iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

virtio: let arch advertise guest's memory access restrictions

Browse Source 
An architecture may restrict host access to guest memory,
e.g. IBM s390 Secure Execution or AMD SEV.

Provide a new Kconfig entry the architecture can select,
CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS, when it provides
the arch_has_restricted_virtio_memory_access callback to advertise
to VIRTIO common code when the architecture restricts memory access
from the host.

The common code can then fail the probe for any device where
VIRTIO_F_ACCESS_PLATFORM is required, but not set.

Signed-off-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Link: https://lore.kernel.org/r/1599728030-17085-2-git-send-email-pmorel@linux.ibm.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
This commit is contained in:
Pierre Morel 2020-09-10 10:53:49 +02:00 committed by Michael S. Tsirkin
parent b9747fdf0c
commit 0afa15e1a5
3 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/virtio/Kconfig
View File

@ -6,6 +6,12 @@ config VIRTIO
bus, such as CONFIG_VIRTIO_PCI, CONFIG_VIRTIO_MMIO, CONFIG_RPMSG
or CONFIG_S390_GUEST.
config ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
bool
help
This option is selected if the architecture may need to enforce
VIRTIO_F_ACCESS_PLATFORM
menuconfig VIRTIO_MENU
bool "Virtio drivers"
default y

15
drivers/virtio/virtio.c
View File

@ -176,6 +176,21 @@ int virtio_finalize_features(struct virtio_device *dev)
if (ret)
return ret;
ret = arch_has_restricted_virtio_memory_access();
if (ret) {
if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1)) {
dev_warn(&dev->dev,
"device must provide VIRTIO_F_VERSION_1\n");
return -ENODEV;
}
if (!virtio_has_feature(dev, VIRTIO_F_ACCESS_PLATFORM)) {
dev_warn(&dev->dev,
"device must provide VIRTIO_F_ACCESS_PLATFORM\n");
return -ENODEV;
}
}
if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1))
return 0;

10
include/linux/virtio_config.h
View File

@ -540,4 +540,14 @@ static inline void virtio_cwrite64(struct virtio_device *vdev,
virtio_cread_le((vdev), structname, member, ptr); \
_r; \
})
#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS
int arch_has_restricted_virtio_memory_access(void);
#else
static inline int arch_has_restricted_virtio_memory_access(void)
{
return 0;
}
#endif /* CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS */
#endif /* _LINUX_VIRTIO_CONFIG_H */