lkml.org 
[lkml]   [2022]   [Mar]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCHv7 27/30] x86/mm: Make DMA memory shared for TD guest
On 3/18/22 08:30, Kirill A. Shutemov wrote:
> Intel TDX doesn't allow VMM to directly access guest private memory.
> Any memory that is required for communication with the VMM must be
> shared explicitly. The same rule applies for any DMA to and from the
> TDX guest. All DMA pages have to be marked as shared pages. A generic way
> to achieve this without any changes to device drivers is to use the
> SWIOTLB framework.
>
> In TDX guest, CC_ATTR_GUEST_MEM_ENCRYPT is set. It makes all DMA to be
> rerouted via SWIOTLB (see pci_swiotlb_detect()). mem_encrypt_init()
> generalized to cover TDX. It makes SWIOTLB buffer shared.

It would be nice to have one transition paragraph to link the last one
to this:

The previous patch ("Add support for TDX shared memory") gave TDX guests
the _ability_ to make some pages shared, but did not actually make any
pages shared. This actually marks SWIOTLB buffers *as* shared.

Start returning true for cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) in
TDX guests. This has several implications:

* Allows the existing mem_encrypt_init() to be used for TDX which
sets SWIOTLB buffers shared (aka. "decrypted").
* Ensures that all DMA is routed via the SWIOTLB mechanism (see
pci_swiotlb_detect())


> Stop selecting DYNAMIC_PHYSICAL_MASK directly. It will get set
> indirectly by selcting X86_MEM_ENCRYPT.

^ selecting

> mem_encrypt_init() is currently under an AMD-specific #ifdef. Move it to
> a generic area of the header.

That new paragraph was kinda funky. With the changelog improvements above:

Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>

\
 
 \ /
  Last update: 2022-03-18 16:54    [W:0.268 / U:0.736 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site