linux-kernel - Re: [PATCH -next] memregion: Add arch_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 7 Sep 2022 10:24:14 -0700
From:   Davidlohr Bueso <dave@...olabs.net>
To:     Dan Williams <dan.j.williams@...el.com>
Cc:     Borislav Petkov <bp@...en8.de>, x86@...nel.org,
        nvdimm@...ts.linux.dev, linux-cxl@...r.kernel.org,
        peterz@...radead.org, akpm@...ux-foundation.org,
        dave.jiang@...el.com, Jonathan.Cameron@...wei.com,
        vishal.l.verma@...el.com, ira.weiny@...el.com,
        a.manzanares@...sung.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH -next] memregion: Add arch_flush_memregion() interface

On Wed, 07 Sep 2022, Dan Williams wrote:

>Davidlohr Bueso wrote:
>> On Wed, 07 Sep 2022, Borislav Petkov wrote:
>>
>> >On Mon, Aug 29, 2022 at 02:29:18PM -0700, Davidlohr Bueso wrote:
>> >> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
>> >> index 1abd5438f126..18463cb704fb 100644
>> >> --- a/arch/x86/mm/pat/set_memory.c
>> >> +++ b/arch/x86/mm/pat/set_memory.c
>> >> @@ -330,6 +330,20 @@ void arch_invalidate_pmem(void *addr, size_t size)
>> >>  EXPORT_SYMBOL_GPL(arch_invalidate_pmem);
>> >>  #endif
>> >>
>> >> +#ifdef CONFIG_ARCH_HAS_MEMREGION_INVALIDATE
>> >> +bool arch_has_flush_memregion(void)
>> >> +{
>> >> +	return !cpu_feature_enabled(X86_FEATURE_HYPERVISOR);
>> >
>> >This looks really weird. Why does this need to care about HV at all?
>>
>> So the context here is:
>>
>> e2efb6359e62 ("ACPICA: Avoid cache flush inside virtual machines")
>>
>> >
>> >Does that nfit stuff even run in guests?
>>
>> No, nor does cxl. This was mostly in general a precautionary check such
>> that the api is unavailable in VMs.
>
>To be clear nfit stuff and CXL does run in guests, but they do not
>support secure-erase in a guest.

Yes, I meant the feats this api enables.

>However, the QEMU CXL enabling is building the ability to do *guest
>physical* address space management, but in that case the driver can be
>paravirtualized to realize that it is not managing host-physical address
>space and does not need to flush caches. That will need some indicator
>to differentiate virtual CXL memory expanders from assigned devices. Is
>there such a thing as a PCIe-virtio extended capability to differentiate
>physical vs emulated devices?

In any case such check would be specific to each user (cxl in this case),
and outside the scope of _this_ particular api. Here we just really want to
avoid the broken TDX guest bits.

Thanks,
Davidlohr