From: Dave Hansen <dave.hansen@intel.com>
To: Tom Lendacky <thomas.lendacky@amd.com>,
Kirill Shutemov <kirill.shutemov@linux.intel.com>,
Dan Williams <dan.j.williams@intel.com>,
Naveen N Rao <naveen.rao@amd.com>
Cc: dave.hansen@linux.intel.com, x86@kernel.org,
Vishal Annapurve <vannapurve@google.com>,
Nikolay Borisov <nik.borisov@suse.com>,
stable@vger.kernel.org, linux-coco@lists.linux.dev
Subject: Re: [PATCH] x86/ioremap: Maintain consistent IORES_MAP_ENCRYPTED for BIOS data
Date: Tue, 1 Apr 2025 10:59:25 -0700 [thread overview]
Message-ID: <d440f49c-ab2f-4cb8-b822-362f757ae47d@intel.com> (raw)
In-Reply-To: <00931e12-4e6a-9ec4-309c-372aaee333b9@amd.com>
On 4/1/25 08:07, Tom Lendacky wrote:
> I haven't tested this, yet, but with SME the BIOS is not encrypted, so
> that would need an unencrypted mapping.
>
> Could you qualify your mapping with a TDX check? Or can you do something
> in the /dev/mem support to map appropriately?
>
> I'm adding @Naveen since he is preparing a patch to prevent /dev/mem
> from accessing ROM areas under SNP as those can trigger #VC for a page
> that is mapped encrypted but has not been validated. He's looking at
> possibly adding something to x86_platform_ops that can be overridden.
> The application would get a bad return code vs an exception.
How many more /dev/mem band-aids will we need for TDX and SEV before we
just throw up our hands and turn it off?
Maybe the x86_platform_ops call should just be "Do we allow /dev/mem at
all?"
next prev parent reply other threads:[~2025-04-01 17:59 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-31 23:14 [PATCH] x86/ioremap: Maintain consistent IORES_MAP_ENCRYPTED for BIOS data Dan Williams
2025-04-01 5:57 ` Nikolay Borisov
2025-04-02 20:55 ` Dan Williams
2025-04-01 7:57 ` Kirill Shutemov
2025-04-01 15:07 ` Tom Lendacky
2025-04-01 17:59 ` Dave Hansen [this message]
2025-04-02 21:03 ` Dan Williams
2025-04-02 18:55 ` Naveen N Rao
2025-04-02 21:36 ` Dan Williams
2025-04-03 12:11 ` Naveen N Rao
2025-04-02 20:56 ` Dan Williams
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d440f49c-ab2f-4cb8-b822-362f757ae47d@intel.com \
--to=dave.hansen@intel.com \
--cc=dan.j.williams@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-coco@lists.linux.dev \
--cc=naveen.rao@amd.com \
--cc=nik.borisov@suse.com \
--cc=stable@vger.kernel.org \
--cc=thomas.lendacky@amd.com \
--cc=vannapurve@google.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.