Linux Confidential Computing Development
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Dan Williams <dan.j.williams@intel.com>
Cc: dave.hansen@linux.intel.com, Arnd Bergmann <arnd@arndb.de>,
	Ingo Molnar <mingo@kernel.org>, Kees Cook <kees@kernel.org>,
	Kirill Shutemov <kirill.shutemov@linux.intel.com>,
	Michael Ellerman <mpe@ellerman.id.au>,
	Naveen N Rao <naveen@kernel.org>,
	Nikolay Borisov <nik.borisov@suse.com>,
	stable@vger.kernel.org, Suzuki K Poulose <suzuki.poulose@arm.com>,
	Vishal Annapurve <vannapurve@google.com>,
	x86@kernel.org, linux-coco@lists.linux.dev
Subject: Re: [PATCH v5] x86/devmem: Remove duplicate range_is_allowed() definition
Date: Wed, 30 Apr 2025 09:19:54 +0200	[thread overview]
Message-ID: <2025043043-disinfect-cosigner-db50@gregkh> (raw)
In-Reply-To: <20250430024622.1134277-2-dan.j.williams@intel.com>

On Tue, Apr 29, 2025 at 07:46:21PM -0700, Dan Williams wrote:
> 17 years ago, Venki suggested [1] "A future improvement would be to
> avoid the range_is_allowed duplication".
> 
> The only thing preventing a common implementation is that
> phys_mem_access_prot_allowed() expects the range check to exit
> immediately when PAT is disabled [2]. I.e. there is no cache conflict to
> manage in that case. This cleanup was noticed on the path to
> considering changing range_is_allowed() policy to blanket deny /dev/mem
> for private (confidential computing) memory.
> 
> Note, however that phys_mem_access_prot_allowed() has long since stopped
> being relevant for managing cache-type validation due to [3], and [4].
> 
> Commit 0124cecfc85a ("x86, PAT: disable /dev/mem mmap RAM with PAT") [1]
> Commit 9e41bff2708e ("x86: fix /dev/mem mmap breakage when PAT is disabled") [2]
> Commit 1886297ce0c8 ("x86/mm/pat: Fix BUG_ON() in mmap_mem() on QEMU/i386") [3]
> Commit 0c3c8a18361a ("x86, PAT: Remove duplicate memtype reserve in devmem mmap") [4]
> 
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Cc: Ingo Molnar <mingo@kernel.org>
> Cc: "Naveen N Rao" <naveen@kernel.org>
> Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
>  arch/x86/mm/pat/memtype.c | 31 ++++---------------------------
>  drivers/char/mem.c        | 18 ------------------
>  include/linux/io.h        | 21 +++++++++++++++++++++
>  3 files changed, 25 insertions(+), 45 deletions(-)


Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

  reply	other threads:[~2025-04-30 12:05 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-04-30  2:46 [PATCH v5] Restrict devmem for confidential VMs Dan Williams
2025-04-30  2:46 ` [PATCH v5] x86/devmem: Remove duplicate range_is_allowed() definition Dan Williams
2025-04-30  7:19   ` Greg Kroah-Hartman [this message]
2025-04-30  2:46 ` [PATCH v5] x86/devmem: Drop /dev/mem access for confidential guests Dan Williams
2025-04-30  7:19   ` Greg Kroah-Hartman
2025-04-30 23:03     ` Dan Williams
2025-04-30 17:31   ` Arnd Bergmann
2025-05-01  0:56     ` Dan Williams
2025-05-01  8:12       ` Arnd Bergmann
2025-05-01 20:01         ` Arnd Bergmann
2025-05-01 20:18           ` Dave Hansen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2025043043-disinfect-cosigner-db50@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=arnd@arndb.de \
    --cc=dan.j.williams@intel.com \
    --cc=dave.hansen@linux.intel.com \
    --cc=kees@kernel.org \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=linux-coco@lists.linux.dev \
    --cc=mingo@kernel.org \
    --cc=mpe@ellerman.id.au \
    --cc=naveen@kernel.org \
    --cc=nik.borisov@suse.com \
    --cc=stable@vger.kernel.org \
    --cc=suzuki.poulose@arm.com \
    --cc=vannapurve@google.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox