Messages in this thread | | | Date | Fri, 20 Jan 2023 21:15:10 +0100 | From | Borislav Petkov <> | Subject | Re: [PATCH v5 06/14] x86/ioremap: Support hypervisor specified range to map as encrypted |
| |
On Thu, Jan 12, 2023 at 01:42:25PM -0800, Michael Kelley wrote: > In a AMD SEV-SNP VM using vTOM, devices in MMIO space may be provided by > the paravisor and need to be mapped as encrypted. Provide a function > for the hypervisor to specify the address range for such devices. > In __ioremap_caller(), map addresses in this range as encrypted. > > Only a single range is supported. If multiple devices need to be > mapped encrypted, the paravisor must place them within the single > contiguous range.
This already is starting to sound insufficient and hacky. And it also makes CC_ATTR_ACCESS_IOAPIC_ENCRYPTED insufficient either.
So, the situation we have is, we're a SEV-SNP VM using vTOM. Which means, MSR_AMD64_SEV[3] = 1. Or SEV_FEATURES[1], alternatively - same thing.
That MSR cannot be intercepted by the HV and we use it extensively in Linux when it runs as a SEV-* guest. And I had asked this before, during review, but why aren't you checking this bit above when you wanna do vTOM-specific work?
Because then you can do that check and
1. map the IO-APIC encrypted 2. map MMIO space of devices from the driver encrypted too 3. ...
and so on.
And you won't need those other, not as nice things...
Hmmm.
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |