Michael S. Tsirkin
2021-Oct-28 05:40 UTC
[RFC] Add DMA_API support for Virtio devices earlier than VirtIO 1.0
On Wed, Oct 27, 2021 at 04:28:28PM -0700, Erdem Aktas wrote:> Enable DMA_API for any VirtIO device earlier than Virtio 1.0 which > is the only way for those devices to be configured correctly when > memory access is retricted. > > Virtio devices can use DMA_API to translate guest phsical addresses to > device physical addresses if VIRTIO_F_ACCESS_PLATFORM feature is set > while the device is being initialized. VIRTIO_F_ACCESS_PLATFORM > feature is only supported in VirtIO 1.0 and later devices. This prevents > any device using an earlier VirtIO version than Virtio 1.0 to be > attached when memory access is restricted ie memory encryption features > (AMD SEV [ES/SNP], Intel TDX, etc..) are enabled. > > Signed-off-by: Erdem Aktas <erdemaktas at google.com>Sorry .. NACK. Virtio before 1.0 is on life support. No new features. Just use 1.0 please.> --- > I have tested the this patch using linux-stable.git head, 5.15.0-rc6 > kernel and scsi disk with virtio 0.95 version with legacy VM and > Confidential VM (AMD SEV). I want to get feedback if > there is any risk or downside of enabling DMA_API on older virtio > drivers when memory encrytion is enabled. > > drivers/virtio/virtio.c | 7 ++----- > include/linux/virtio_config.h | 22 ++++++++++++++-------- > 2 files changed, 16 insertions(+), 13 deletions(-) > > diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c > index 236081afe9a2..71115ba85d07 100644 > --- a/drivers/virtio/virtio.c > +++ b/drivers/virtio/virtio.c > @@ -179,11 +179,8 @@ int virtio_finalize_features(struct virtio_device *dev) > if (ret) { > if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1)) { > dev_warn(&dev->dev, > - "device must provide VIRTIO_F_VERSION_1\n"); > - return -ENODEV; > - } > - > - if (!virtio_has_feature(dev, VIRTIO_F_ACCESS_PLATFORM)) { > + "device does not provide VIRTIO_F_VERSION_1 while restricted memory access is enabled!.\n"); > + } else if (!virtio_has_feature(dev, VIRTIO_F_ACCESS_PLATFORM)) { > dev_warn(&dev->dev, > "device must provide VIRTIO_F_ACCESS_PLATFORM\n"); > return -ENODEV; > diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h > index 8519b3ae5d52..6eacb4d43318 100644 > --- a/include/linux/virtio_config.h > +++ b/include/linux/virtio_config.h > @@ -170,6 +170,15 @@ static inline bool virtio_has_feature(const struct virtio_device *vdev, > return __virtio_test_bit(vdev, fbit); > } > > +#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS > +int arch_has_restricted_virtio_memory_access(void); > +#else > +static inline int arch_has_restricted_virtio_memory_access(void) > +{ > + return 0; > +} > +#endif /* CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS */ > + > /** > * virtio_has_dma_quirk - determine whether this device has the DMA quirk > * @vdev: the device > @@ -180,6 +189,11 @@ static inline bool virtio_has_dma_quirk(const struct virtio_device *vdev) > * Note the reverse polarity of the quirk feature (compared to most > * other features), this is for compatibility with legacy systems. > */ > + if (!virtio_has_feature(vdev, VIRTIO_F_VERSION_1) && > + arch_has_restricted_virtio_memory_access()) > + return false; > + > + > return !virtio_has_feature(vdev, VIRTIO_F_ACCESS_PLATFORM); > } > > @@ -558,13 +572,5 @@ static inline void virtio_cwrite64(struct virtio_device *vdev, > _r; \ > }) > > -#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS > -int arch_has_restricted_virtio_memory_access(void); > -#else > -static inline int arch_has_restricted_virtio_memory_access(void) > -{ > - return 0; > -} > -#endif /* CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS */ > > #endif /* _LINUX_VIRTIO_CONFIG_H */ > -- > 2.30.2