All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Hildenbrand <david@redhat.com>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Janosch Frank <frankja@linux.ibm.com>,
	cohuck@redhat.com, qemu-devel@nongnu.org,
	Halil Pasic <pasic@linux.ibm.com>,
	borntraeger@de.ibm.com, qemu-s390x@nongnu.org
Subject: Re: [PATCH v5 07/18] s390x: protvirt: Inhibit balloon when switching to protected mode
Date: Fri, 20 Mar 2020 10:36:53 +0100	[thread overview]
Message-ID: <dc38f7a3-2bc8-084c-b36f-7f99bd129007@redhat.com> (raw)
In-Reply-To: <20200319133710-mutt-send-email-mst@kernel.org>

On 19.03.20 18:45, Michael S. Tsirkin wrote:
> On Thu, Mar 19, 2020 at 02:54:11PM +0100, David Hildenbrand wrote:
>> Why does the balloon driver not support VIRTIO_F_IOMMU_PLATFORM? It is
>> absolutely not clear to me. The introducing commit mentioned that it
>> "bypasses DMA". I fail to see that.
> 
> Well sure one can put the balloon behind an IOMMU.  If will shuffle PFN
> lists through a shared page.  Problem is, you can't run an untrusted
> driver with it since if you do it can corrupt guest memory.
> And VIRTIO_F_IOMMU_PLATFORM so far meant that you can run
> a userspace driver.

Just to clarify: Is it sufficient to clear VIRTIO_F_IOMMU_PLATFORM in
the *guest kernel driver* to prohibit *guest userspace drivers*?
I would have thought we would have to disallow on the hypervisor/device
side. (no expert on user space drivers, especially how they
detect/enable/access virtio devices)

> 
> Maybe we need a separate feature bit for this kind of thing where you
> assume the driver is trusted? Such a bit - unlike
> VIRTIO_F_IOMMU_PLATFORM - would allow legacy guests ...

Let's take virtio-mem as an example. You cannot zap memory outside of
the scope of a virtio-mem device. So I assume having a user space driver
would be ok (although most probably of limited use :) )?

Still, for virtio-mem, special s390x handling, similar to virtio-balloon
- (un)sharing of pages - would have to be performed.

So some feature bits to cleanly separate the different limitations would
be great. At least in regard to s390x, I guess we don't have to worry
too much about legacy guests.

