Messages in this thread | | | From | Michael Ellerman <> | Subject | Re: [RFC v1 1/2] powerpc/pseries/iommu: Share the per-cpu TCE page with the hypervisor. | Date | Thu, 07 Nov 2019 21:29:54 +1100 |
| |
Ram Pai <linuxram@us.ibm.com> writes: > The hypervisor needs to access the contents of the page holding the TCE > entries while setting up the TCE entries in the IOMMU's TCE table. For > SecureVMs, since this page is encrypted, the hypervisor cannot access > valid entries. Share the page with the hypervisor. This ensures that the > hypervisor sees the valid entries.
Can you please give people some explanation of why this is safe. After all the point of the Ultravisor is to protect the guest from a malicious hypervisor. Giving the hypervisor access to a page of TCEs sounds dangerous, so please explain why it's not.
cheers
> diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c > index 8d9c2b1..07f0847 100644 > --- a/arch/powerpc/platforms/pseries/iommu.c > +++ b/arch/powerpc/platforms/pseries/iommu.c > @@ -37,6 +37,7 @@ > #include <asm/mmzone.h> > #include <asm/plpar_wrappers.h> > #include <asm/svm.h> > +#include <asm/ultravisor.h> > > #include "pseries.h" > > @@ -179,6 +180,19 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, > > static DEFINE_PER_CPU(__be64 *, tce_page); > > +/* > + * Allocate a tce page. If secure VM, share the page with the hypervisor. > + */ > +static __be64 *alloc_tce_page(void) > +{ > + __be64 *tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > + > + if (tcep && is_secure_guest()) > + uv_share_page(PHYS_PFN(__pa(tcep)), 1); > + > + return tcep; > +} > + > static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > long npages, unsigned long uaddr, > enum dma_data_direction direction, > @@ -206,8 +220,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > * from iommu_alloc{,_sg}() > */ > if (!tcep) { > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > - /* If allocation fails, fall back to the loop implementation */ > + tcep = alloc_tce_page(); > if (!tcep) { > local_irq_restore(flags); > return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, > @@ -391,6 +404,7 @@ static int tce_clearrange_multi_pSeriesLP(unsigned long start_pfn, > return rc; > } > > + > static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, > unsigned long num_pfn, const void *arg) > { > @@ -405,7 +419,7 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, > tcep = __this_cpu_read(tce_page); > > if (!tcep) { > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > + tcep = alloc_tce_page(); > if (!tcep) { > local_irq_enable(); > return -ENOMEM; > -- > 1.8.3.1
| |