Commit 0afa15e1 authored by Pierre Morel's avatar Pierre Morel Committed by Michael S. Tsirkin
Browse files

virtio: let arch advertise guest's memory access restrictions 



An architecture may restrict host access to guest memory,
e.g. IBM s390 Secure Execution or AMD SEV.

Provide a new Kconfig entry the architecture can select,
CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS, when it provides
the arch_has_restricted_virtio_memory_access callback to advertise
to VIRTIO common code when the architecture restricts memory access
from the host.

The common code can then fail the probe for any device where
VIRTIO_F_ACCESS_PLATFORM is required, but not set.

Signed-off-by: default avatarPierre Morel <pmorel@linux.ibm.com>
Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
Reviewed-by: default avatarHalil Pasic <pasic@linux.ibm.com>
Link: https://lore.kernel.org/r/1599728030-17085-2-git-send-email-pmorel@linux.ibm.com


Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Acked-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
parent b9747fdf

drivers/virtio/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -6,6 +6,12 @@ config VIRTIO 
	  bus, such as CONFIG_VIRTIO_PCI, CONFIG_VIRTIO_MMIO, CONFIG_RPMSG

	  or CONFIG_S390_GUEST.



config ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS

	bool

	help

	  This option is selected if the architecture may need to enforce

	  VIRTIO_F_ACCESS_PLATFORM



menuconfig VIRTIO_MENU

	bool "Virtio drivers"

	default y

drivers/virtio/virtio.c

+15 −0
Original line number Diff line number Diff line
@@ -176,6 +176,21 @@ int virtio_finalize_features(struct virtio_device *dev) 
	if (ret)

		return ret;



	ret = arch_has_restricted_virtio_memory_access();

	if (ret) {

		if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1)) {

			dev_warn(&dev->dev,

				 "device must provide VIRTIO_F_VERSION_1\n");

			return -ENODEV;

		}



		if (!virtio_has_feature(dev, VIRTIO_F_ACCESS_PLATFORM)) {

			dev_warn(&dev->dev,

				 "device must provide VIRTIO_F_ACCESS_PLATFORM\n");

			return -ENODEV;

		}

	}



	if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1))

		return 0;

include/linux/virtio_config.h

+10 −0
Original line number Diff line number Diff line
@@ -540,4 +540,14 @@ static inline void virtio_cwrite64(struct virtio_device *vdev, 
			virtio_cread_le((vdev), structname, member, ptr); \

		_r;							\

	})



#ifdef CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS

int arch_has_restricted_virtio_memory_access(void);

#else

static inline int arch_has_restricted_virtio_memory_access(void)

{

	return 0;

}

#endif /* CONFIG_ARCH_HAS_RESTRICTED_VIRTIO_MEMORY_ACCESS */



#endif /* _LINUX_VIRTIO_CONFIG_H */

CRA Git | Maintained and supported by SUSTech CRA and CCSE