| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <3d85dccb-7a22-1701-5717-8efd08b7a50c@suse.com>
Date: Wed, 27 Apr 2022 20:36:25 +0200
From: Juergen Gross <jgross@...e.com>
To: "Michael Kelley (LINUX)" <mikelley@...rosoft.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>,
"x86@...nel.org" <x86@...nel.org>,
"linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
"linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
"virtualization@...ts.linux-foundation.org"
<virtualization@...ts.linux-foundation.org>
Cc: Arnd Bergmann <arnd@...db.de>, Heiko Carstens <hca@...ux.ibm.com>,
Vasily Gorbik <gor@...ux.ibm.com>,
Alexander Gordeev <agordeev@...ux.ibm.com>,
Christian Borntraeger <borntraeger@...ux.ibm.com>,
Sven Schnelle <svens@...ux.ibm.com>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>,
"H. Peter Anvin" <hpa@...or.com>,
KY Srinivasan <kys@...rosoft.com>,
Haiyang Zhang <haiyangz@...rosoft.com>,
Stephen Hemminger <sthemmin@...rosoft.com>,
Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>,
Andy Lutomirski <luto@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
"Michael S. Tsirkin" <mst@...hat.com>,
Jason Wang <jasowang@...hat.com>,
Christoph Hellwig <hch@...radead.org>,
Oleksandr Tyshchenko <olekstysh@...il.com>
Subject: Re: [PATCH v2 2/2] virtio: replace
arch_has_restricted_virtio_memory_access()
On 27.04.22 18:30, Michael Kelley (LINUX) wrote:
> From: Juergen Gross <jgross@...e.com> Sent: Wednesday, April 27, 2022 8:34 AM
>>
>> Instead of using arch_has_restricted_virtio_memory_access() together
>> with CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS, replace those
>> with platform_has() and a new platform feature
>> PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS.
>>
>> Signed-off-by: Juergen Gross <jgross@...e.com>
>> ---
>> V2:
>> - move setting of PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS in SEV case
>> to sev_setup_arch().
>> ---
>> arch/s390/Kconfig | 1 -
>> arch/s390/mm/init.c | 13 +++----------
>> arch/x86/Kconfig | 1 -
>> arch/x86/kernel/cpu/mshyperv.c | 5 ++++-
>> arch/x86/mm/mem_encrypt.c | 6 ------
>> arch/x86/mm/mem_encrypt_amd.c | 4 ++++
>> drivers/virtio/Kconfig | 6 ------
>> drivers/virtio/virtio.c | 5 ++---
>> include/linux/platform-feature.h | 3 ++-
>> include/linux/virtio_config.h | 9 ---------
>> 10 files changed, 15 insertions(+), 38 deletions(-)
>>
>> diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
>> index e084c72104f8..f97a22ae69a8 100644
>> --- a/arch/s390/Kconfig
>> +++ b/arch/s390/Kconfig
>> @@ -772,7 +772,6 @@ menu "Virtualization"
>> config PROTECTED_VIRTUALIZATION_GUEST
>> def_bool n
>> prompt "Protected virtualization guest support"
>> - select ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
>> help
>> Select this option, if you want to be able to run this
>> kernel as a protected virtualization KVM guest.
>> diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
>> index 86ffd0d51fd5..2c3b451813ed 100644
>> --- a/arch/s390/mm/init.c
>> +++ b/arch/s390/mm/init.c
>> @@ -31,6 +31,7 @@
>> #include <linux/cma.h>
>> #include <linux/gfp.h>
>> #include <linux/dma-direct.h>
>> +#include <linux/platform-feature.h>
>> #include <asm/processor.h>
>> #include <linux/uaccess.h>
>> #include <asm/pgalloc.h>
>> @@ -168,22 +169,14 @@ bool force_dma_unencrypted(struct device *dev)
>> return is_prot_virt_guest();
>> }
>>
>> -#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
>> -
>> -int arch_has_restricted_virtio_memory_access(void)
>> -{
>> - return is_prot_virt_guest();
>> -}
>> -EXPORT_SYMBOL(arch_has_restricted_virtio_memory_access);
>> -
>> -#endif
>> -
>> /* protected virtualization */
>> static void pv_init(void)
>> {
>> if (!is_prot_virt_guest())
>> return;
>>
>> + platform_set(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS);
>> +
>> /* make sure bounce buffers are shared */
>> swiotlb_force = SWIOTLB_FORCE;
>> swiotlb_init(1);
>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>> index b0142e01002e..20ac72546ae4 100644
>> --- a/arch/x86/Kconfig
>> +++ b/arch/x86/Kconfig
>> @@ -1515,7 +1515,6 @@ config X86_CPA_STATISTICS
>> config X86_MEM_ENCRYPT
>> select ARCH_HAS_FORCE_DMA_UNENCRYPTED
>> select DYNAMIC_PHYSICAL_MASK
>> - select ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
>> def_bool n
>>
>> config AMD_MEM_ENCRYPT
>> diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
>> index 4b67094215bb..965518b9d14b 100644
>> --- a/arch/x86/kernel/cpu/mshyperv.c
>> +++ b/arch/x86/kernel/cpu/mshyperv.c
>> @@ -19,6 +19,7 @@
>> #include <linux/i8253.h>
>> #include <linux/random.h>
>> #include <linux/swiotlb.h>
>> +#include <linux/platform-feature.h>
>> #include <asm/processor.h>
>> #include <asm/hypervisor.h>
>> #include <asm/hyperv-tlfs.h>
>> @@ -347,8 +348,10 @@ static void __init ms_hyperv_init_platform(void)
>> #endif
>> /* Isolation VMs are unenlightened SEV-based VMs, thus this check: */
>> if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
>> - if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE)
>> + if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE) {
>> cc_set_vendor(CC_VENDOR_HYPERV);
>> +
>> platform_set(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS);
>> + }
>> }
>> }
>>
>
> Unless I'm misunderstanding something, the Hyper-V specific change isn't
> needed. Hyper-V doesn't support virtio in the first place, so it's a bit
> unexpected be setting a virtio-related flag in Hyper-V code. Also, Hyper-V
> guests call sev_setup_arch() with CC_ATTR_GUEST_MEM_ENCRYPT set,
> so this virtio-related flag will get set anyway via that path.
Okay, thanks. Will drop that chunk then.
Juergen
Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3099 bytes)
Download attachment "OpenPGP_signature" of type "application/pgp-signature" (496 bytes)
Powered by blists - more mailing lists