From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E0CEC433FE for ; Thu, 3 Nov 2022 15:05:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AD97E6B0072; Thu, 3 Nov 2022 11:05:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A89256B0073; Thu, 3 Nov 2022 11:05:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9A00C6B0074; Thu, 3 Nov 2022 11:05:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 906EF6B0072 for ; Thu, 3 Nov 2022 11:05:19 -0400 (EDT) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 6E130120557 for ; Thu, 3 Nov 2022 15:05:19 +0000 (UTC) X-FDA: 80092454358.08.7F0A8FF Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by imf22.hostedemail.com (Postfix) with ESMTP id C5DD9C0012 for ; Thu, 3 Nov 2022 15:05:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1667487918; x=1699023918; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=g/Nc9Oh47t3xrBMy8uQ8PnTTBtTpjf2qN+cuKgODC74=; b=TnT0Xxr0FGBz42hYqscMaDwzzkLx1FtugJ5a+VjoO/NHoVKLg05EqgLA Tsx1OyYgMRRvSR5rmCbV9KiAU2DN0oTeeL+9rKIvPT3Jn0HpAIuk4plVl 90Tl8dwhaxtUa1UaXk/qTcHS5dTWD9G+62DVRrAH/3aulknYjWbjMbhqj flNDTfspBU2sQgJL86G5soFF6OJe5M4MEtbPiUyizbqQC83ib/1HrUJ2H N4sqZ0cqBRCGxCQMAVB5Cvo1CHtYdn1QV6Qpd4vKLX2UWd4JhxxXsRGwH 5JH3fHXIqSf52G3FjugKwbRNyDvweyoD8uTz467KPcTbfOzz9zp9h1DvS w==; X-IronPort-AV: E=McAfee;i="6500,9779,10520"; a="311442147" X-IronPort-AV: E=Sophos;i="5.96,235,1665471600"; d="scan'208";a="311442147" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Nov 2022 08:05:17 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10520"; a="585825682" X-IronPort-AV: E=Sophos;i="5.96,235,1665471600"; d="scan'208";a="585825682" Received: from btoolex-mobl.amr.corp.intel.com (HELO [10.209.95.24]) ([10.209.95.24]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Nov 2022 08:05:15 -0700 Message-ID: Date: Thu, 3 Nov 2022 08:05:14 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2 Subject: Re: [PATCH v6 12/21] x86/virt/tdx: Add placeholder to construct TDMRs to cover all TDX memory regions Content-Language: en-US To: Andi Kleen , Kai Huang , linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: linux-mm@kvack.org, seanjc@google.com, pbonzini@redhat.com, dan.j.williams@intel.com, rafael.j.wysocki@intel.com, kirill.shutemov@linux.intel.com, reinette.chatre@intel.com, len.brown@intel.com, tony.luck@intel.com, peterz@infradead.org, isaku.yamahata@intel.com, chao.gao@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com, bagasdotme@gmail.com, sagis@google.com, imammedo@redhat.com References: From: Dave Hansen In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1667487919; a=rsa-sha256; cv=none; b=YHRRC9gI8EG43+4+A4RkAz3zbTG014LotITMLpqsqJfeqo1Xzqk2ls8rFW9+r1o6FBIIKb mgLHmnmzgQHU+zNm/wYY6R8ec+mcbj74YH0A21Us74HYqmIz+p4fviaXVGWZmloQWFBxMn +jllhyYd3e/d7+KPX55GyWAAUIFHac0= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=TnT0Xxr0; spf=pass (imf22.hostedemail.com: domain of dave.hansen@intel.com designates 134.134.136.65 as permitted sender) smtp.mailfrom=dave.hansen@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1667487919; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=qmId2aoL+w/oxJPo0Hlj9FZKIznWqCpt/W1PB32P3tc=; b=P+pg/Fbw+J0rLXVv54hFxZdTn5qCrrmm0pwJ7glsoPNqGKM4820MGfWJKnArTRJU9fJdch EUP2YyoAt4/l5wPC2lVLiZr9g2ofkryE+nrMXXDQyYcKtJR/FTpyE7hPHvmJ3IDmIkb8EL m6fd9q2M6Z7Xche6kLAugZ22RPMeT/4= X-Stat-Signature: o5k7xjmu7fyngnbc49arwdq1qcn1rcjd X-Rspamd-Server: rspam09 X-Rspam-User: X-Rspamd-Queue-Id: C5DD9C0012 Authentication-Results: imf22.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=TnT0Xxr0; spf=pass (imf22.hostedemail.com: domain of dave.hansen@intel.com designates 134.134.136.65 as permitted sender) smtp.mailfrom=dave.hansen@intel.com; dmarc=pass (policy=none) header.from=intel.com X-HE-Tag: 1667487918-451010 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000119, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 10/27/22 08:31, Andi Kleen wrote: > >> +/* Calculate the actual TDMR_INFO size */ >> +static inline int cal_tdmr_size(void) >> +{ >> +    int tdmr_sz; >> + >> +    /* >> +     * The actual size of TDMR_INFO depends on the maximum number >> +     * of reserved areas. >> +     */ >> +    tdmr_sz = sizeof(struct tdmr_info); >> +    tdmr_sz += sizeof(struct tdmr_reserved_area) * >> +           tdx_sysinfo.max_reserved_per_tdmr; > > would seem safer to have a overflow check here. tdmr_reserved_area is 16 bytes. To overflow a signed int, tdmr_sz would need to be for an allocation >2GB. alloc_pages_exact() tops out at supplying 4MB allocations. So, sure, this breaks at max_reserved_per_tdmr>2^27, but it actually breaks *EARLIER* at max_reserved_per_tdmr>2^18 because the page allocator is borked. Plus, max_reserved_per_tdmr is barely in double digits today. It's a *LOOOOOOOOONG* way from either of those limits. If you want to add a warning here, then go for it and enforce a sane value on max_reserved_per_tdmr. But, the overflow is *LITERALLY* an order of magnitude more obscure than overwhelming the page allocator. Let's not clutter up the code with silly checks like that.