@@ -147,6 +147,7 @@ parameter is applicable::
PCI PCI bus support is enabled.
PCIE PCI Express support is enabled.
PCMCIA The PCMCIA subsystem is enabled.
+ PG Protected guest is enabled.
PNP Plug & Play support is enabled.
PPC PowerPC architecture is enabled.
PPT Parallel port support is enabled.
@@ -2062,6 +2062,18 @@
1 - Bypass the IOMMU for DMA.
unset - Use value of CONFIG_IOMMU_DEFAULT_PASSTHROUGH.
+ ioremap_force_shared= [X86_64, PG]
+ Force the kernel to use shared memory mappings which do
+ not use ioremap_shared/pcimap_shared to opt-in to shared
+ mappings with the host. This feature is mainly used by
+ a protected guest when enabling new drivers without
+ proper shared memory related changes. Please note that
+ this option might also allow other non explicitly enabled
+ drivers to interact with the host in protected guest,
+ which could cause other security risks. This option will
+ also cause BIOS data structures to be shared with the host,
+ which might open security holes.
+
io7= [HW] IO7 for Marvel-based Alpha systems
See comment before marvel_specify_io7 in
arch/alpha/kernel/core_marvel.c.
@@ -413,6 +413,8 @@ extern bool arch_memremap_can_ram_remap(resource_size_t offset,
extern bool phys_mem_access_encrypted(unsigned long phys_addr,
unsigned long size);
+extern bool ioremap_force_shared;
+
/**
* iosubmit_cmds512 - copy data to single MMIO location, in 512-bit units
* @dst: destination, in MMIO space (must be 512-bit aligned)
@@ -28,6 +28,7 @@
#include <asm/memtype.h>
#include <asm/setup.h>
#include <asm/tdx.h>
+#include <asm/cmdline.h>
#include "physaddr.h"
@@ -162,6 +163,17 @@ static void __ioremap_check_mem(resource_size_t addr, unsigned long size,
__ioremap_check_other(addr, desc);
}
+/*
+ * Normally only drivers that are hardened for use in confidential guests
+ * force shared mappings. But if device filtering is disabled other
+ * devices can be loaded, and these need shared mappings too. This
+ * variable is set to true if these filters are disabled.
+ *
+ * Note this has some side effects, e.g. various BIOS tables
+ * get shared too which is risky.
+ */
+bool ioremap_force_shared;
+
/*
* Remap an arbitrary physical address space into the kernel virtual
* address space. It transparently creates kernel huge I/O mapping when
@@ -249,7 +261,7 @@ __ioremap_caller(resource_size_t phys_addr, unsigned long size,
prot = PAGE_KERNEL_IO;
if ((io_desc.flags & IORES_MAP_ENCRYPTED) || encrypted)
prot = pgprot_encrypted(prot);
- else if (shared)
+ else if (shared || ioremap_force_shared)
prot = pgprot_protected_guest(prot);
switch (pcm) {
@@ -847,6 +859,11 @@ void __init early_ioremap_init(void)
WARN_ON((fix_to_virt(0) + PAGE_SIZE) & ((1 << PMD_SHIFT) - 1));
#endif
+ /* Parse cmdline params for ioremap_force_shared */
+ if (cmdline_find_option_bool(boot_command_line,
+ "ioremap_force_shared"))
+ ioremap_force_shared = 1;
+
early_ioremap_setup();
pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
Add a command line option to force all the enabled drivers to use shared memory mappings. This will be useful when enabling new drivers in the protected guest without making all the required changes to use shared mappings in it. Note that this might also allow other non explicitly enabled drivers to interact with the host, which could cause other security risks. Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> --- .../admin-guide/kernel-parameters.rst | 1 + .../admin-guide/kernel-parameters.txt | 12 ++++++++++++ arch/x86/include/asm/io.h | 2 ++ arch/x86/mm/ioremap.c | 19 ++++++++++++++++++- 4 files changed, 33 insertions(+), 1 deletion(-)