Messages in this thread | | | Date | Tue, 6 Dec 2022 20:22:52 +0100 | From | Borislav Petkov <> | Subject | Re: [Patch v4 01/13] x86/ioapic: Gate decrypted mapping on cc_platform_has() attribute |
| |
On Thu, Dec 01, 2022 at 07:30:19PM -0800, Michael Kelley wrote: > Current code always maps the IO-APIC as shared (decrypted) in a > confidential VM. But Hyper-V guest VMs on AMD SEV-SNP with vTOM > enabled use a paravisor running in VMPL0 to emulate the IO-APIC. > In such a case, the IO-APIC must be accessed as private (encrypted).
Lemme see I understand this correctly:
the paravisor is emulating the IO-APIC in the lower range of the address space, under the vTOM which is accessed encrypted.
That's why you need to access it encrypted in the guest.
Close?
Thx.
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |