting the kernel.

The .config (plus CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y):
https://raw.githubusercontent.com/cailca/linux-mm/master/x86.config

Reproduced on several systems including,

HPE DL385 G10
AMD EPYC 7301 16-Core Processor

Dell PowerEdge R6415
AMD EPYC 7401P 24-Core Processor

Even on one of the HPE DL385 G10, it is able to boot but NO such
message, "AMD Secure Memory Encryption (SME) active"

Set KASAN=n will boot and has the above message at least on those Dell
systems.

Re: AMD SME + KASAN = doom

[Borislav Petkov]

On Sat, Jun 13, 2020 at 11:24:08AM -0400, Qian Cai wrote:
> CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y + KASAN (inline) will reset
> the host right away after those lines on linux-next (the mainline has
> the same problem when I tested a while back, so it seems never work),

$ head arch/x86/mm/Makefile
# SPDX-License-Identifier: GPL-2.0
# Kernel does not boot with instrumentation of tlb.c and mem_encrypt*.c
KCOV_INSTRUMENT_tlb.o                   := n
KCOV_INSTRUMENT_mem_encrypt.o           := n
KCOV_INSTRUMENT_mem_encrypt_identity.o  := n

KASAN_SANITIZE_mem_encrypt.o            := n
KASAN_SANITIZE_mem_encrypt_identity.o   := n

so something else needs to be de-KASAN-ed too.

For now flip your Subject: AMD SME - KASAN = boot.

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg

Re: AMD SME + KASAN = doom

[Qian Cai]

> On Jun 13, 2020, at 11:54 AM, Borislav Petkov <bp@suse.de> wrote:
> 
> $ head arch/x86/mm/Makefile
> # SPDX-License-Identifier: GPL-2.0
> # Kernel does not boot with instrumentation of tlb.c and mem_encrypt*.c
> KCOV_INSTRUMENT_tlb.o                   := n
> KCOV_INSTRUMENT_mem_encrypt.o           := n
> KCOV_INSTRUMENT_mem_encrypt_identity.o  := n
> 
> KASAN_SANITIZE_mem_encrypt.o            := n
> KASAN_SANITIZE_mem_encrypt_identity.o   := n
> 
> so something else needs to be de-KASAN-ed too.

Okay, I’ll try to figure out what else needs to be done.

> 
> For now flip your Subject: AMD SME - KASAN = boot.

Which is a bit of shame because KASAN is proved useful for testing and at the same time SME could flags some issues with drivers like megasas_raid (where the driver will do a  firmware dump during the boot which I plan to debug more a bit later).