Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: iac594737:Fastmail
Date:   Thu, 22 Sep 2022 10:55:40 -0400
From:   Demi Marie Obenour <demi@invisiblethingslab.com>
To:     Jan Beulich <jbeulich@suse.com>
Cc:     Juergen Gross <jgross@suse.com>,
        Stefano Stabellini <sstabellini@kernel.org>,
        Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
        linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org,
        xen-devel@lists.xenproject.org,
        Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= 
        <marmarek@invisiblethingslab.com>, Ard Biesheuvel <ardb@kernel.org>
Subject: Re: [PATCH v3] Support ESRT in Xen dom0
Message-ID: <Yyx3hlE/MDBeEdtu@itl-email>
References: <20220919193257.2031-1-demi@invisiblethingslab.com>
 <CAMj1kXEBfJUfTQ3THqqKxsU09_S98B_TjTECKwGM0WAv_5tZaA@mail.gmail.com>
 <7930b617-d473-94dd-c7e4-33ffa19da13e@suse.com>
 <CAMj1kXEJ9d3-8xa7rkczY7ur2zDm9CjqM7u1eEdHHmPG=Oo=xA@mail.gmail.com>
 <3671fd52-6034-7149-ebe4-f7560c0dc6b0@suse.com>
 <Yyu1xC7Tlf9sS7Ro@itl-email>
 <6f42a382-c5aa-ba16-f330-69a07476e2aa@suse.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="GpPEXFLkdw7UWuLD"
Content-Disposition: inline
In-Reply-To: <6f42a382-c5aa-ba16-f330-69a07476e2aa@suse.com>
Precedence: bulk


--GpPEXFLkdw7UWuLD
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Thu, 22 Sep 2022 10:55:40 -0400
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: Jan Beulich <jbeulich@suse.com>
Cc: Juergen Gross <jgross@suse.com>,
	Stefano Stabellini <sstabellini@kernel.org>,
	Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
	linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org,
	xen-devel@lists.xenproject.org,
	Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= <marmarek@invisiblethingslab.com>,
	Ard Biesheuvel <ardb@kernel.org>
Subject: Re: [PATCH v3] Support ESRT in Xen dom0

On Thu, Sep 22, 2022 at 08:12:14AM +0200, Jan Beulich wrote:
> On 22.09.2022 03:09, Demi Marie Obenour wrote:
> > On Wed, Sep 21, 2022 at 10:34:04PM +0200, Jan Beulich wrote:
> >> On 20.09.2022 18:09, Ard Biesheuvel wrote:
> >>> On Tue, 20 Sept 2022 at 17:54, Jan Beulich <jbeulich@suse.com> wrote:
> >>>>
> >>>> On 20.09.2022 17:36, Ard Biesheuvel wrote:
> >>>>> On Mon, 19 Sept 2022 at 21:33, Demi Marie Obenour
> >>>>> <demi@invisiblethingslab.com> wrote:
> >>>>>>
> >>>>>> fwupd requires access to the EFI System Resource Table (ESRT) to
> >>>>>> discover which firmware can be updated by the OS.  Currently, Linu=
x does
> >>>>>> not expose the ESRT when running as a Xen dom0.  Therefore, it is =
not
> >>>>>> possible to use fwupd in a Xen dom0, which is a serious problem fo=
r e.g.
> >>>>>> Qubes OS.
> >>>>>>
> >>>>>> Before Xen 4.16, this was not fixable due to hypervisor limitation=
s.
> >>>>>> The UEFI specification requires the ESRT to be in EfiBootServicesD=
ata
> >>>>>> memory, which Xen will use for whatever purposes it likes.  Theref=
ore,
> >>>>>> Linux cannot safely access the ESRT, as Xen may have overwritten i=
t.
> >>>>>>
> >>>>>> Starting with Xen 4.17, Xen checks if the ESRT is in EfiBootServic=
esData
> >>>>>> or EfiRuntimeServicesData memory.  If the ESRT is in EfiBootServic=
esData
> >>>>>> memory, Xen allocates some memory of type EfiRuntimeServicesData, =
copies
> >>>>>> the ESRT to it, and finally replaces the ESRT pointer with a point=
er to
> >>>>>> the copy.  Since Xen will not clobber EfiRuntimeServicesData memor=
y,
> >>>>>> this ensures that the ESRT can safely be accessed by the OS.  It i=
s safe
> >>>>>> to access the ESRT under Xen if, and only if, it is in memory of t=
ype
> >>>>>> EfiRuntimeServicesData.
> >>>>>>
> >>>>>
> >>>>> Thanks for the elaborate explanation. This is really helpful.
> >>>>>
> >>>>> So here, you are explaining that the only way for Xen to prevent
> >>>>> itself from potentially clobbering the ESRT is by creating a
> >>>>> completely new allocation?
> >>>>
> >>>> There are surely other ways, e.g. preserving BootServices* regions
> >>>> alongside RuntimeServices* ones. But as the maintainer of the EFI
> >>>> code in Xen I don't view this as a reasonable approach.
> >>>
> >>> Why not?
> >>
> >> Because it's against the intentions the EFI has (or at least had)
> >> for this memory type. Much more than EfiAcpiReclaimMemory this
> >> type is intended for use as ordinary RAM post-boot.
> >=20
> > What about giving that memory to dom0?  dom0=E2=80=99s balloon driver w=
ill give
> > anything dom0 doesn=E2=80=99t wind up using back to Xen.
>=20
> While perhaps in principle possible, this would require special casing
> in Xen. Except for the memory the initrd comes in, we don't directly
> hand memory to Dom0. Instead everything goes through the page allocator
> first. Plus if we really were convinced boot services memory needed
> retaining, then it would also need retaining across kexec (and hence
> shouldn't be left to Dom0 to decide what to do with it).

