similar to: [PATCH] s390: protvirt: virtio: Refuse device without IOMMU

On 2020-06-11 05:10, Jason Wang wrote: > > On 2020/6/10 ??9:11, Pierre Morel wrote: >> Protected Virtualisation protects the memory of the guest and >> do not allow a the host to access all of its memory. >> >> Let's refuse a VIRTIO device which does not use IOMMU >> protected access. >> >> Signed-off-by: Pierre Morel <pmorel at

On 2020-06-11 05:10, Jason Wang wrote: > > On 2020/6/10 ??9:11, Pierre Morel wrote: >> Protected Virtualisation protects the memory of the guest and >> do not allow a the host to access all of its memory. >> >> Let's refuse a VIRTIO device which does not use IOMMU >> protected access. >> >> Signed-off-by: Pierre Morel <pmorel at

On 2020-06-10 15:24, Cornelia Huck wrote: > On Wed, 10 Jun 2020 15:11:51 +0200 > Pierre Morel <pmorel at linux.ibm.com> wrote: > >> Protected Virtualisation protects the memory of the guest and >> do not allow a the host to access all of its memory. >> >> Let's refuse a VIRTIO device which does not use IOMMU >> protected access. >> >>

On 2020-06-10 15:24, Cornelia Huck wrote: > On Wed, 10 Jun 2020 15:11:51 +0200 > Pierre Morel <pmorel at linux.ibm.com> wrote: > >> Protected Virtualisation protects the memory of the guest and >> do not allow a the host to access all of its memory. >> >> Let's refuse a VIRTIO device which does not use IOMMU >> protected access. >> >>

On 2020/6/12 ??7:38, Pierre Morel wrote: > > > On 2020-06-12 11:21, Pierre Morel wrote: >> >> >> On 2020-06-11 05:10, Jason Wang wrote: >>> >>> On 2020/6/10 ??9:11, Pierre Morel wrote: >>>> Protected Virtualisation protects the memory of the guest and >>>> do not allow a the host to access all of its memory. >>>>

On 2020/6/12 ??7:38, Pierre Morel wrote: > > > On 2020-06-12 11:21, Pierre Morel wrote: >> >> >> On 2020-06-11 05:10, Jason Wang wrote: >>> >>> On 2020/6/10 ??9:11, Pierre Morel wrote: >>>> Protected Virtualisation protects the memory of the guest and >>>> do not allow a the host to access all of its memory. >>>>

On Wed, 10 Jun 2020 15:11:51 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > Protected Virtualisation protects the memory of the guest and > do not allow a the host to access all of its memory. > > Let's refuse a VIRTIO device which does not use IOMMU > protected access. > > Signed-off-by: Pierre Morel <pmorel at linux.ibm.com> > --- >

On 2020/6/10 ??9:11, Pierre Morel wrote: > Protected Virtualisation protects the memory of the guest and > do not allow a the host to access all of its memory. > > Let's refuse a VIRTIO device which does not use IOMMU > protected access. > > Signed-off-by: Pierre Morel <pmorel at linux.ibm.com> > --- > drivers/s390/virtio/virtio_ccw.c | 5 +++++ > 1 file

On 2020-06-12 11:21, Pierre Morel wrote: > > > On 2020-06-11 05:10, Jason Wang wrote: >> >> On 2020/6/10 ??9:11, Pierre Morel wrote: >>> Protected Virtualisation protects the memory of the guest and >>> do not allow a the host to access all of its memory. >>> >>> Let's refuse a VIRTIO device which does not use IOMMU >>>

On Wed, 10 Jun 2020 16:37:55 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > On 2020-06-10 15:24, Cornelia Huck wrote: > > On Wed, 10 Jun 2020 15:11:51 +0200 > > Pierre Morel <pmorel at linux.ibm.com> wrote: > > > >> Protected Virtualisation protects the memory of the guest and > >> do not allow a the host to access all of its memory.

Michael, the following patches have all been posted in the past. I've collected them on top of your vhost branch -- please let me know whether this works for you. The following changes since commit 6bdf1e0efb04a1716373646cb6f35b73addca492: Makefile: drop -D__CHECK_ENDIAN__ from cflags (2016-12-16 00:13:43 +0200) are available in the git repository at:

Michael, the following patches have all been posted in the past. I've collected them on top of your vhost branch -- please let me know whether this works for you. The following changes since commit 6bdf1e0efb04a1716373646cb6f35b73addca492: Makefile: drop -D__CHECK_ENDIAN__ from cflags (2016-12-16 00:13:43 +0200) are available in the git repository at:

Hi all, In another series I proposed to add an architecture specific callback to fail feature negociation on architecture need. In VIRTIO, we already have an entry to reject the features on the transport basis. Transport is not architecture so I send a separate series in which we fail the feature negociation inside virtio_ccw_finalize_features, the virtio_config_ops.finalize_features for S390

Hi all, In another series I proposed to add an architecture specific callback to fail feature negociation on architecture need. In VIRTIO, we already have an entry to reject the features on the transport basis. Transport is not architecture so I send a separate series in which we fail the feature negociation inside virtio_ccw_finalize_features, the virtio_config_ops.finalize_features for S390

Enhanced virtualization protection technology may require the use of bounce buffers for I/O. While support for this was built into the virtio core, virtio-ccw wasn't changed accordingly. Some background on technology (not part of this series) and the terminology used. * Protected Virtualization (PV): Protected Virtualization guarantees, that non-shared memory of a guest that operates in PV

Enhanced virtualization protection technology may require the use of bounce buffers for I/O. While support for this was built into the virtio core, virtio-ccw wasn't changed accordingly. Some background on technology (not part of this series) and the terminology used. * Protected Virtualization (PV): Protected Virtualization guarantees, that non-shared memory of a guest that operates in PV

Enhanced virtualization protection technology may require the use of bounce buffers for I/O. While support for this was built into the virtio core, virtio-ccw wasn't changed accordingly. Some background on technology (not part of this series) and the terminology used. * Protected Virtualization (PV): Protected Virtualization guarantees, that non-shared memory of a guest that operates in PV

Enhanced virtualization protection technology may require the use of bounce buffers for I/O. While support for this was built into the virtio core, virtio-ccw wasn't changed accordingly. Some background on technology (not part of this series) and the terminology used. * Protected Virtualization (PV): Protected Virtualization guarantees, that non-shared memory of a guest that operates in PV

On Tue, 7 Jul 2020 10:44:37 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > S390, protecting the guest memory against unauthorized host access > needs to enforce VIRTIO I/O device protection through the use of > VIRTIO_F_VERSION_1 and VIRTIO_F_IOMMU_PLATFORM. Hm... what about: "If protected virtualization is active on s390, the virtio queues are not accessible to the

On Tue, 7 Jul 2020 10:44:37 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > S390, protecting the guest memory against unauthorized host access > needs to enforce VIRTIO I/O device protection through the use of > VIRTIO_F_VERSION_1 and VIRTIO_F_IOMMU_PLATFORM. Hm... what about: "If protected virtualization is active on s390, the virtio queues are not accessible to the