linux-kernel - Re: [PATCH v15 08/23] x86/virt/tdx: Use all system memory when initializing TDX module as TDX memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <62539c75-8f4e-4e12-bcb4-55c46cdf646d@suse.com>
Date: Thu, 5 Dec 2024 11:06:17 +0200
From: Nikolay Borisov <nik.borisov@...e.com>
To: Mike Rapoport <rppt@...nel.org>, Kai Huang <kai.huang@...el.com>
Cc: linux-kernel@...r.kernel.org, kvm@...r.kernel.org, x86@...nel.org,
 dave.hansen@...el.com, kirill.shutemov@...ux.intel.com,
 peterz@...radead.org, tony.luck@...el.com, tglx@...utronix.de, bp@...en8.de,
 mingo@...hat.com, hpa@...or.com, seanjc@...gle.com, pbonzini@...hat.com,
 rafael@...nel.org, david@...hat.com, dan.j.williams@...el.com,
 len.brown@...el.com, ak@...ux.intel.com, isaku.yamahata@...el.com,
 ying.huang@...el.com, chao.gao@...el.com,
 sathyanarayanan.kuppuswamy@...ux.intel.com, bagasdotme@...il.com,
 sagis@...gle.com, imammedo@...hat.com
Subject: Re: [PATCH v15 08/23] x86/virt/tdx: Use all system memory when
 initializing TDX module as TDX memory



On 5.12.24 г. 9:57 ч., Mike Rapoport wrote:
> Hi,
> 
> I've been auditing for_each_mem_pfn_range() users and it's usage in TDX is
> dubious for me.
> 
> On Fri, Nov 10, 2023 at 12:55:45AM +1300, Kai Huang wrote:
>>
>> As TDX-usable memory is a fixed configuration, take a snapshot of the
>> memory configuration from memblocks at the time of module initialization
>> (memblocks are modified on memory hotplug).  This snapshot is used to
> 
> AFAUI this could happen long after free_initmem() which discards all
> memblock data on x86.
 > >> enable TDX support for *this* memory configuration only.  Use a memory
>> hotplug notifier to ensure that no other RAM can be added outside of
>> this configuration.
>   
> ...
> 
>> +/*
>> + * Ensure that all memblock memory regions are convertible to TDX
>> + * memory.  Once this has been established, stash the memblock
>> + * ranges off in a secondary structure because memblock is modified
>> + * in memory hotplug while TDX memory regions are fixed.
>> + */
>> +static int build_tdx_memlist(struct list_head *tmb_list)
>> +{
>> +	unsigned long start_pfn, end_pfn;
>> +	int i, ret;
>> +
>> +	for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn, NULL) {
> 
> Unles ARCH_KEEP_MEMBLOCK is defined this won't work after free_initmem()

TDX_HOST actually selects ARCH_KEEP_MEMBLOCK:

   6 config INTEL_TDX_HOST 

    5         bool "Intel Trust Domain Extensions (TDX) host support" 

    4         depends on CPU_SUP_INTEL 

    3         depends on X86_64 

    2         depends on KVM_INTEL 

    1         depends on X86_X2APIC 

1980         select ARCH_KEEP_MEMBLOCK 

    1         depends on CONTIG_ALLOC 

    2         depends on !KEXEC_CORE 

    3         depends on X86_MCE


<snip>