linux-kernel - Re: [PATCH -next] memregion: Add arch_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6319916ba0f9d_5801629437@dwillia2-xfh.jf.intel.com.notmuch>
Date:   Wed, 7 Sep 2022 23:53:31 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     Borislav Petkov <bp@...en8.de>,
        Dan Williams <dan.j.williams@...el.com>
CC:     Davidlohr Bueso <dave@...olabs.net>, <x86@...nel.org>,
        <nvdimm@...ts.linux.dev>, <linux-cxl@...r.kernel.org>,
        <peterz@...radead.org>, <akpm@...ux-foundation.org>,
        <dave.jiang@...el.com>, <Jonathan.Cameron@...wei.com>,
        <vishal.l.verma@...el.com>, <ira.weiny@...el.com>,
        <a.manzanares@...sung.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH -next] memregion: Add arch_flush_memregion() interface

Borislav Petkov wrote:
> On Wed, Sep 07, 2022 at 09:52:17AM -0700, Dan Williams wrote:
> > To be clear nfit stuff and CXL does run in guests, but they do not
> > support secure-erase in a guest.
> > 
> > However, the QEMU CXL enabling is building the ability to do *guest
> > physical* address space management, but in that case the driver can be
> > paravirtualized to realize that it is not managing host-physical address
> > space and does not need to flush caches. That will need some indicator
> > to differentiate virtual CXL memory expanders from assigned devices.
> 
> Sounds to me like that check should be improved later to ask
> whether the kernel is managing host-physical address space, maybe
> arch_flush_memregion() should check whether the address it is supposed
> to flush is host-physical and exit early if not...

Even though I raised the possibility of guest passthrough of a CXL
memory expander, I do not think it could work in practice without it
being a gigantic security nightmare. So it is probably safe to just do
the hypervisor check and assume that there's no such thing as guest
management of host physical address space.