From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6442BC10F0E for ; Tue, 9 Apr 2019 10:54:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2936D2084C for ; Tue, 9 Apr 2019 10:54:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726205AbfDIKyw (ORCPT ); Tue, 9 Apr 2019 06:54:52 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:52018 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726112AbfDIKyw (ORCPT ); Tue, 9 Apr 2019 06:54:52 -0400 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x39AsmfU103031 for ; Tue, 9 Apr 2019 06:54:50 -0400 Received: from e06smtp02.uk.ibm.com (e06smtp02.uk.ibm.com [195.75.94.98]) by mx0b-001b2d01.pphosted.com with ESMTP id 2rrsh0hc4u-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 09 Apr 2019 06:54:49 -0400 Received: from localhost by e06smtp02.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 9 Apr 2019 11:54:22 +0100 Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197) by e06smtp02.uk.ibm.com (192.168.101.132) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 9 Apr 2019 11:54:20 +0100 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id x39AsJF059113604 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 9 Apr 2019 10:54:19 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0078D11C054; Tue, 9 Apr 2019 10:54:19 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6BC1311C05C; Tue, 9 Apr 2019 10:54:18 +0000 (GMT) Received: from oc2783563651 (unknown [9.152.224.40]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 9 Apr 2019 10:54:18 +0000 (GMT) Date: Tue, 9 Apr 2019 12:54:16 +0200 From: Halil Pasic To: Cornelia Huck Cc: kvm@vger.kernel.org, linux-s390@vger.kernel.org, Martin Schwidefsky , Sebastian Ott , virtualization@lists.linux-foundation.org, Christian Borntraeger , Viktor Mihajlovski , Vasily Gorbik , Janosch Frank , Claudio Imbrenda , Farhan Ali , Eric Farman Subject: Re: [RFC PATCH 03/12] s390/mm: force swiotlb for protected virtualization In-Reply-To: <20190409121647.3e0e1f53.cohuck@redhat.com> References: <20190404231622.52531-1-pasic@linux.ibm.com> <20190404231622.52531-4-pasic@linux.ibm.com> <20190409121647.3e0e1f53.cohuck@redhat.com> Organization: IBM X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.31; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 19040910-0008-0000-0000-000002D7E081 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 19040910-0009-0000-0000-00002243FFFA Message-Id: <20190409125416.73713f23@oc2783563651> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-04-09_04:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1904090071 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Tue, 9 Apr 2019 12:16:47 +0200 Cornelia Huck wrote: > On Fri, 5 Apr 2019 01:16:13 +0200 > Halil Pasic wrote: > > > On s390 protected virtualization guests also have to use bounce I/O > > buffers. That requires some plumbing. > > > > Let us make sure any device using DMA API accordingly is spared from the ^, ^, Maybe this helps... > > problems that hypervisor attempting I/O to a non-shared secure page would > > bring. > > I have problems parsing this sentence :( > > Do you mean that we want to exclude pages for I/O from encryption? The intended meaning is: * Devices that do use DMA API (properly) to get get/map the memory that is used to talk to hypervisor should be OK with PV (protected virtualizaton). I.e. for such devices PV or not PV is basically transparent. * But if a device does not use DMA API for the memory that is used to talk to the hypervisor this patch won't help. And yes the gist of it is: memory accessed by the hypervisor needs to be on pages excluded from protection (which in case of PV is technically not encryption). Does that help? > > > > > Signed-off-by: Halil Pasic > > --- > > arch/s390/Kconfig | 4 ++++ > > arch/s390/include/asm/Kbuild | 1 - > > arch/s390/include/asm/dma-mapping.h | 13 +++++++++++ > > arch/s390/include/asm/mem_encrypt.h | 18 +++++++++++++++ > > arch/s390/mm/init.c | 44 +++++++++++++++++++++++++++++++++++++ > > 5 files changed, 79 insertions(+), 1 deletion(-) > > create mode 100644 arch/s390/include/asm/dma-mapping.h > > create mode 100644 arch/s390/include/asm/mem_encrypt.h > > (...) > > > @@ -126,6 +129,45 @@ void mark_rodata_ro(void) > > pr_info("Write protected read-only-after-init data: %luk\n", size >> 10); > > } > > > > +int set_memory_encrypted(unsigned long addr, int numpages) > > +{ > > + /* also called for the swiotlb bounce buffers, make all pages shared */ > > + /* TODO: do ultravisor calls */ > > + return 0; > > +} > > +EXPORT_SYMBOL_GPL(set_memory_encrypted); > > + > > +int set_memory_decrypted(unsigned long addr, int numpages) > > +{ > > + /* also called for the swiotlb bounce buffers, make all pages shared */ > > + /* TODO: do ultravisor calls */ > > + return 0; > > +} > > +EXPORT_SYMBOL_GPL(set_memory_decrypted); > > + > > +/* are we a protected virtualization guest? */ > > +bool sev_active(void) > > +{ > > + /* > > + * TODO: Do proper detection using ultravisor, for now let us fake we > > + * have it so the code gets exercised. > > That's the swiotlb stuff, right? > You mean 'That' == code to get exercised == 'swiotlb stuff'? If yes then the answer is kind of. The swiotlb (i.e. bounce buffers) is when we map (like we map the buffers pointed to by the descriptors in case of the virtio ring). The other part of it is the memory allocated as DMA coherent (i.e. the virtio ring (desc, avail used) itself). > (The patches will obviously need some reordering before it is actually > getting merged.) > What do you mean by reordering? One reason why this is an early RFC is the missing dependency (i.e. the stuff described by most of the TODO comments). As pointed out in the cover letter. Another reason is that I wanted to avoid putting a lots of effort into fine-polishing before clarifying the getting some feedback on the basics from the community. ;) > > + */ > > + return true; > > +} > > +EXPORT_SYMBOL_GPL(sev_active); > > + > > +/* protected virtualization */ > > +static void pv_init(void) > > +{ > > + if (!sev_active()) > > + return; > > + > > + /* make sure bounce buffers are shared */ > > + swiotlb_init(1); > > + swiotlb_update_mem_attributes(); > > + swiotlb_force = SWIOTLB_FORCE; > > +} > > + > > void __init mem_init(void) > > { > > cpumask_set_cpu(0, &init_mm.context.cpu_attach_mask); > > @@ -134,6 +176,8 @@ void __init mem_init(void) > > set_max_mapnr(max_low_pfn); > > high_memory = (void *) __va(max_low_pfn * PAGE_SIZE); > > > > + pv_init(); > > + > > /* Setup guest page hinting */ > > cmma_init(); > > >