Support running Hygon TKM in CSV virtual machine #443
Conversation
hygon inclusion category: feature --------------------------- The data of the CSV VM is encrypted, so the ciphertext data of the CSV VM cannot be copied to the host kernel space for processing. This patch removes the old copy-based processing. Signed-off-by: xiongmengbiao <xiongmengbiao@hygon.cn>
hygon inclusion category: feature --------------------------- The CSV virtual machine puts the tkm command data into an encrypted 2MB hugepage space, then submits the command address GPA to the host kernel, then the host kernel converts the GPA to HPA, and finally submits the HPA to the PSP hardware. During the entire command forwarding process, since the data of the CSV virtual machine is encrypted, the host kernel cannot access the real TKM command data submitted by CSV. Signed-off-by: xiongmengbiao <xiongmengbiao@hygon.cn>
hygon inclusion category: bugfix --------------------------- CSV guests can run without SME enabled. Regardless of the host's SME status, the C-bit must be set for the physical address. Memory will be encrypted with a different key than SME. Signed-off-by: xiongmengbiao <xiongmengbiao@hygon.cn>
hygon inclusion category: feature --------------------------- When accessing the TKM from the host user space, DMA operations are performed using hugepages of memory, which are expected to be permanently fixed in the system. This patch provides a set of ioctl interfaces to pin memory pages to prevent migration. Signed-off-by: xiongmengbiao <xiongmengbiao@hygon.cn>
…_to_pfn hygon inclusion category: bugfix --------------------------- gfn_to_pfn causes the refcount to increment atomically by one, which needs to be released. Signed-off-by: niuyongwen <niuyongwen@hygon.cn>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @Amannix. Thanks for your PR. I'm waiting for a deepin-community member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
3 participants
Verification steps：
-mem2 base=512G,size=32M -device psp,vid=to the startup parameters. This will map 16 host-shared 2MB huge pages within the specified address range and bind them to the corresponding TKM key space.dmesgto check that the BIOS-e820 address range includes the [512G, 512G+32M) interval, indicating that the BIOS has provided the memory space set by the mem2 option to the kernel.memmap=32M$512Gto ensure that the kernel reserves the [512G, 512G+32M) memory range.Related QEMU PR: deepin-community/qemu#24