From: Dave Hansen <dave.hansen@intel.com>
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
luto@kernel.org, peterz@infradead.org
Cc: sathyanarayanan.kuppuswamy@linux.intel.com, aarcange@redhat.com,
ak@linux.intel.com, dan.j.williams@intel.com, david@redhat.com,
hpa@zytor.com, jgross@suse.com, jmattson@google.com,
joro@8bytes.org, jpoimboe@redhat.com, knsathya@kernel.org,
pbonzini@redhat.com, sdeep@vmware.com, seanjc@google.com,
tony.luck@intel.com, vkuznets@redhat.com, wanpengli@tencent.com,
thomas.lendacky@amd.com, brijesh.singh@amd.com, x86@kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCHv7 27/30] x86/mm: Make DMA memory shared for TD guest
Date: Fri, 18 Mar 2022 08:53:27 -0700 [thread overview]
Message-ID: <f9c71fde-714e-9e0a-48ec-05be1ce6d76b@intel.com> (raw)
In-Reply-To: <20220318153048.51177-28-kirill.shutemov@linux.intel.com>
On 3/18/22 08:30, Kirill A. Shutemov wrote:
> Intel TDX doesn't allow VMM to directly access guest private memory.
> Any memory that is required for communication with the VMM must be
> shared explicitly. The same rule applies for any DMA to and from the
> TDX guest. All DMA pages have to be marked as shared pages. A generic way
> to achieve this without any changes to device drivers is to use the
> SWIOTLB framework.
>
> In TDX guest, CC_ATTR_GUEST_MEM_ENCRYPT is set. It makes all DMA to be
> rerouted via SWIOTLB (see pci_swiotlb_detect()). mem_encrypt_init()
> generalized to cover TDX. It makes SWIOTLB buffer shared.
It would be nice to have one transition paragraph to link the last one
to this:
The previous patch ("Add support for TDX shared memory") gave TDX guests
the _ability_ to make some pages shared, but did not actually make any
pages shared. This actually marks SWIOTLB buffers *as* shared.
Start returning true for cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) in
TDX guests. This has several implications:
* Allows the existing mem_encrypt_init() to be used for TDX which
sets SWIOTLB buffers shared (aka. "decrypted").
* Ensures that all DMA is routed via the SWIOTLB mechanism (see
pci_swiotlb_detect())
> Stop selecting DYNAMIC_PHYSICAL_MASK directly. It will get set
> indirectly by selcting X86_MEM_ENCRYPT.
^ selecting
> mem_encrypt_init() is currently under an AMD-specific #ifdef. Move it to
> a generic area of the header.
That new paragraph was kinda funky. With the changelog improvements above:
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
next prev parent reply other threads:[~2022-03-18 15:53 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-18 15:30 [PATCHv7 00/30] TDX Guest: TDX core support Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 01/30] x86/tdx: Detect running as a TDX guest in early boot Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 02/30] x86/tdx: Provide common base for SEAMCALL and TDCALL C wrappers Kirill A. Shutemov
2022-03-19 14:48 ` Borislav Petkov
2022-03-21 15:52 ` Kirill A. Shutemov
2022-03-21 16:02 ` [PATCHv7.1 " Kirill A. Shutemov
2022-04-04 3:19 ` Kai Huang
2022-04-04 3:25 ` Kai Huang
2022-04-04 13:51 ` Dave Hansen
2022-04-04 23:35 ` Kai Huang
2022-04-05 0:01 ` Dave Hansen
2022-04-05 0:23 ` Kai Huang
2022-04-08 20:12 ` Dave Hansen
2022-03-18 15:30 ` [PATCHv7 03/30] x86/tdx: Add __tdx_module_call() and __tdx_hypercall() helper functions Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 04/30] x86/tdx: Extend the confidential computing API to support TDX guests Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 05/30] x86/tdx: Exclude shared bit from __PHYSICAL_MASK Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 06/30] x86/traps: Refactor exc_general_protection() Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 07/30] x86/traps: Add #VE support for TDX guest Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 08/30] x86/tdx: Add HLT support for TDX guests Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 09/30] x86/tdx: Add MSR " Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 10/30] x86/tdx: Handle CPUID via #VE Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 11/30] x86/tdx: Handle in-kernel MMIO Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 12/30] x86/tdx: Detect TDX at early kernel decompression time Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 13/30] x86: Adjust types used in port I/O helpers Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 14/30] x86: Consolidate " Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 15/30] x86/boot: Port I/O: allow to hook up alternative helpers Kirill A. Shutemov
2022-03-18 16:04 ` [PATCHv7.1 " Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 16/30] x86/boot: Port I/O: add decompression-time support for TDX Kirill A. Shutemov
2022-03-18 16:05 ` [PATCHv7.1 " Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 17/30] x86/tdx: Port I/O: add runtime hypercalls Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 18/30] x86/tdx: Port I/O: add early boot support Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 19/30] x86/tdx: Wire up KVM hypercalls Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 20/30] x86/boot: Add a trampoline for booting APs via firmware handoff Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 21/30] x86/acpi, x86/boot: Add multiprocessor wake-up support Kirill A. Shutemov
2022-03-18 18:23 ` Dave Hansen
2022-03-18 19:22 ` Dave Hansen
2022-03-24 15:24 ` Kirill A. Shutemov
2022-03-28 19:17 ` Dave Hansen
2022-03-30 23:16 ` Kirill A. Shutemov
2022-03-30 23:44 ` Dave Hansen
2022-03-31 1:52 ` Kirill A. Shutemov
2022-04-01 17:33 ` Dave Hansen
2022-03-18 15:30 ` [PATCHv7 22/30] x86/boot: Set CR0.NE early and keep it set during the boot Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 23/30] x86/boot: Avoid #VE during boot for TDX platforms Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 24/30] x86/topology: Disable CPU online/offline control for TDX guests Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 25/30] x86/tdx: Make pages shared in ioremap() Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 26/30] x86/mm/cpa: Add support for TDX shared memory Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 27/30] x86/mm: Make DMA memory shared for TD guest Kirill A. Shutemov
2022-03-18 15:53 ` Dave Hansen [this message]
2022-03-18 15:30 ` [PATCHv7 28/30] x86/tdx: ioapic: Add shared bit for IOAPIC base address Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 29/30] ACPICA: Avoid cache flush inside virtual machines Kirill A. Shutemov
2022-03-18 15:30 ` [PATCHv7 30/30] Documentation/x86: Document TDX kernel architecture Kirill A. Shutemov
2022-04-04 4:32 ` Kai Huang
2022-04-04 6:25 ` Dave Hansen
2022-04-04 7:23 ` Kai Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f9c71fde-714e-9e0a-48ec-05be1ce6d76b@intel.com \
--to=dave.hansen@intel.com \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=dan.j.williams@intel.com \
--cc=david@redhat.com \
--cc=hpa@zytor.com \
--cc=jgross@suse.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=jpoimboe@redhat.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=knsathya@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=sdeep@vmware.com \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tony.luck@intel.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).