Juergen Gross
2022-Apr-27 12:37 UTC
[PATCH 2/2] virtio: replace arch_has_restricted_virtio_memory_access()
On 27.04.22 14:28, Borislav Petkov wrote:> On Wed, Apr 27, 2022 at 08:37:31AM +0200, Juergen Gross wrote: >> On 26.04.22 19:35, Borislav Petkov wrote: >>> On Tue, Apr 26, 2022 at 03:40:21PM +0200, Juergen Gross wrote: >>>> /* protected virtualization */ >>>> static void pv_init(void) >>>> { >>>> if (!is_prot_virt_guest()) >>>> return; >>>> + platform_set_feature(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS); >>> >>> Kinda long-ish for my taste. I'll probably call it: >>> >>> platform_set() >>> >>> as it is implicit that it sets a feature bit. >> >> Okay, fine with me. >> >>> >>>> diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c >>>> index b43bc24d2bb6..6043ba6cd17d 100644 >>>> --- a/arch/x86/mm/mem_encrypt_identity.c >>>> +++ b/arch/x86/mm/mem_encrypt_identity.c >>>> @@ -40,6 +40,7 @@ >>>> #include <linux/mm.h> >>>> #include <linux/mem_encrypt.h> >>>> #include <linux/cc_platform.h> >>>> +#include <linux/platform-feature.h> >>>> #include <asm/setup.h> >>>> #include <asm/sections.h> >>>> @@ -566,6 +567,10 @@ void __init sme_enable(struct boot_params *bp) >>>> } else { >>>> /* SEV state cannot be controlled by a command line option */ >>>> sme_me_mask = me_mask; >>>> + >>>> + /* Set restricted memory access for virtio. */ >>>> + platform_set_feature(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS); >>> >>> Huh, what does that have to do with SME? >> >> I picked the function where sev_status is being set, as this seemed to be >> the correct place to set the feature bit. > > What I don't understand is what does restricted memory access have to do > with AMD SEV and how does play together with what you guys are trying to > do? > > The big picture pls.Ah, okay. For support of virtio with Xen we want to not only support the virtio devices like KVM, but use grants for letting the guest decide which pages are allowed to be mapped by the backend (dom0). Instead of physical guest addresses the guest will use grant-ids (plus offset). In order to be able to handle this at the basic virtio level instead of the single virtio device drivers, we need to use dedicated dma-ops. And those will be used by virtio only, if the "restricted virtio memory request" flag is set, which is used by SEV, too. In order to let virtio set this flag, we need a way to communicate to virtio that the running system is either a SEV guest or a Xen guest. HTH, Juergen -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_0xB0DE9DD628BF132F.asc Type: application/pgp-keys Size: 3098 bytes Desc: OpenPGP public key URL: <http://lists.linuxfoundation.org/pipermail/virtualization/attachments/20220427/1ffc7ba3/attachment.bin> -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature Type: application/pgp-signature Size: 495 bytes Desc: OpenPGP digital signature URL: <http://lists.linuxfoundation.org/pipermail/virtualization/attachments/20220427/1ffc7ba3/attachment.sig>
Tom Lendacky
2022-Apr-27 14:09 UTC
[PATCH 2/2] virtio: replace arch_has_restricted_virtio_memory_access()
On 4/27/22 07:37, Juergen Gross wrote:> On 27.04.22 14:28, Borislav Petkov wrote: >> On Wed, Apr 27, 2022 at 08:37:31AM +0200, Juergen Gross wrote: >>> On 26.04.22 19:35, Borislav Petkov wrote: >>>> On Tue, Apr 26, 2022 at 03:40:21PM +0200, Juergen Gross wrote: >>>>> ?? /* protected virtualization */ >>>>> ?? static void pv_init(void) >>>>> ?? { >>>>> ?????? if (!is_prot_virt_guest()) >>>>> ?????????? return; >>>>> +??? platform_set_feature(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS); >>>> >>>> Kinda long-ish for my taste. I'll probably call it: >>>> >>>> ????platform_set() >>>> >>>> as it is implicit that it sets a feature bit. >>> >>> Okay, fine with me. >>> >>>> >>>>> diff --git a/arch/x86/mm/mem_encrypt_identity.c >>>>> b/arch/x86/mm/mem_encrypt_identity.c >>>>> index b43bc24d2bb6..6043ba6cd17d 100644 >>>>> --- a/arch/x86/mm/mem_encrypt_identity.c >>>>> +++ b/arch/x86/mm/mem_encrypt_identity.c >>>>> @@ -40,6 +40,7 @@ >>>>> ?? #include <linux/mm.h> >>>>> ?? #include <linux/mem_encrypt.h> >>>>> ?? #include <linux/cc_platform.h> >>>>> +#include <linux/platform-feature.h> >>>>> ?? #include <asm/setup.h> >>>>> ?? #include <asm/sections.h> >>>>> @@ -566,6 +567,10 @@ void __init sme_enable(struct boot_params *bp) >>>>> ?????? } else { >>>>> ?????????? /* SEV state cannot be controlled by a command line option */ >>>>> ?????????? sme_me_mask = me_mask; >>>>> + >>>>> +??????? /* Set restricted memory access for virtio. */ >>>>> +??????? platform_set_feature(PLATFORM_VIRTIO_RESTRICTED_MEM_ACCESS);This is way early in the boot, but it appears that marking the platform feature bitmap as __read_mostly puts this in the .data section, so avoids the issue of bss being cleared. TDX support also uses the arch_has_restricted_virtio_memory_access() function and will need to be updated. Seems like a lot of changes, I just wonder if the the arch_has...() function couldn't be updated to also include a Xen check? Thanks, Tom>>>> >>>> Huh, what does that have to do with SME? >>> >>> I picked the function where sev_status is being set, as this seemed to be >>> the correct place to set the feature bit. >> >> What I don't understand is what does restricted memory access have to do >> with AMD SEV and how does play together with what you guys are trying to >> do? >> >> The big picture pls. > > Ah, okay. > > For support of virtio with Xen we want to not only support the virtio > devices like KVM, but use grants for letting the guest decide which > pages are allowed to be mapped by the backend (dom0). > > Instead of physical guest addresses the guest will use grant-ids (plus > offset). In order to be able to handle this at the basic virtio level > instead of the single virtio device drivers, we need to use dedicated > dma-ops. And those will be used by virtio only, if the "restricted > virtio memory request" flag is set, which is used by SEV, too. In order > to let virtio set this flag, we need a way to communicate to virtio > that the running system is either a SEV guest or a Xen guest. > > HTH, > > > Juergen