From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BA09EC8735 for ; Thu, 7 Sep 2023 14:56:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 61D6A8D0007; Thu, 7 Sep 2023 10:56:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5A6E58D0001; Thu, 7 Sep 2023 10:56:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3FB218D0007; Thu, 7 Sep 2023 10:56:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 2B5268D0001 for ; Thu, 7 Sep 2023 10:56:54 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 016AE80969 for ; Thu, 7 Sep 2023 14:56:53 +0000 (UTC) X-FDA: 81210103548.05.D95150A Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by imf09.hostedemail.com (Postfix) with ESMTP id 28D01140026 for ; Thu, 7 Sep 2023 14:56:50 +0000 (UTC) Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=MA2yx83F; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf09.hostedemail.com: domain of dave.hansen@intel.com designates 134.134.136.31 as permitted sender) smtp.mailfrom=dave.hansen@intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1694098612; a=rsa-sha256; cv=none; b=xpA99kikxqELE2mf5X+ieilWivTNqo5hHXCoTlH+pcRAfn4mJ5V1Q0hbjC00rk/tWf89wq ZTLtjcAnqo4Dty+Rza3eSPE2dc5sP1UVszricY/C2GRAz8QlshNm7jTlNOE73PrpSONaGT oZvr08lFfJP+e4+CnDdOUDsp+P0eNMg= ARC-Authentication-Results: i=1; imf09.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=MA2yx83F; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf09.hostedemail.com: domain of dave.hansen@intel.com designates 134.134.136.31 as permitted sender) smtp.mailfrom=dave.hansen@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1694098612; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=sL+x8uENVG4/4kAY8YhVNRoSHuax6wvobotSMCcGZvw=; b=OrUIzsD5htrex0Y+lBKHbX/rhW3AeyfokcK2esng0ZeVyU1MQCU3866pLsGeJI+LEEnDbK aj2yZ1OsfN9SN4/uQ7JXLHDO9hoEAQfsfIMfhobkXxRg5pG3H88KDuTfQJ6ObC5dXnkLHo 57FKhLF8xqG0WWgAmqYmByvCEfqicAE= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1694098611; x=1725634611; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=QrIByt2sivOlThJJJuIm95tWasheU6Saudv9SUBPsTs=; b=MA2yx83FIF/UoNlsnYY+Zzt6HuslgkRiIn+yeq4S7yYQSHefsnLJRGqc xNV6Xc65pw6gYxicwad0yfZe1j1FttDKLogK68wtRFQTKjyTWPlX77OGG s5/G+GYg6OLlf1wE/372HTnBrcCdVxDW2eIo+AcmNU5FNUlPJjlMtLyfc 0DLfrUrh0Hv3Krp0gDxr0HX998b7BZsyOAvggrTUw1DmcEKGgnT6VXADw mO5mWQbELEMZB7tTgccqja2PqAggrMBjkB9yslKgk1JpJCQu6h1baNxPG WG5Hq8JPsPbOKXTCa3I0+83kkf/lwbkccT+5XKacjBEyPvW+k/5xu+Prd A==; X-IronPort-AV: E=McAfee;i="6600,9927,10826"; a="441379009" X-IronPort-AV: E=Sophos;i="6.02,235,1688454000"; d="scan'208";a="441379009" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Sep 2023 07:46:57 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10826"; a="856885283" X-IronPort-AV: E=Sophos;i="6.02,235,1688454000"; d="scan'208";a="856885283" Received: from ningle-mobl2.amr.corp.intel.com (HELO [10.209.13.77]) ([10.209.13.77]) by fmsmga002-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Sep 2023 07:46:55 -0700 Message-ID: <7a50d04f-63ee-a901-6f39-7d341e423a77@intel.com> Date: Thu, 7 Sep 2023 07:46:54 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.0 Subject: Re: [PATCH 3/3] /dev/mem: Do not map unaccepted memory Content-Language: en-US To: "Kirill A. Shutemov" Cc: Adrian Hunter , Borislav Petkov , Andrew Morton , Vlastimil Babka , Mike Rapoport , Lorenzo Stoakes , Tom Lendacky , Baoquan He , Vivek Goyal , Dave Young , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-coco@lists.linux.dev, linux-efi@vger.kernel.org, kexec@lists.infradead.org References: <20230906073902.4229-1-adrian.hunter@intel.com> <20230906073902.4229-4-adrian.hunter@intel.com> <9ffb7a3b-cf20-617a-e4f1-8a6a8a2c5972@intel.com> <20230907142510.vcj57cvnewqt4m37@box.shutemov.name> From: Dave Hansen In-Reply-To: <20230907142510.vcj57cvnewqt4m37@box.shutemov.name> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 28D01140026 X-Stat-Signature: dbjpwjn6mpfmxsu9o4wj7pizbb7bdx93 X-HE-Tag: 1694098610-197785 X-HE-Meta: U2FsdGVkX1+LxICOxMNug8zHFAoN+eEE2zKZ6fMpi3S09v3sHdNZh3vd/RoQtPOTknlDFjriPI1Eke9Nj9698QLqXUm8q90PF3lICkq9L//4I3+eTfaFyCQh26bMcxXHwFjAMXTtLD+NAJksrrKo+edoPjhWxQkz1gU6loaiAiKnPWnYAZVa3G1rrk5mqf2J9O9P95u4RkW5uoBP1QtH0sLO+hcOJcG/fNJ+RWgPI2cnetIh9k0dkqZeW5mDMl+zXQ8jj7/i80M79dGYN5Lu2uC5r2lwYP8H+CbmelU+WaEw1vXlBlNeH8iQfdaLvnJddHbg+53j5aS0KtRzF5MK7a2iBdkLR/w0/berbS30HGTnqXsEB1bmjUZZliDdcVVJXMAsrWKiAEp/5NJaskkaMTZPBfFleRucR40j7hs29gLKdbdCKyKftcCHmAyV7VzlcXgAVVgajdJ6NxB/gZ2lWQwOSo+WKhuCO0axUGvP4d/lubPdDsKJJ4FAEFGkIHdDMRxEUV15ruTYflBg8/wmvOJ8DUD2rL/0s721bPSYYOzK7pOBkiYAN+8mnuIfJpidwDLfoucxreobfEuYuKqO0p3pDSEckJW1Bd64tsXbvvVdm62+KWNEs97jQBTTl+voKfkO9E4WneXIySJ+CQ6hg5q7lQRcBgngkitYcgYqR36xQqq9nvmAPfIrAPtimWRRwHMm6iwm2f557wu7qWGREzhnYM6xbQNkfTFpPhYIVUWeW0q1+5NS4aZVA8mPLYAp16Wc6gI75oYezozc7E7sFt2w5D9MBeTGs99ufbjQKb5gwGNdeha9bGdzTLWhWPu9/JtjWE445Kvx/NxMo2zK7EzwCYbWqzyYBH4KgnWOY5nk1BBigzJVdqyNMiQKKGcroh5Em5zPPukPb4q5rxStc+SuiLY84NMVQf06NtVLZCZbl+JPcoUbqITsdpARh6/tCB8Q2lKf43IAqwd9oCe JaEa5Xxj 1LXvF76GK4CpwiZVIiGGJ/NNxH8lt4puJtPLnuuq/bBBL1/yC/z6ckGqP6BT6K7mL+oz9WzWrjjKxSViL7phG0dViWhJGddyEWz0VfGiQrtF/qpFF+X6/VOXKrRmxniz+QouPF9Ol0Vtnnb6DmMefTF6hvQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 9/7/23 07:25, Kirill A. Shutemov wrote: > On Thu, Sep 07, 2023 at 07:15:21AM -0700, Dave Hansen wrote: >> On 9/6/23 00:39, Adrian Hunter wrote: >>> Support for unaccepted memory was added recently, refer commit >>> dcdfdd40fa82 ("mm: Add support for unaccepted memory"), whereby >>> a virtual machine may need to accept memory before it can be used. >>> >>> Do not map unaccepted memory because it can cause the guest to fail. >> Doesn't /dev/mem already provide a billion ways for someone to shoot >> themselves in the foot? TDX seems to have added the 1,000,000,001st. >> Is this really worth patching? > Is it better to let TD die silently? I don't think so. First, let's take a look at all of the distro kernels that folks will run under TDX. Do they have STRICT_DEVMEM set? > config STRICT_DEVMEM ... > If this option is switched on, and IO_STRICT_DEVMEM=n, the /dev/mem > file only allows userspace access to PCI space and the BIOS code and > data regions. This is sufficient for dosemu and X and all common > users of /dev/mem. Can a line of code in this patch even run in the face of IO_STRICT_DEVMEM=y? I think basically everybody sets that option and has for over a decade. If there are any distros out there _not_ setting this, we should probably have a chat with them to find out more. I suspect any practical use of this patch is limited to folks who: 1. Compile sensible security-related options out of their kernel 2. Go and reads random pages with /dev/mem in their "secure" VM They get to hold the pieces, and they can and will get a notification from their VMM that the VM did something nasty. BTW, Ubuntu at least also sets HARDENED_USERCOPY which will *also* enable STRICT_DEVMEM. So someone would have to _really_ go to some trouble to shoot themselves in the foot here. If they're _that_ determined, it would be a shame to thwart their efforts with this patch.