Re: [PATCH v2] x86/crash: Disable SGX in the kdump kernel

[sashiko-bot@kernel.org]

> The kdump capture kernel cannot use SGX: EPC memory is e820-reserved,
> so it is not part of the crash dump, and no enclave will ever run
> during dump capture.  Yet sgx_init() runs unconditionally and pays the
> full EPC bookkeeping: sgx_setup_epc_section() allocates one struct
> sgx_epc_page (32 bytes) per 4K EPC page, i.e. EPC/128, plus a memremap
> of the whole EPC range.
> 
> The capture kernel has no memory other than the crashkernel
> reservation.  On a VM with 15.5G EPC the bookkeeping alone costs
> 124 MB of vmalloc - nearly half of the stock crashkernel=256M -
> and the cost scales with EPC size, not RAM.
> 
> That is enough to break kdump outright: with the default 256M the
> capture kernel OOMs in early userspace (udevadm and journald are killed
> before the root device is enumerated) and no vmcore is produced, while
> 512M works.  With this change the same 256M reservation captures a
> complete vmcore; SGX initializes as usual on normal boots.
> 
> Clear X86_FEATURE_SGX from an x86 early handler for elfcorehdr=, which
> only the capture kernel receives, so sgx_init() bails out on its
> existing capability check and no kdump knowledge leaks into the SGX
> code.  Like nosgx, it has to be an early parameter: clearing a feature
> after alternatives are patched is too late.
> 
> Reported-by: Challvy Tee <challvy.tee@gmail.com>
> Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
> Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113035019.3747461-1-xiangzao@linux.alibaba.com?part=1