linux-kernel - Re: [PATCH v2 2/2] virtio: replace arch_has_restricted_virtio_memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 27 Apr 2022 20:36:25 +0200
From:   Juergen Gross <jgross@...e.com>
To:     "Michael Kelley (LINUX)" <mikelley@...rosoft.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        "linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "virtualization@...ts.linux-foundation.org" 
        <virtualization@...ts.linux-foundation.org>
Cc:     Arnd Bergmann <arnd@...db.de>, Heiko Carstens <hca@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>,
        Christoph Hellwig <hch@...radead.org>,
        Oleksandr Tyshchenko <olekstysh@...il.com>
Subject: Re: [PATCH v2 2/2] virtio: replace
 arch_has_restricted_virtio_memory_access()

On 27.04.22 18:30, Michael Kelley (LINUX) wrote:
> From: Juergen Gross <jgross@...e.com> Sent: Wednesday, April 27, 2022 8:34 AM
>>
>> Instead of using arch_has_restricted_virtio_memory_access() together
>> with CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS, replace those
>> with platform_has() and a new platform feature
>> PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS.
>>
>> Signed-off-by: Juergen Gross <jgross@...e.com>
>> ---
>> V2:
>> - move setting of PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS in SEV case
>>    to sev_setup_arch().
>> ---
>>   arch/s390/Kconfig                |  1 -
>>   arch/s390/mm/init.c              | 13 +++----------
>>   arch/x86/Kconfig                 |  1 -
>>   arch/x86/kernel/cpu/mshyperv.c   |  5 ++++-
>>   arch/x86/mm/mem_encrypt.c        |  6 ------
>>   arch/x86/mm/mem_encrypt_amd.c    |  4 ++++
>>   drivers/virtio/Kconfig           |  6 ------
>>   drivers/virtio/virtio.c          |  5 ++---
>>   include/linux/platform-feature.h |  3 ++-
>>   include/linux/virtio_config.h    |  9 ---------
>>   10 files changed, 15 insertions(+), 38 deletions(-)
>>
>> diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
>> index e084c72104f8..f97a22ae69a8 100644
>> --- a/arch/s390/Kconfig
>> +++ b/arch/s390/Kconfig
>> @@ -772,7 +772,6 @@ menu "Virtualization"
>>   config PROTECTED_VIRTUALIZATION_GUEST
>>   	def_bool n
>>   	prompt "Protected virtualization guest support"
>> -	select ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
>>   	help
>>   	  Select this option, if you want to be able to run this
>>   	  kernel as a protected virtualization KVM guest.
>> diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
>> index 86ffd0d51fd5..2c3b451813ed 100644
>> --- a/arch/s390/mm/init.c
>> +++ b/arch/s390/mm/init.c
>> @@ -31,6 +31,7 @@
>>   #include <linux/cma.h>
>>   #include <linux/gfp.h>
>>   #include <linux/dma-direct.h>
>> +#include <linux/platform-feature.h>
>>   #include <asm/processor.h>
>>   #include <linux/uaccess.h>
>>   #include <asm/pgalloc.h>
>> @@ -168,22 +169,14 @@ bool force_dma_unencrypted(struct device *dev)
>>   	return is_prot_virt_guest();
>>   }
>>
>> -#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
>> -
>> -int arch_has_restricted_virtio_memory_access(void)
>> -{
>> -	return is_prot_virt_guest();
>> -}
>> -EXPORT_SYMBOL(arch_has_restricted_virtio_memory_access);
>> -
>> -#endif
>> -
>>   /* protected virtualization */
>>   static void pv_init(void)
>>   {
>>   	if (!is_prot_virt_guest())
>>   		return;
>>
>> +	platform_set(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS);
>> +
>>   	/* make sure bounce buffers are shared */
>>   	swiotlb_force = SWIOTLB_FORCE;
>>   	swiotlb_init(1);
>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>> index b0142e01002e..20ac72546ae4 100644
>> --- a/arch/x86/Kconfig
>> +++ b/arch/x86/Kconfig
>> @@ -1515,7 +1515,6 @@ config X86_CPA_STATISTICS
>>   config X86_MEM_ENCRYPT
>>   	select ARCH_HAS_FORCE_DMA_UNENCRYPTED
>>   	select DYNAMIC_PHYSICAL_MASK
>> -	select ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
>>   	def_bool n
>>
>>   config AMD_MEM_ENCRYPT
>> diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
>> index 4b67094215bb..965518b9d14b 100644
>> --- a/arch/x86/kernel/cpu/mshyperv.c
>> +++ b/arch/x86/kernel/cpu/mshyperv.c
>> @@ -19,6 +19,7 @@
>>   #include <linux/i8253.h>
>>   #include <linux/random.h>
>>   #include <linux/swiotlb.h>
>> +#include <linux/platform-feature.h>
>>   #include <asm/processor.h>
>>   #include <asm/hypervisor.h>
>>   #include <asm/hyperv-tlfs.h>
>> @@ -347,8 +348,10 @@ static void __init ms_hyperv_init_platform(void)
>>   #endif
>>   		/* Isolation VMs are unenlightened SEV-based VMs, thus this check: */
>>   		if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
>> -			if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE)
>> +			if (hv_get_isolation_type() != HV_ISOLATION_TYPE_NONE) {
>>   				cc_set_vendor(CC_VENDOR_HYPERV);
>> +
>> 	platform_set(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS);
>> +			}
>>   		}
>>   	}
>>
> 
> Unless I'm misunderstanding something, the Hyper-V specific change isn't
> needed.   Hyper-V doesn't support virtio in the first place, so it's a bit
> unexpected be setting a virtio-related flag in Hyper-V code.   Also, Hyper-V
> guests call sev_setup_arch() with CC_ATTR_GUEST_MEM_ENCRYPT set,
> so this virtio-related flag will get set anyway via that path.

Okay, thanks. Will drop that chunk then.


Juergen

Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3099 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (496 bytes)