linux-kernel - Re: [PATCH v9 10/21] vfio/pci: introduce CONFIG_VFIO_PCI_ZDEV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Jun 2022 10:56:51 +0200
From:   Pierre Morel <pmorel@...ux.ibm.com>
To:     Matthew Rosato <mjrosato@...ux.ibm.com>,
        Thomas Huth <thuth@...hat.com>, linux-s390@...r.kernel.org
Cc:     alex.williamson@...hat.com, cohuck@...hat.com,
        schnelle@...ux.ibm.com, farman@...ux.ibm.com,
        borntraeger@...ux.ibm.com, hca@...ux.ibm.com, gor@...ux.ibm.com,
        gerald.schaefer@...ux.ibm.com, agordeev@...ux.ibm.com,
        svens@...ux.ibm.com, frankja@...ux.ibm.com, david@...hat.com,
        imbrenda@...ux.ibm.com, vneethv@...ux.ibm.com,
        oberpar@...ux.ibm.com, freude@...ux.ibm.com, pasic@...ux.ibm.com,
        pbonzini@...hat.com, corbet@....net, jgg@...dia.com,
        kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-doc@...r.kernel.org
Subject: Re: [PATCH v9 10/21] vfio/pci: introduce CONFIG_VFIO_PCI_ZDEV_KVM



On 6/8/22 15:15, Matthew Rosato wrote:
> On 6/8/22 2:19 AM, Thomas Huth wrote:
>> On 06/06/2022 22.33, Matthew Rosato wrote:
>>> The current contents of vfio-pci-zdev are today only useful in a KVM
>>> environment; let's tie everything currently under vfio-pci-zdev to
>>> this Kconfig statement and require KVM in this case, reducing complexity
>>> (e.g. symbol lookups).
>>>
>>> Signed-off-by: Matthew Rosato <mjrosato@...ux.ibm.com>

Reviewed-by: Pierre Morel <pmorel@...ux.ibm.com>


>>> ---
>>>   drivers/vfio/pci/Kconfig      | 11 +++++++++++
>>>   drivers/vfio/pci/Makefile     |  2 +-
>>>   include/linux/vfio_pci_core.h |  2 +-
>>>   3 files changed, 13 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/vfio/pci/Kconfig b/drivers/vfio/pci/Kconfig
>>> index 4da1914425e1..f9d0c908e738 100644
>>> --- a/drivers/vfio/pci/Kconfig
>>> +++ b/drivers/vfio/pci/Kconfig
>>> @@ -44,6 +44,17 @@ config VFIO_PCI_IGD
>>>         To enable Intel IGD assignment through vfio-pci, say Y.
>>>   endif
>>> +config VFIO_PCI_ZDEV_KVM
>>> +    bool "VFIO PCI extensions for s390x KVM passthrough"
>>> +    depends on S390 && KVM
>>> +    default y
>>> +    help
>>> +      Support s390x-specific extensions to enable support for 
>>> enhancements
>>> +      to KVM passthrough capabilities, such as interpretive 
>>> execution of
>>> +      zPCI instructions.
>>> +
>>> +      To enable s390x KVM vfio-pci extensions, say Y.
>>
>> Is it still possible to disable CONFIG_VFIO_PCI_ZDEV_KVM ? Looking at 
>> the later patches (e.g. 20/21 where you call kvm_s390_pci_zpci_op() 
>> from kvm-s390.c), it rather seems to me that it currently cannot be 
>> disabled independently (as long as KVM is enabled).
> 
> Yes, you can build with, for example, CONFIG_VFIO_PCI_ZDEV_KVM=n and 
> CONFIG_KVM=m -- I tested it again just now.  The result is kvm and 
> vfio-pci are built and vfio-pci works, but none of the vfio-pci-zdev 
> extensions are available (including zPCI interpretation).
> 
> This is accomplished via the placement of some IS_ENABLED checks.  Some 
> calls (e.g. AEN init) are fenced by 
> IS_ENABLED(CONFIG_VFIO_PCI_ZDEV_KVM).  There are also some areas that 
> are fenced off via a call to kvm_s390_pci_interp_allowed() which also 
> includes an IS_ENABLED check along with checks for facility and cpu id.
> 
> Using patch 20 as an example, KVM_CAP_S390_ZPCI_OP will always be 
> reported as unavailable to userspace if CONFIG_VFIO_PCI_ZDEV_KVM=n due 
> to the call to kvm_s390_pci_interp_allowed().  If userspace sends us the 
> ioctl anyway, we will return -EINVAL because there is again a 
> IS_ENABLED(CONFIG_VFIO_PCI_ZDEV_KVM) check before we read the ioctl args 
> from userspace.

Yes and the code will not be generated by the compiler in patch 20 after 
the break if CONFIG_VFIO_PCI_ZDEV_KVM is not enabled.

+	case KVM_S390_ZPCI_OP: {
+		struct kvm_s390_zpci_op args;
+
+		r = -EINVAL;
+		if (!IS_ENABLED(CONFIG_VFIO_PCI_ZDEV_KVM))
+			break;

Code not generated----v

+		if (copy_from_user(&args, argp, sizeof(args))) {
+			r = -EFAULT;
+			break;
+		}
+		r = kvm_s390_pci_zpci_op(kvm, &args);
+		break;

----------^

+	}
> 
>>
>> So if you want to make this selectable by the user, I think you have 
>> to put some more #ifdefs in the following patches.
>> But if this was not meant to be selectable by the user, I think it 
>> should not get a help text and rather be selected by the KVM switch in 
>> arch/s390/kvm/Kconfig instead of having a "default y".
>>
>>   Thomas
>>
> 

-- 
Pierre Morel
IBM Lab Boeblingen