similar to: [PATCH v11 0/2] s390: virtio: let arch validate VIRTIO features

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. The tests are back to virtio_finalize_features. No more argument for the architecture callback which only reports if the architecture needs guest memory access restrictions for VIRTIO. I renamed the callback to arch_has_restricted_virtio_memory_access, and the config option to

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. in this respin: The tests are back to virtio_finalize_features. No more argument for the architecture callback which only reports if the architecture needs guest memory access restrictions for VIRTIO. I renamed the callback to arch_has_restricted_virtio_memory_access, and the config

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. I changed VIRTIO_F_IOMMU_PLATFORM to VIRTIO_F_ACCESS_PLATFORM I forgot in drivers/virtio/Kconfig, and put back the inclusion of virtio_config.h for the definition of the callback in arch/s390/mm/init.c I wrongly removed in the last series. Regards, Pierre Pierre Morel (2): virtio: let

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. I changed VIRTIO_F_IOMMU_PLATFORM to VIRTIO_F_ACCESS_PLATFORM I forgot in drivers/virtio/Kconfig, and put back the inclusion of virtio_config.h for the definition of the callback in arch/s390/mm/init.c I wrongly removed in the last series. Regards, Pierre Pierre Morel (2): virtio: let

On Wed, 19 Aug 2020 18:23:17 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > An architecture may restrict host access to guest memory. "e.g. IBM s390 Secure Execution or AMD SEV" Just to make clearer what you are referring to? > > Provide a new Kconfig entry the architecture can select, > CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS, when it provides >

On Wed, 19 Aug 2020 18:23:18 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > If protected virtualization is active on s390, VIRTIO has retricted s/retricted/only restricted/ > access to the guest memory. > Define CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS and export > arch_has_restricted_virtio_memory_access to advertize VIRTIO if that's > the case,

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. in this respin: I use the original idea from Connie for an optional arch_has_restricted_memory_access. I renamed the callback accordingly, added the definition of ARCH_HAS_RESTRICTED_MEMORY_ACCESS inside the VIRTIO Kconfig and the selection in the PROTECTED_VIRTUALIZATION_GUEST config

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. in this respin: 1) I kept removed the ack from Jason as I reworked the patch @Jason, the nature and goal of the patch did not really changed please can I get back your acked-by with these changes? 2) Rewording for warning messages Regards, Pierre Pierre Morel (2):

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. in this respin: 1) I kept removed the ack from Jason as I reworked the patch @Jason, the nature and goal of the patch did not really changed please can I get back your acked-by with these changes? 2) I suppressed the unnecessary verbosity of the architecture specific

Hi all, The goal of the series is to give a chance to the architecture to validate VIRTIO device features. in this respin: 1) I kept removed the ack from Jason as I reworked the patch @Jason, the nature and goal of the patch did not really changed please can I get back your acked-by with these changes? 2) Rewording for warning messages Regards, Pierre Pierre Morel (2):

Hi all, I changed the patch subject to reflect the content, becoming more general. 1) I removed the ack from Christian and Jason even far as I understand they gave it for the functionality more than for the implementation. @Jason, @Christian, please can I get back your acked-by with these changes? 2) previous patch had another name: [PATCH v3 0/1] s390: virtio: let arch choose to

On Tue, 18 Aug 2020 16:58:30 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > An architecture may need to validate the VIRTIO devices features > based on architecture specifics. > > Provide a new Kconfig entry, CONFIG_ARCH_HAS_RESTRICTED_MEMORY_ACCESS, > the architecture can select when it provides a callback named > arch_has_restricted_memory_access to validate the

On Tue, 18 Aug 2020 16:58:30 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > An architecture may need to validate the VIRTIO devices features > based on architecture specifics. > > Provide a new Kconfig entry, CONFIG_ARCH_HAS_RESTRICTED_MEMORY_ACCESS, > the architecture can select when it provides a callback named > arch_has_restricted_memory_access to validate the

An architecture protecting the guest memory against unauthorized host access may want to enforce VIRTIO I/O device protection through the use of VIRTIO_F_IOMMU_PLATFORM. Let's give a chance to the architecture to accept or not devices without VIRTIO_F_IOMMU_PLATFORM. Pierre Morel (1): s390: virtio: let arch accept devices without IOMMU feature arch/s390/mm/init.c | 6 ++++++

Hi Shile, Thank you for the patch! Yet something to improve: [auto build test ERROR on linus/master] [also build test ERROR on v5.8-rc5 next-20200716] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url:

Protected Virtualisation protects the memory of the guest and do not allow a the host to access all of its memory. Let's refuse a VIRTIO device which does not use IOMMU protected access. Signed-off-by: Pierre Morel <pmorel at linux.ibm.com> --- drivers/s390/virtio/virtio_ccw.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/s390/virtio/virtio_ccw.c

Protected Virtualisation protects the memory of the guest and do not allow a the host to access all of its memory. Let's refuse a VIRTIO device which does not use IOMMU protected access. Signed-off-by: Pierre Morel <pmorel at linux.ibm.com> --- drivers/s390/virtio/virtio_ccw.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/s390/virtio/virtio_ccw.c

Hi Mike, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on vhost/linux-next] [also build test WARNING on v5.9-rc6 next-20200921] [cannot apply to target/for-next] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url:

An architecture protecting the guest memory against unauthorized host access may want to enforce VIRTIO I/O device protection through the use of VIRTIO_F_IOMMU_PLATFORM. Let's give a chance to the architecture to accept or not devices without VIRTIO_F_IOMMU_PLATFORM. Pierre Morel (1): s390: virtio: let arch accept devices without IOMMU feature arch/s390/mm/init.c | 6 ++++++

On Tue, 7 Jul 2020 10:44:37 +0200 Pierre Morel <pmorel at linux.ibm.com> wrote: > S390, protecting the guest memory against unauthorized host access > needs to enforce VIRTIO I/O device protection through the use of > VIRTIO_F_VERSION_1 and VIRTIO_F_IOMMU_PLATFORM. Hm... what about: "If protected virtualization is active on s390, the virtio queues are not accessible to the