[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default prop
From: |
David Gibson |
Subject: |
Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests |
Date: |
Thu, 17 Dec 2020 16:53:38 +1100 |
On Tue, Dec 08, 2020 at 01:50:05PM +0100, Cornelia Huck wrote:
> On Tue, 8 Dec 2020 11:28:29 +0100
> Halil Pasic <pasic@linux.ibm.com> wrote:
>
> > On Tue, 8 Dec 2020 12:54:03 +1100
> > David Gibson <david@gibson.dropbear.id.au> wrote:
> >
> > > > > >>> + * Virtio devices can't count on directly accessing guest
> > > > > >>> + * memory, so they need iommu_platform=on to use normal
> > > > > >>> DMA
> > > > > >>> + * mechanisms. That requires also disabling legacy
> > > > > >>> virtio
> > > > > >>> + * support for those virtio pci devices which allow it.
> > > > > >>> + */
> > > > > >>> + object_register_sugar_prop(TYPE_VIRTIO_PCI,
> > > > > >>> "disable-legacy",
> > > > > >>> + "on", true);
> > > > > >>> + object_register_sugar_prop(TYPE_VIRTIO_DEVICE,
> > > > > >>> "iommu_platform",
> > > > > >>> + "on", false);
> > > > > >>
> > > > > >> I have not followed all the history (sorry). Should we also set
> > > > > >> iommu_platform
> > > > > >> for virtio-ccw? Halil?
> > > > > >>
> > > > > >
> > > > > > That line should add iommu_platform for all virtio devices,
> > > > > > shouldn't
> > > > > > it?
> > > > >
> > > > > Yes, sorry. Was misreading that with the line above.
> > > > >
> > > >
> > > > I believe this is the best we can get. In a sense it is still a
> > > > pessimization,
> > >
> > > I'm not really clear on what you're getting at here.
> >
> > By pessimiziation, I mean that we are going to indicate
> > _F_PLATFORM_ACCESS even if it isn't necessary, because the guest never
> > opted in for confidential/memory protection/memory encryption. We have
> > discussed this before, and I don't see a better solution that works for
> > everybody.
>
> If you consider specifying the secure guest option as a way to tell
> QEMU to make everything ready for running a secure guest, I'd certainly
> consider it necessary. If you do not want to force it, you should not
> do the secure guest preparation setup.
Right, that's my feeling as well.
I'm also of the opinion that !F_PLATFORM_ACCESS is kind of a nasty
hack that has some other problems (e.g. it means an L1 can't safely
pass the device into an L2).
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
signature.asc
Description: PGP signature
- [for-6.0 v5 09/13] securable guest memory: Move SEV initialization into arch specific code, (continued)
- [for-6.0 v5 09/13] securable guest memory: Move SEV initialization into arch specific code, David Gibson, 2020/12/04
- [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, David Gibson, 2020/12/04
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Christian Borntraeger, 2020/12/04
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Cornelia Huck, 2020/12/04
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Christian Borntraeger, 2020/12/04
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Halil Pasic, 2020/12/04
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, David Gibson, 2020/12/07
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Christian Borntraeger, 2020/12/08
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Halil Pasic, 2020/12/08
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Cornelia Huck, 2020/12/08
- Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests,
David Gibson <=
Re: [for-6.0 v5 12/13] securable guest memory: Alter virtio default properties for protected guests, Cornelia Huck, 2020/12/04
[for-6.0 v5 07/13] sev: Add Error ** to sev_kvm_init(), David Gibson, 2020/12/04
[for-6.0 v5 10/13] spapr: Add PEF based securable guest memory, David Gibson, 2020/12/04
[for-6.0 v5 05/13] securable guest memory: Rework the "memory-encryption" property, David Gibson, 2020/12/04
[for-6.0 v5 13/13] s390: Recognize securable-guest-memory option, David Gibson, 2020/12/04
Re: [for-6.0 v5 00/13] Generalize memory encryption models, Christian Borntraeger, 2020/12/04