From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD586C4320E for ; Tue, 24 Aug 2021 21:56:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A2560613CD for ; Tue, 24 Aug 2021 21:56:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238427AbhHXV4r (ORCPT ); Tue, 24 Aug 2021 17:56:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40280 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238439AbhHXV4q (ORCPT ); Tue, 24 Aug 2021 17:56:46 -0400 Received: from mail-pg1-x52f.google.com (mail-pg1-x52f.google.com [IPv6:2607:f8b0:4864:20::52f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2CFFC0613C1 for ; Tue, 24 Aug 2021 14:56:01 -0700 (PDT) Received: by mail-pg1-x52f.google.com with SMTP id n18so21126060pgm.12 for ; Tue, 24 Aug 2021 14:56:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0skVvO4SGPlA/J6kwOdnD9awH4QB9ReOisx8edtYBMQ=; b=td+p5L6oApTGIECN+ygfdkt+RZDjHSiqYQ90d7SsipgbdzrvwzlwsX9gKbnz170ozc VLmcKWqYLFsRiZ7d5lBcMcpU05xsqBHaj5BtzBQd6H4St7YTyOWoz9iIlfb8AvbkLeCW 1gNnuQo+3BcAU7zndpjjl8/92FDO8rVrHrULQuLDgjx0eMAf0jAvAForvOSFch4Jx0ak hdhEbuiQ57z3GbDl3KVmKKey9WFa0Mcfc61kOn7X5qhr1Kva3yrI14ChRzCIySRXwT4R DXSVDt4eG6CgSvmr3BHGYl+RUUV3FKAKOldIU9DmcNVJDs4+Jpxct0sg1vOLOvpMICcR J3WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0skVvO4SGPlA/J6kwOdnD9awH4QB9ReOisx8edtYBMQ=; b=PXygNnQxJ2J+K4tSzjbHXtHsAW6j9BJLTo2dJfk2L+J1Gcb5PHvVhHv6S6976WitKd /LvMkmELSuhaSEZhdLBpSsz5crUv/mQ1GdHnSpum5jqZjsOR3XVkbp3A2W6PdKJbQGlj vb/D4WzO7TwXdHiav2Z4l/A5ySC2D2F/lNbhBcgzRUBh7ABSUOcgFuAW3Wzc6zlNIqcq VSY43d50s9phWWBYHuZrEswxTGTxxaOtRNU/uW9aJ5Qh0Yz/hzBHxMHWFU2Hm37XtTko aL3EfgDIH3+DgGe/MgMK6hjMZmvtAnfygnug1R621SrDSXQ3E4kmfMenrrujx4nbmJnX +abQ== X-Gm-Message-State: AOAM533F+sn3vBARuZYViBgAbKmbr0fr9E/+/kIZuma0JGOuy+TJ1kq3 cKa1DqQpqhAhycNdbXHqXjoXS7lQtHNlSTFrsSCIsg== X-Google-Smtp-Source: ABdhPJy53qjYKOgleV9wHJ9ler14y20UTDnQwlr+oeS3RBFiHGiYWJ5VH+8aEVcyHLXvsrveMN4GeeU+tR1NWVcXvTU= X-Received: by 2002:a05:6a00:150d:b0:3e2:13fc:dd2b with SMTP id q13-20020a056a00150d00b003e213fcdd2bmr40939043pfu.71.1629842160839; Tue, 24 Aug 2021 14:56:00 -0700 (PDT) MIME-Version: 1.0 References: <20210824185541.GA3485816@bjorn-Precision-5520> In-Reply-To: <20210824185541.GA3485816@bjorn-Precision-5520> From: Rajat Jain Date: Tue, 24 Aug 2021 14:55:24 -0700 Message-ID: Subject: Re: [PATCH v4 11/15] pci: Add pci_iomap_shared{,_range} To: Bjorn Helgaas Cc: Andi Kleen , "Michael S. Tsirkin" , Dan Williams , "Kuppuswamy, Sathyanarayanan" , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Peter Zijlstra , Andy Lutomirski , Bjorn Helgaas , Richard Henderson , Thomas Bogendoerfer , James E J Bottomley , Helge Deller , "David S . Miller" , Arnd Bergmann , Jonathan Corbet , Peter H Anvin , Dave Hansen , Tony Luck , Kirill Shutemov , Sean Christopherson , Kuppuswamy Sathyanarayanan , X86 ML , Linux Kernel Mailing List , Linux PCI , linux-alpha@vger.kernel.org, linux-mips@vger.kernel.org, linux-parisc@vger.kernel.org, sparclinux@vger.kernel.org, linux-arch , Linux Doc Mailing List , virtualization@lists.linux-foundation.org Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org Thanks a lot Bjorn for adding me! On Tue, Aug 24, 2021 at 11:55 AM Bjorn Helgaas wrote: > > [+cc Rajat; I still don't know what "shared memory with a hypervisor > in a confidential guest" means, but now we're talking about hardened > drivers and allow lists, which Rajat is interested in] > > On Tue, Aug 24, 2021 at 10:20:44AM -0700, Andi Kleen wrote: > > > > > I see. Hmm. It's a bit of a random thing to do it at the map time > > > though. E.g. DMA is all handled transparently behind the DMA API. > > > Hardening is much more than just replacing map with map_shared > > > and I suspect what you will end up with is basically > > > vendors replacing map with map shared to make things work > > > for their users and washing their hands. > > > > That concept exists too. There is a separate allow list for the drivers. So > > just adding shared to a driver is not enough, until it's also added to the > > allowlist > > > > Users can of course chose to disable the allowlist, but they need to > > understand the security implications. This is great. I'd be interested in looking at this allowlist mechanism. Is this something in-kernel or in userspace? Is this available upstream or are you maintaining this allowlist elsewhere? (Background: https://lore.kernel.org/linux-pci/CACK8Z6E8pjVeC934oFgr=VB3pULx_GyT2NkzAogdRQJ9TKSX9A@mail.gmail.com/) Short Summary: we also have our security team that audits drivers, and we'd like to enable only audited drivers for the untrusted devices. Currently, we're carrying this allowlist mechanism on our own since the idea was Nack'ed by upstream. So if there is something available, we'd like to use it too. Thanks, Rajat > > > > > I would say an explicit flag in the driver that says "hardened" > > > and refusing to init a non hardened one would be better. > > > > We have that too (that's the device filtering) > > > > But the problem is that device filtering just stops the probe functions, not > > the initcalls, and lot of legacy drivers do MMIO interactions before going > > into probe. In some cases it's unavoidable because of the device doesn't > > have a separate enumeration mechanism it needs some kind of probing to even > > check for its existence And since we don't want to change all of them it's > > far safer to make the ioremap opt-in. > > > > > > -Andi > >