So how should dom0 handle the various EFI tables other than the ESRT?
Right now most uses of these tables in Linux are not guarded by any
checks for efi_enabled(EFI_MEMMAP) or similar.  If some of them are in
EfiBootServicesData memory, they might be corrupted before Linux gets
them.
--=20
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

--GpPEXFLkdw7UWuLD
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmMsd4cACgkQsoi1X/+c
IsEBoA//b/usaepDm+lyniu3r0moNjjY3zaQmtdSXTMeHqFzBrABiAz5AZyBFCtr
wzSdmzo4rlrvNR2/et8taDq0qOcjGouCgWLLS4p5pbW+PkV/0RzLPVCQaanRm+g5
ZKeQbIFHeClEw7c4AWgY1mmlhiSdPYPCpXDdL4NCKeZgSTRykBp4J+Rg6rjwWKHD
NAcWWs5MP6S4uVPVyZJQW4Blp087xPx3y/dFe5Fj3SeV37FDE9mvALy2+eJkDwnb
7EPnOmczl7BSHg6L0xxClF1AFedsP7Ao/ANIs+kAR3EhbKnvczvLgANTMBRo+JUk
Z6JST57bnRNtR4nSs8txTfjA4OqBy6RgJAwzN2lgd9zjZJnUgRVaungMKi0hmanS
QMDtB6EGnCj8m6TaJiISxNjNeK8TQRh11GyNCcFgsUnfi7KlYbybeMnoOOWg3Hwz
n5xXPsO9YSplCPsJ+aqfKp5yhUoE7ePskiGzyRThLBzx5HMgM/qFnXvtvi2/cY+G
XEfQo9fWiss6Or47D3ekcw0FtYrU2EKUVsVEmRR0f8aRSJl4phCSu9mbU6aikQzK
ADdLyxZ/Cle6oGy44fVcevif3qp/gO5/u3AxegTqBL9Xu9mtz3RyZrDxAaZoLUEh
b6UgO0JZhueI7F9B48R4cKAfOzJ/+9srYZyIZHLQZYPzMDzOaV4=
=tj0J
-----END PGP SIGNATURE-----

--GpPEXFLkdw7UWuLD--