lkml.org 
[lkml]   [2020]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRE: [PATCH 2/2] virtio: let virtio use DMA API when guest RAM is protected
    On Thu, Feb 20, 2020 at 03:55:14PM -0500, Michael S. Tsirkin wrote:
    > On Thu, Feb 20, 2020 at 05:06:06PM +0100, Halil Pasic wrote:
    > > Currently the advanced guest memory protection technologies (AMD SEV,
    > > powerpc secure guest technology and s390 Protected VMs) abuse the
    > > VIRTIO_F_IOMMU_PLATFORM flag to make virtio core use the DMA API, which
    > > is in turn necessary, to make IO work with guest memory protection.
    > >
    > > But VIRTIO_F_IOMMU_PLATFORM a.k.a. VIRTIO_F_ACCESS_PLATFORM is really a
    > > different beast: with virtio devices whose implementation runs on an SMP
    > > CPU we are still fine with doing all the usual optimizations, it is just
    > > that we need to make sure that the memory protection mechanism does not
    > > get in the way. The VIRTIO_F_ACCESS_PLATFORM mandates more work on the
    > > side of the guest (and possibly he host side as well) than we actually
    > > need.
    > >
    > > An additional benefit of teaching the guest to make the right decision
    > > (and use DMA API) on it's own is: removing the need, to mandate special
    > > VM configuration for guests that may run with protection. This is
    > > especially interesting for s390 as VIRTIO_F_IOMMU_PLATFORM pushes all
    > > the virtio control structures into the first 2G of guest memory:
    > > something we don't necessarily want to do per-default.
    > >
    > > Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
    > > Tested-by: Ram Pai <linuxram@us.ibm.com>
    > > Tested-by: Michael Mueller <mimu@linux.ibm.com>
    >
    > This might work for you but it's fragile, since without
    > VIRTIO_F_ACCESS_PLATFORM hypervisor assumes it gets
    > GPA's, not DMA addresses.
    >
    >
    >
    > IOW this looks like another iteration of:
    >
    > virtio: Support encrypted memory on powerpc secure guests
    >
    > which I was under the impression was abandoned as unnecessary.

    It has been abondoned on powerpc. We enabled VIRTIO_F_ACCESS_PLATFORM;
    by default, flag on powerpc.

    We would like to enable secure guests on powerpc without this flag
    aswell enabled, but past experience has educated us that its not a easy
    path. However if Halil makes some inroads in this path for s390, we
    will like to support him.


    RP

    \
     
     \ /
      Last update: 2020-02-21 02:19    [W:2.473 / U:0.868 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site