Messages in this thread | | | From | "Michael Kelley (LINUX)" <> | Subject | RE: [Patch v4 01/13] x86/ioapic: Gate decrypted mapping on cc_platform_has() attribute | Date | Tue, 6 Dec 2022 19:54:02 +0000 |
| |
From: Borislav Petkov <bp@alien8.de> Sent: Tuesday, December 6, 2022 11:23 AM > > On Thu, Dec 01, 2022 at 07:30:19PM -0800, Michael Kelley wrote: > > Current code always maps the IO-APIC as shared (decrypted) in a > > confidential VM. But Hyper-V guest VMs on AMD SEV-SNP with vTOM > > enabled use a paravisor running in VMPL0 to emulate the IO-APIC. > > In such a case, the IO-APIC must be accessed as private (encrypted). > > Lemme see I understand this correctly: > > the paravisor is emulating the IO-APIC in the lower range of the address > space, under the vTOM which is accessed encrypted. > > That's why you need to access it encrypted in the guest. > > Close? >
Exactly correct.
Michael
| |