From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.200 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793168197; b=qwvZ65DRCG1OZWhZmv48GJP0+Xt2oyazDXkWVRTgAcSddPMPwDfBrwAJGpHQ8uxU+lAN RTmT5ZmlgBnbqiZwshzxLfKf4K17Ah3nqvvi8pjukP/oWBRoI5viDjdMZvj4HR+Q/9uYG Le+nEmVj4oYW2u6+/Zq0EWUXqWXExcL03SKHEEe1PSXYF/+J/8OlzNgoGHABHrtK+hGJv vTFtrHAMuf7HX9XJ9tqHZp5PnTncETLd2uTPDVTB15HJjN+aTM7Aka3J1pqizGGauKlkT exUFDf1gYZBzpRNdXxsNToEuYvaBIGpv2VvlP8CxtjeV75U4rNqA9nE6fjN2PDDsx7Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793168197; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:MIME-Version:X-Received: In-Reply-To:References:Message-ID:Date:Subject:From:To:Cc: Content-Type; bh=X4wg8Pbjg2SQve6wgEy6XvKbvCoQemBjrt/2F9Kq2TY=; b=Fxz3pkb9L8AsoJ6Ay96MlPTamNZlU1ONqrB6l++V3lPvAG1MWpDu1cFgcC8d4LjnuPJc 3e+2hRwyrQOZCzDBFqytS3ELRTBRe2SMzcz0FIIBCOelyBM3HFaJLdMOLSP9xjSYfo8mj zx6/xjbLGRw2VeFmd8ES+j8GTIExYyudp4DK2p5p/xNAEAubU0AZZaiYoqaqgBAPfENq4 E0VnHzQHwUlOTHTJVCy3pg7MqdUOhCyRNberQ1Bgi3qsmdKqz41SPqeW0LSWD6CpMUYfm gAmLaX8wby903wkdSEnCyrR27N7VlgfDh4UK6LJKxcIN6mj1TM7MaLta2LHKQ5aGvpA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--jeffxu.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=C6Pudu23; arc=none smtp.remote-ip=74.125.82.200 Received: from mail-dy1-f200.google.com (mail-dy1-f200.google.com [74.125.82.200]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74600606A324 for ; Wed, 28 Oct 2026 06:16:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 74600606A324 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jeffxu.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=C6Pudu23 Received: by mail-dy1-f200.google.com with SMTP id 5a478bee46e88-359b81ad4e8so843919eec.0 for ; Tue, 27 Oct 2026 23:16:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1793168196; x=1793772996; darn=vger.kernel.org; h=content-type:cc:to:from:subject:date:message-id:references :in-reply-to:mime-version:from:to:cc:subject:date:message-id :reply-to:content-type; bh=X4wg8Pbjg2SQve6wgEy6XvKbvCoQemBjrt/2F9Kq2TY=; b=C6Pudu23merR8N3QUSSvCl7wNv2iJ4wZUywbEvQhTfxkkwUD1bmyJMvQ2INlo/bCI7 3J2m8hD96wmYaDz2HNVTnKY7bDC8tFyaNdiOM1QFSV5826GR/S9EbVVncFbiq7dSSy2t w24/QFazfb8wG5dHVpT8H928MituPMKXEXB8snmifr3Gc2O/tC3crUaeuJw9TS9d5Gvn r5pkfFwogZZk3Efst5f17eYYlK22KsZS0vTvX+rFSthgeT4zRTnDzcMhm7e0c3Erq6Sh bhACPNNEje+m79G8yP5AhOuwbfhrViJl3Ag1sVFrnaEc56uj8+6SQualB4meyXj8OWeW 6OeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793168196; x=1793772996; h=content-type:cc:to:from:subject:date:message-id:references :in-reply-to:mime-version:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=X4wg8Pbjg2SQve6wgEy6XvKbvCoQemBjrt/2F9Kq2TY=; b=1Bk3L4umSUarwvNC5ySpCOgeaTMYKCjm3OoKDdvorBd3ljODZIThbYT7GafgSD8EaX RvhDUMrlx70jc0xruwG7gFpWQZXw569fOoB6RC4NK6u8+yvGJ6NV+cZbBypOgpGTLrZ2 Hbad4jGZJi4Zji+aI8d/FHqDL17AGeOtG1TNSe+3ooXM5adqTrOS2SY3aMvYYKTtu7Ia u1CKEjmLFC29aNqWvW2JiwuODdNUNwYuodivBqNcjz/qgIvoovTcDZx6GB8t+VsfU8Gu M3IOQv2NpZktaXYbwCRvlpmxxcpFPqKEkXJ7q5M4LRP6D1Wm6Rb+/bMMMkC0IAgZ6Vdv jJhg== X-Forwarded-Encrypted: i=1; AKwUvBwRaTRzWGKPTpSRU0LJQq/0KhhviWFOfOP1ICQzgumOoi/GPZv8OEdUsDz3xZbEcqA/0BtrJwuZo15im9o=@vger.kernel.org X-Gm-Message-State: AFq9FYLMtwhKu3NwTJyuBrRlvE8gjGZ/Fo5T8B1im3Jg/ot+mF3lLDhy 8v1bzdkkGRK3ytGjSXWT21ILubupszt9EC8FxhReSaCt6YD1DLVTak4qCmT//rV8ZsgJ6L/WEjr AgagZOQ== X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Received: from dyx13.prod.google.com ([2002:a05:693c:820d:b0:36a:1d37:273b]) (user=jeffxu job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7301:6195:10b0:35d:95e4:267d with SMTP id 5a478bee46e88-36a200c3b89mr2179969eec.27.1793168196147; Tue, 27 Oct 2026 23:16:36 -0700 (PDT) In-Reply-To: References: <5bd3c89d733ad22224f296dfa8900769de937de0.1793094611.git.chris@chrisdown.name> <18e2972cb8520c2e.3137322e32382e342e3434.279dd1.0000sendgmr@google.com> Message-ID: <18e29cf9499c7ec0.3137322e32382e342e3434.2a28ab.0000sendgmr@google.com> Date: Wed, 28 Oct 2026 06:16:36 +0000 Subject: Re: [PATCH 1/3] mseal sysmap: Add mseal_system_mappings= boot parameter From: Jeff Xu To: Chris Down Cc: "Lorenzo Stoakes (ARM)" , Andrew Morton , "Liam R. Howlett" , Vlastimil Babka , Jann Horn , Pedro Falcato , David Hildenbrand , Kees Cook , Jeff Xu , Jeff Xu , Andrey Vagin , Alexander Mikhalitsyn , Paul Moore , James Morris , "Serge E. Hallyn" , Shuah Khan , Jonathan Corbet , linux-mm@kvack.org, linux-hardening@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes Hi Chris, On Wed, Oct 28, 2026 at 01:55:40PM +0800, Chris Down wrote: > Chris Down writes: > > - Have check_sealed skip as usual when [vdso] isn't sealed and param > > is not set > > - A new test, say expect_sealed, fails in the same case > > - run_vmtests runs with -T expect_sealed when > > CONFIG_MSEAL_SYSTEM_MAPPINGS=y > Er, the other way around. I meant vm_runtests passes -T expect_sealed > _unless_ CONFIG_MSEAL_SYSTEM_MAPPINGS=y. Using kselftest_harness's `-T expect_sealed` together with checking `/proc/cmdline` for `no_mseal_sys_mappings` in `check_sealed` sounds great to me -- very clean and covers both regression cases without extra argument parsing. Thanks! Jeff