linux-kernel - Re: [PATCH v1] iommu/amd: Set C-bit only for RAM-backed PTEs in IOMMU page tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251023160154.GM262900@nvidia.com>
Date: Thu, 23 Oct 2025 13:01:54 -0300
From: Jason Gunthorpe <jgg@...dia.com>
To: Wei Wang <wei.w.wang@...mail.com>
Cc: suravee.suthikulpanit@....com, thomas.lendacky@....com, jroedel@...e.de,
	kevin.tian@...el.com, linux-kernel@...r.kernel.org,
	iommu@...ts.linux.dev
Subject: Re: [PATCH v1] iommu/amd: Set C-bit only for RAM-backed PTEs in
 IOMMU page tables

On Thu, Oct 23, 2025 at 11:15:43PM +0800, Wei Wang wrote:
> When SME is enabled, iommu_v1_map_pages() currently sets the C-bit for
> all physical addresses. This is correct for RAM, since the C-bit is
> required by SME to indicate encrypted memory and ensure proper
> encryption/decryption.
> 
> However, applying the C-bit to MMIO addresses is incorrect. Devices and
> PCIe switches do not interpret the C-bit currently, and doing so can break
> PCIe peer-to-peer communication. To avoid this, only set the C-bit when
> the physical address is backed by RAM, and leave MMIO mappings unchanged.
> 
> Fixes: 2543a786aa25 ("iommu/amd: Allow the AMD IOMMU to work with memory encryption")
> Signed-off-by: Wei Wang <wei.w.wang@...mail.com>
> ---
>  drivers/iommu/amd/io_pgtable.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/amd/io_pgtable.c b/drivers/iommu/amd/io_pgtable.c
> index 70c2f5b1631b..6f395940d0a4 100644
> --- a/drivers/iommu/amd/io_pgtable.c
> +++ b/drivers/iommu/amd/io_pgtable.c
> @@ -353,6 +353,9 @@ static int iommu_v1_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
>  	if (!(prot & IOMMU_PROT_MASK))
>  		goto out;
>  
> +	if (sme_me_mask && page_is_ram(PHYS_PFN(paddr)))
> +		paddr = __sme_set(paddr);

It needs to use the IOMMU_MMIO flag not page_is_ram, which I think got
mangled by the time it reached here..

Though broadly this points to a larger problem, the iommu domain code
should not be trying to guess if a mapping is private or not, this
needs to be passed in from higher level code which knows what state
the PFN is..

Jason