From: "Gerd Hoffmann" <kraxel@redhat.com>
To: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: Dionna Amalie Glaze <dionnaglaze@google.com>,
Ard Biesheuvel <ardb@kernel.org>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org,
x86@kernel.org, jiewen.yao@intel.com, devel@edk2.groups.io,
"Min M. Xu" <min.m.xu@intel.org>,
James Bottomley <jejb@linux.ibm.com>,
Tom Lendacky <Thomas.Lendacky@amd.com>,
Erdem Aktas <erdemaktas@google.com>,
Dave Hansen <dave.hansen@linux.intel.com>
Subject: Re: [PATCH v2] x86/efi: Safely enable unaccepted memory in UEFI
Date: Tue, 17 Jan 2023 11:24:33 +0100 [thread overview]
Message-ID: <20230117102433.mawczdq3di6776bx@sirius.home.kraxel.org> (raw)
In-Reply-To: <20230116231711.cudsnxvnfg6aef3w@box.shutemov.name>
On Tue, Jan 17, 2023 at 02:17:11AM +0300, Kirill A. Shutemov wrote:
> On Mon, Jan 16, 2023 at 11:43:15AM -0800, Dionna Amalie Glaze wrote:
> > > > I still don't understand why we need to support every imaginable
> > > > combination of firmware, bootloader and OS. Unaccepted memory only
> > > > exists on a special kind of virtual machine, which provides very
> > > > little added value unless you opt into the security and attestation
> > > > features, which are all heavily based on firmware protocols. So why
> > > > should care about a EFI-aware bootloader calling ExitBootServices()
> > > > and subsequently doing a legacy boot of Linux on such systems?
> > >
> > > Why break what works? Some users want it.
> > >
> >
> > The users that want legacy boot features will not be broken,
>
> Why do you call boot with a bootloader a legacy feature?
Linux efi kernels can be booted in two ways:
(1) old/legacy: boot loader calls ExitBootServices and jumps to the
kernel entry point.
(2) new/efi stub: boot loader does *not* call ExitBootServices, but
loads the linux kernel as efi binary instead. The linux kernel
efi stub calls ExitBootServices then.
All kernel version relevant here (new enough to support SEV-SNP / TDX)
have efi stub support, so (1) does not really matter in practice.
the efi stub was added *exactly* to handle cases like this one: the
kernel can do efi calls needed on its own without depending on the
boot loader doing it on behalf of the kernel.
> > This means that users of a distro that has not enabled unaccepted
> > memory support cannot simply start a VM with the usual command, but
> > instead have to know a baroque extra flag to get access to all the
> > memory that they configured the machine (and for a CSP customer, paid
> > for). That's not a good experience.
>
> New features require enabling. It is not something new.
Asking user to manually configure something which can be handled
automatically just fine is a bad design.
take care,
Gerd
next prev parent reply other threads:[~2023-01-17 10:24 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-13 21:29 [PATCH v2] x86/efi: Safely enable unaccepted memory in UEFI Dionna Glaze
2023-01-13 22:20 ` Kirill A. Shutemov
2023-01-16 10:56 ` Gerd Hoffmann
2023-01-16 12:30 ` Kirill A. Shutemov
2023-01-16 13:11 ` Ard Biesheuvel
2023-01-16 13:42 ` Kirill A. Shutemov
2023-01-16 19:43 ` Dionna Glaze
2023-01-16 23:17 ` Kirill A. Shutemov
2023-01-17 10:24 ` Gerd Hoffmann [this message]
2023-01-17 16:45 ` Dionna Glaze
2023-01-18 7:51 ` [edk2-devel] " Gerd Hoffmann
2023-01-16 21:22 ` Dave Hansen
2023-01-16 22:46 ` Lendacky, Thomas
2023-01-18 15:09 ` Ard Biesheuvel
2023-01-18 15:40 ` Dave Hansen
2023-01-18 15:46 ` Ard Biesheuvel
2023-01-17 10:34 ` Gerd Hoffmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230117102433.mawczdq3di6776bx@sirius.home.kraxel.org \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox