From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AC0ECA9ECF for ; Thu, 31 Oct 2019 21:53:01 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0D2D4208C0 for ; Thu, 31 Oct 2019 21:53:00 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QH4xISMA" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0D2D4208C0 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 6DF1B6B0005; Thu, 31 Oct 2019 17:53:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 68EAF6B0006; Thu, 31 Oct 2019 17:53:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5A5CD6B0007; Thu, 31 Oct 2019 17:53:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0211.hostedemail.com [216.40.44.211]) by kanga.kvack.org (Postfix) with ESMTP id 39EDF6B0005 for ; Thu, 31 Oct 2019 17:53:00 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with SMTP id CF3514DDB for ; Thu, 31 Oct 2019 21:52:59 +0000 (UTC) X-FDA: 76105430478.05.eye31_71680bc76bd41 X-HE-Tag: eye31_71680bc76bd41 X-Filterd-Recvd-Size: 5418 Received: from mail-io1-f66.google.com (mail-io1-f66.google.com [209.85.166.66]) by imf07.hostedemail.com (Postfix) with ESMTP for ; Thu, 31 Oct 2019 21:52:59 +0000 (UTC) Received: by mail-io1-f66.google.com with SMTP id p6so8543901iod.7 for ; Thu, 31 Oct 2019 14:52:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=S6nzwdV69bS3qMmnYiEeOyRFqJ5MsMzJLi/ghgWFyCk=; b=QH4xISMARBbOmmD3a9sgevwM4oEP3QBvRNmTOkMVYDdAKztdrYBiftDBJKA0Vzldim 02CjCPjP7ff7F/zqEeXFSTQ43DmYwvd4owfRWPEL28BYSnw6QBnx1uXHY3ZQfH8+h1hQ jA7qdGHxzHXoz/fKWM2xzzGWqVQvKy/cp82yCB6I4dMUGs8aghFdymxrCW2FaMa/Kpme 5W7k3/vmCV0gi/sSh/qE01UlCsWWp5xLa2uOzNCs+irygA64lpLzQwsNhw64u017X4Bt WDqwrayYdr3GjBsa49HTeGcGx2QQWX1DXM3UEXjl1pA1CLnzlj7qlloaeGXzaCfrWac4 h2Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=S6nzwdV69bS3qMmnYiEeOyRFqJ5MsMzJLi/ghgWFyCk=; b=gbVn5xnSvJJ3bltrYx1fKsihQvsjx9L7jo5GvmqAfOQgzEEoJ99iwagHR72WDoPb/C P78N7ufS6jZN9RoamshTPoq6sJUw9YxdAY2Rej4i0sSUd2O7JcwxOotxQbH58EgiVI/h Ig9wYUti64M39OrS/a1JhLuMXYcDS6omPynI0RZS1gWH3cc5Wzq6qbRAe1ure1bhKbfX S1DD0bJA54YIMLYAfPQu4KIBhUm4bEXQBLh6YUqMox5CfzSy0izLfwImEGhyU45kIdfz DHol7GBJQ/f5Nesl9yktj3y+5WwwzLOMLGm0W2oaPMHqNqo5d/or1fw+zw+Yx9gl8qzT bSfQ== X-Gm-Message-State: APjAAAVcaq1BEQknkwFlDkQ1hJxFQbFkwnme/maSH3EXXKIgaTVmycJC SK+0L2WuQhlLTv4TbAgKtDni4kFQwRbl39lLvJs= X-Google-Smtp-Source: APXvYqw1GGuyhktv3L0CWRwAE5jFdB3YHTBZ/G3in7KXjy4nSlz8MqaOjQ1BkXcRJhHFs83nIz1yDhXZBSuI2dNiaZg= X-Received: by 2002:a02:330e:: with SMTP id c14mr1725697jae.5.1572558778301; Thu, 31 Oct 2019 14:52:58 -0700 (PDT) MIME-Version: 1.0 References: <1572171452-7958-1-git-send-email-rppt@kernel.org> <1572171452-7958-2-git-send-email-rppt@kernel.org> <085ed07e-e646-f7a4-0370-06f33a2a4e4a@redhat.com> <20191030081529.GB20624@rapoport-lnx> <9eae3941-64cf-4ea1-0287-0e64bab192c6@redhat.com> <20191031191651.GA26165@rapoport-lnx> In-Reply-To: <20191031191651.GA26165@rapoport-lnx> From: Dan Williams Date: Thu, 31 Oct 2019 14:52:46 -0700 Message-ID: Subject: Re: [PATCH RFC] mm: add MAP_EXCLUSIVE to create exclusive user mappings To: Mike Rapoport Cc: David Hildenbrand , Linux Kernel Mailing List , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Arnd Bergmann , Borislav Petkov , Dave Hansen , James Bottomley , Peter Zijlstra , Steven Rostedt , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Linux API , linux-mm , "the arch/x86 maintainers" , Mike Rapoport Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Oct 31, 2019 at 12:17 PM Mike Rapoport wrote: > > On Wed, Oct 30, 2019 at 09:19:33AM +0100, David Hildenbrand wrote: > > On 30.10.19 09:15, Mike Rapoport wrote: > > >On Tue, Oct 29, 2019 at 12:02:34PM +0100, David Hildenbrand wrote: > > >>On 27.10.19 11:17, Mike Rapoport wrote: > > >>>From: Mike Rapoport > > >>> > > >>>The mappings created with MAP_EXCLUSIVE are visible only in the context of > > >>>the owning process and can be used by applications to store secret > > >>>information that will not be visible not only to other processes but to the > > >>>kernel as well. > > >>> > > >>>The pages in these mappings are removed from the kernel direct map and > > >>>marked with PG_user_exclusive flag. When the exclusive area is unmapped, > > >>>the pages are mapped back into the direct map. > > >>> > > >> > > >>Just a thought, the kernel is still able to indirectly read the contents of > > >>these pages by doing a kdump from kexec environment, right? > > > > > >Right. > > > > > >>Also, I wonder > > >>what would happen if you map such pages via /dev/mem into another user space > > >>application and e.g., use them along with kvm [1]. > > > > > >Do you mean that one application creates MAP_EXCLUSIVE and another > > >applications accesses the same physical pages via /dev/mem? > > > > Exactly. > > > > > > > >With /dev/mem all physical memory is visible... > > > > Okay, so the statement "information that will not be visible not only to > > other processes but to the kernel as well" is not correct. There are easy > > ways to access that information if you really want to (might require root > > permissions, though). > > Right, but /dev/mem is an easy way to extract any information in any > environment if one has root permissions... > I don't understand this concern with /dev/mem. Just add these pages to the growing list of the things /dev/mem is not allowed to touch.