linux-kernel - Re: [PATCH 0/9] iommu/amd: Add AMD IOMMU emulation support for SEV-SNP guest kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 15 May 2024 02:02:12 +0700
From: "Suthikulpanit, Suravee" <suravee.suthikulpanit@....com>
To: Michael Kelley <mhklinux@...look.com>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "iommu@...ts.linux.dev" <iommu@...ts.linux.dev>,
 "joro@...tes.org" <joro@...tes.org>
Cc: "thomas.lendacky@....com" <thomas.lendacky@....com>,
 "vasant.hegde@....com" <vasant.hegde@....com>,
 "michael.roth@....com" <michael.roth@....com>,
 "jon.grimm@....com" <jon.grimm@....com>,
 "rientjes@...gle.com" <rientjes@...gle.com>
Subject: Re: [PATCH 0/9] iommu/amd: Add AMD IOMMU emulation support for
 SEV-SNP guest kernel



On 5/14/2024 3:05 AM, Michael Kelley wrote:
> From: Suravee Suthikulpanit<suravee.suthikulpanit@....com>  Sent: Tuesday, April 30, 2024 8:24 AM
>> To boot a VM w/ x2APIC ID > 255, guest interrupt remapping emulation
>> is required.
>
> Top-level question:  Is there a reason the MSI extended destination ID mechanism is
> insufficient to avoid the need for interrupt remapping?  (see function pointer
> "msi_ext_dest_id").  I'm unclear on whether it is or not. If it is not sufficient, perhaps
> you could explain why.

In case of running a Linux VM w/ QEMU/KVM as hypervisor, the 
qemu-system-x86_64 option kvm-msi-ext-dest-id=on would allow booting the 
VM w/ x2APIC ID > 255. However, for other hypervisor, it might not 
support this feature.

>> For SEV guest, this can be achieved using an emulated
>> AMD IOMMU.
> You've used "SEV" here and in several other places.  I think you intend this to be
> the more specific "SEV-SNP", and exclude SEV and SEV-ES. For avoid any confusion,
> I'd suggest using "SEV-SNP" throughout if that's what you mean.

Actually, The CC_ATTR_GUEST_MEM_ENCRYPT attribute is true for all SEV 
guests, so this will enable IOMMU emulation for all SEV guests.

Thanks,
Suravee

> Michael