Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-26 Thread Borislav Petkov
On Tue, Apr 26, 2022 at 11:36:40AM +0200, Juergen Gross wrote: > As the suggestion was to add another flag this wouldn't be a problem IMO. We had a problem already with adding one flag would break the same flag on the other guest type. That's why we added cc_vendor too. So it can be tricky. > pla

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-26 Thread Juergen Gross
On 26.04.22 10:41, Borislav Petkov wrote: On Tue, Apr 26, 2022 at 07:16:16AM +0200, Juergen Gross wrote: Christoph suggested (rather firmly) this would be the way to go. Yeah, I saw it but I don't think it is the right way to go. What happens the next time a guest needs to query the platform

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Juergen Gross
On 25.04.22 23:25, Borislav Petkov wrote: On Mon, Apr 25, 2022 at 11:38:36PM +0300, Oleksandr wrote: diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h index efd8205..d06bc7a 100644 --- a/include/linux/cc_platform.h +++ b/include/linux/cc_platform.h @@ -72,6 +72,19 @@ enum cc

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Borislav Petkov
On Mon, Apr 25, 2022 at 11:38:36PM +0300, Oleksandr wrote: > diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h > index efd8205..d06bc7a 100644 > --- a/include/linux/cc_platform.h > +++ b/include/linux/cc_platform.h > @@ -72,6 +72,19 @@ enum cc_attr { > * Examples inclu

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Oleksandr
Hello all. On 25.04.22 12:14, Juergen Gross wrote: On 25.04.22 09:58, Christoph Hellwig wrote: On Mon, Apr 25, 2022 at 09:47:49AM +0200, Juergen Gross wrote: Would the Xen specific bits fit into Confidential Computing Platform checks? I will let Juergen/Boris comment on this. I don't thin

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Juergen Gross
On 25.04.22 09:58, Christoph Hellwig wrote: On Mon, Apr 25, 2022 at 09:47:49AM +0200, Juergen Gross wrote: Would the Xen specific bits fit into Confidential Computing Platform checks? I will let Juergen/Boris comment on this. I don't think cc_platform_has would be correct here. Xen certainly p

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Christoph Hellwig
On Mon, Apr 25, 2022 at 09:47:49AM +0200, Juergen Gross wrote: > > Would the Xen specific bits fit into Confidential Computing Platform > > checks? I will let Juergen/Boris comment on this. > > I don't think cc_platform_has would be correct here. Xen certainly > provides more isolation between gue

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Juergen Gross
On 24.04.22 20:08, Boris Ostrovsky wrote: On 4/24/22 12:53 PM, Oleksandr wrote: On 23.04.22 19:40, Christoph Hellwig wrote: + +#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS +int arch_has_restricted_virtio_memory_access(void) +{ +    return (xen_has_restricted_virtio_memory_acce

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-25 Thread Juergen Gross
On 24.04.22 18:53, Oleksandr wrote: On 23.04.22 19:40, Christoph Hellwig wrote: Hello Christoph Please split this into one patch that creates grant-dma-ops, and another that sets up the virtio restricted access helpers. Sounds reasonable, will do: 1. grant-dma-ops.c with config XEN_GRANT

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-24 Thread Boris Ostrovsky
On 4/24/22 12:53 PM, Oleksandr wrote: On 23.04.22 19:40, Christoph Hellwig wrote: + +#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS +int arch_has_restricted_virtio_memory_access(void) +{ +    return (xen_has_restricted_virtio_memory_access() || +    cc_platform_has(CC_AT

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-24 Thread Oleksandr
On 23.04.22 19:40, Christoph Hellwig wrote: Hello Christoph Please split this into one patch that creates grant-dma-ops, and another that sets up the virtio restricted access helpers. Sounds reasonable, will do: 1. grant-dma-ops.c with config XEN_GRANT_DMA_OPS 2. arch_has_restricted_vir

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-23 Thread Christoph Hellwig
Please split this into one patch that creates grant-dma-ops, and another that sets up the virtio restricted access helpers. > + > +#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS > +int arch_has_restricted_virtio_memory_access(void) > +{ > + return (xen_has_restricted_virtio_memory_acce

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-23 Thread Oleksandr
On 23.04.22 12:10, Juergen Gross wrote: Hello Juergen On 23.04.22 09:05, Oleksandr wrote: On 23.04.22 02:00, Stefano Stabellini wrote: Hello Stefano On Fri, 22 Apr 2022, Oleksandr Tyshchenko wrote: From: Juergen Gross Introduce Xen grant DMA-mapping layer which contains special DMA-

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-23 Thread Juergen Gross
On 23.04.22 09:05, Oleksandr wrote: On 23.04.22 02:00, Stefano Stabellini wrote: Hello Stefano On Fri, 22 Apr 2022, Oleksandr Tyshchenko wrote: From: Juergen Gross Introduce Xen grant DMA-mapping layer which contains special DMA-mapping routines for providing grant references as DMA addre

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-23 Thread Oleksandr
On 23.04.22 02:00, Stefano Stabellini wrote: Hello Stefano On Fri, 22 Apr 2022, Oleksandr Tyshchenko wrote: From: Juergen Gross Introduce Xen grant DMA-mapping layer which contains special DMA-mapping routines for providing grant references as DMA addresses to be used by frontends (e.g. vi

Re: [PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-22 Thread Stefano Stabellini
On Fri, 22 Apr 2022, Oleksandr Tyshchenko wrote: > From: Juergen Gross > > Introduce Xen grant DMA-mapping layer which contains special DMA-mapping > routines for providing grant references as DMA addresses to be used by > frontends (e.g. virtio) in Xen guests. > > In order to support virtio in

[PATCH V1 3/6] xen/virtio: Add option to restrict memory access under Xen

2022-04-22 Thread Oleksandr Tyshchenko
From: Juergen Gross Introduce Xen grant DMA-mapping layer which contains special DMA-mapping routines for providing grant references as DMA addresses to be used by frontends (e.g. virtio) in Xen guests. In order to support virtio in Xen guests add a config option XEN_VIRTIO enabling the user to