-- 
Thanks,

David / dhildenb



  reply	other threads:[~2020-03-20  9:37 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-26 12:20 [PATCH v5 00/18] s390x: Protected Virtualization support Janosch Frank
2020-02-26 12:20 ` [PATCH v5 01/18] s390x: Use constant for ESA PSW address Janosch Frank
2020-02-26 13:46   ` Christian Borntraeger
2020-02-26 13:47     ` Janosch Frank
2020-02-26 14:27   ` David Hildenbrand
2020-02-26 17:51     ` Cornelia Huck
2020-02-26 17:52       ` David Hildenbrand
2020-02-27  7:53       ` Janosch Frank
2020-02-27  8:09         ` Janosch Frank
2020-02-27  9:06           ` Cornelia Huck
2020-02-27  9:23             ` [PATCH v6] s390x: Rename and use constants for short PSW address and mask Janosch Frank
2020-02-27  9:27               ` David Hildenbrand
2020-02-27 10:36               ` Cornelia Huck
2020-02-26 12:20 ` [PATCH v5 02/18] Sync pv Janosch Frank
2020-02-26 12:20 ` [PATCH v5 03/18] s390x: protvirt: Add diag308 subcodes 8 - 10 Janosch Frank
2020-02-26 12:20 ` [PATCH v5 04/18] s390x: protvirt: Support unpack facility Janosch Frank
2020-02-26 12:20 ` [PATCH v5 05/18] s390x: protvirt: Add migration blocker Janosch Frank
2020-02-26 14:05   ` Christian Borntraeger
2020-02-26 14:08     ` Janosch Frank
2020-02-26 12:20 ` [PATCH v5 06/18] s390x: protvirt: Handle diag 308 subcodes 0,1,3,4 Janosch Frank
2020-02-26 15:00   ` Christian Borntraeger
2020-02-26 15:11     ` Janosch Frank
2020-02-26 12:20 ` [PATCH v5 07/18] s390x: protvirt: Inhibit balloon when switching to protected mode Janosch Frank
2020-02-26 14:59   ` David Hildenbrand
2020-02-26 15:06     ` Christian Borntraeger
2020-02-26 15:16       ` David Hildenbrand
2020-02-26 15:30         ` Janosch Frank
2020-02-26 15:31           ` David Hildenbrand
2020-02-26 18:24           ` Cornelia Huck
2020-03-03 12:42             ` Christian Borntraeger
2020-02-26 15:11     ` Janosch Frank
2020-02-26 15:13       ` Christian Borntraeger
2020-02-26 15:15         ` David Hildenbrand
2020-02-27 12:24       ` Halil Pasic
2020-03-19 13:42         ` Halil Pasic
2020-03-19 13:54         ` David Hildenbrand
2020-03-19 15:40           ` Halil Pasic
2020-03-19 17:31             ` David Hildenbrand
2020-03-20 18:43               ` Halil Pasic
2020-03-24 21:07                 ` Brijesh Singh
2020-03-27 10:50                 ` David Hildenbrand
2020-03-19 17:45           ` Michael S. Tsirkin
2020-03-20  9:36             ` David Hildenbrand [this message]
2020-03-29 14:48               ` Michael S. Tsirkin
2020-03-31  8:59                 ` David Hildenbrand
2020-02-26 12:20 ` [PATCH v5 08/18] s390x: protvirt: KVM intercept changes Janosch Frank
2020-02-26 12:20 ` [PATCH v5 09/18] s390x: Add SIDA memory ops Janosch Frank
2020-02-26 12:20 ` [PATCH v5 10/18] s390x: protvirt: Move STSI data over SIDAD Janosch Frank
2020-02-26 12:20 ` [PATCH v5 11/18] s390x: protvirt: SCLP interpretation Janosch Frank
2020-02-26 12:20 ` [PATCH v5 12/18] s390x: protvirt: Set guest IPL PSW Janosch Frank
2020-02-26 12:20 ` [PATCH v5 13/18] s390x: protvirt: Move diag 308 data over SIDAD Janosch Frank
2020-02-26 12:20 ` [PATCH v5 14/18] s390x: protvirt: Disable address checks for PV guest IO emulation Janosch Frank
2020-02-26 12:20 ` [PATCH v5 15/18] s390x: protvirt: Move IO control structures over SIDA Janosch Frank
2020-02-26 12:20 ` [PATCH v5 16/18] s390x: protvirt: Handle SIGP store status correctly Janosch Frank
2020-02-26 12:20 ` [PATCH v5 17/18] s390x: Add unpack facility feature to GA1 Janosch Frank
2020-02-26 12:20 ` [PATCH v5 18/18] docs: Add protvirt docs Janosch Frank
2020-02-26 20:09 ` [PATCH v5 00/18] s390x: Protected Virtualization support Cornelia Huck
2020-02-27  8:32   ` Janosch Frank
2020-03-03 15:50 ` [PATCH] pc-bios: s390x: Save iplb location in lowcore Janosch Frank
2020-03-03 16:13   ` David Hildenbrand
2020-03-04  8:59     ` Janosch Frank
2020-03-04  9:05       ` David Hildenbrand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=dc38f7a3-2bc8-084c-b36f-7f99bd129007@redhat.com \
    --to=david@redhat.com \
    --cc=borntraeger@de.ibm.com \
    --cc=cohuck@redhat.com \
    --cc=frankja@linux.ibm.com \
    --cc=mst@redhat.com \
    --cc=pasic@linux.ibm.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-s390x@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.