netdev - Re: [RFC PATCH V3 08/11] swiotlb: Add bounce buffer remap address setting function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Jun 2021 08:29:27 -0500
From:   Tom Lendacky <thomas.lendacky@....com>
To:     Christoph Hellwig <hch@....de>, Tianyu Lan <ltykernel@...il.com>
Cc:     kys@...rosoft.com, haiyangz@...rosoft.com, sthemmin@...rosoft.com,
        wei.liu@...nel.org, decui@...rosoft.com, tglx@...utronix.de,
        mingo@...hat.com, bp@...en8.de, x86@...nel.org, hpa@...or.com,
        arnd@...db.de, dave.hansen@...ux.intel.com, luto@...nel.org,
        peterz@...radead.org, akpm@...ux-foundation.org,
        kirill.shutemov@...ux.intel.com, rppt@...nel.org,
        hannes@...xchg.org, cai@....pw, krish.sadhukhan@...cle.com,
        saravanand@...com, Tianyu.Lan@...rosoft.com,
        konrad.wilk@...cle.com, m.szyprowski@...sung.com,
        robin.murphy@....com, boris.ostrovsky@...cle.com, jgross@...e.com,
        sstabellini@...nel.org, joro@...tes.org, will@...nel.org,
        xen-devel@...ts.xenproject.org, davem@...emloft.net,
        kuba@...nel.org, jejb@...ux.ibm.com, martin.petersen@...cle.com,
        iommu@...ts.linux-foundation.org, linux-arch@...r.kernel.org,
        linux-hyperv@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-scsi@...r.kernel.org, netdev@...r.kernel.org,
        vkuznets@...hat.com, brijesh.singh@....com, sunilmut@...rosoft.com
Subject: Re: [RFC PATCH V3 08/11] swiotlb: Add bounce buffer remap address
 setting function

On 6/14/21 2:12 AM, Christoph Hellwig wrote:
> On Mon, Jun 07, 2021 at 10:56:47PM +0800, Tianyu Lan wrote:
>> These addresses in extra address space works as system memory mirror. The 
>> shared memory with host in Isolation VM needs to be accessed via extra 
>> address space which is above shared gpa boundary.
> 
> Why?
> 

IIUC, this is using the vTOM feature of SEV-SNP. When this feature is
enabled for a VMPL level, any physical memory addresses below vTOM are
considered private/encrypted and any physical memory addresses above vTOM
are considered shared/unencrypted. With this option, you don't need a
fully enlightened guest that sets and clears page table encryption bits.
You just need the DMA buffers to be allocated in the proper range above vTOM.

See the section on "Virtual Machine Privilege Levels" in
https://www.amd.com/system/files/TechDocs/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf.

Thanks,
Tom