From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f170.google.com (mail-qt1-f170.google.com [209.85.160.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 171663E92AB for ; Fri, 15 May 2026 22:51:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778885477; cv=none; b=a4Z5JvcPnfg9743SgFKNfAY6xbNazFuHeoE4SVma9KPPQcOUrkJsPXd8ok2uqrQmEDC2xhw85koEm4IpQ9GYgM9Z2byWD//bvaiF88xqhXBdHyjrKCsRrcVVOGgimi+orUH26vCIW4XQguPvEwjCSMnmQ77iDlYuyHNPlD80YfE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778885477; c=relaxed/simple; bh=r4o8kNBsfNITnPuziuAzBiGGbEdWSyP9HN1hm0J0N4c=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=l4GysLD0u8iUGNfKvLKBbC/4u0yKLMwLwfMHN9gOMS226Lj+0MBq0pD+tHJ10/5e06atWnHtCIlqznEm3SXq5faouGIdv8z9ZaXNqp2Uj27xXadTaydqLZhcVuDNhUOyX8ANlpuVBkg6p6dAzogv78+QjVHEH+WG1FS7HGqJXxY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=Aa0y6wdw; arc=none smtp.client-ip=209.85.160.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="Aa0y6wdw" Received: by mail-qt1-f170.google.com with SMTP id d75a77b69052e-50e5c7eb565so5552011cf.3 for ; Fri, 15 May 2026 15:51:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1778885475; x=1779490275; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=immH+g/3RYXTN+iTjjy3LaccswRoDpZE21Qsh/sCfkE=; b=Aa0y6wdwQdQJLuCuY/J6Ayi18P0IsRvuPe0YESsaCTGj+OO0A5qnFHHcArUPwbkZGy /3ULnMIrCpJoEetah300odJn0ZTP7zL4u931d6v530FQLI+cKc6MytplXK7f42ZNmDye GYPbzLh5UN+19W7GlUtMnLQsSJDo6N8KbuHI+5McYxjwDz/40SaydbXb/viLnl8RQtMW eASlY0Wmk+GSzHnhIxDOIVQ2pV9i7V29UM2YfwziWKzwA4WBsNSh8f1XNAAtawSLWvjT OiG8OnZKZpXow0kNgbvekOLs0yITBrmUcJjN5cMA2Wy2UQtdit/RGN5NzF4+TYHl2Eiw xnTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778885475; x=1779490275; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=immH+g/3RYXTN+iTjjy3LaccswRoDpZE21Qsh/sCfkE=; b=SHuyLqpiUs2YZouJ0QE+KYOWQ6EFA1yXOOwJy50QqNhKrrCm1UsCNoCyjuCvZTDydc SsGgeXFh44eyjNPorPWWDDSo5d+oBl6tBgNa1aozPiwRRjCcYKyhccY24TTtZ2kjZhm6 2ztv36Ahzx364yNE9K/4q1jQ/TMy8HHSMrmKt4DdqlBRrLEpWxH/kDv7RrxD2Z6yI3m1 bKvmdybHd1Avi9oU+wdZcb3aMAqnKfDHpEp3/Owml57TjEaleZNeQ29Fv5NmJd6SZUdT m0OSQv9XPCnTah8NAvdZAp00BlbiQ6frS3gDi8dXC+WHKLuOpbvGQGsmyNf4UEpwN88Z /wnw== X-Forwarded-Encrypted: i=1; AFNElJ+mBKncGveURwi9oudErzN+lVTMfydUQG9/s6McAMyX6kPXb1CzlM9GDzw1XztdQZS3gRBm5+IDySb0hSo=@vger.kernel.org X-Gm-Message-State: AOJu0Yza0AfqhfWDI895aMvPTnVpSGlmn8DvRZNbmuvGdyzE5VOtbnV9 2t0RWwtOIUx0fFm+Qz0awmX+FbW7NYcA8nuzTcF8E1n1zDk4eRP+wifyAvLK4Kf5RmY= X-Gm-Gg: Acq92OGUo3HozU/BlTXhDJ2Tolilv5qkVJk5jOFKLSmUVpj+MTdcUNAjh3JxRDKSX6Y nV9U2ptoMd2mmVDTpp1w1PvroIArbUxarHFEhZlel6ZSmXL0DlfICYRx5WahNMwE7Km9AQYogQy qsh70Nym/lqQ84ohDNUnEOKlEwtIHbmRWVgsK8Uv66zmH5sQjA0mBFonVS+Utz7fFvd7lo0Lo/Z QqO10jrEnOwIE3upOcHE2kEvHDU8mUZefg9t8Eu5QY2heAd2XmQerI/6KL8pu0EB4roqBH6t/sg gQCtzXYFd8gjFC/KeH+nT7Hl0GC6zwKz5widvv7Zs33i01vctUxexOYdyGbvLKeHxxKVScJnMID vTnlYl6igsEx+6upkx/zJHgwZf27pvkulQVYtA8IacPr+LQbDeJdTPbbmEB1QrTstn+dXOaPO1X ut4Dsuy9mdKpnUUhPsYAOCkO/3aMjXxLTtiBH5J7Hh4FwGKl2jSSETv8KIZx/zyt9AJxznBTvGt t9LFw== X-Received: by 2002:a05:622a:590c:b0:50e:fcbc:6b7e with SMTP id d75a77b69052e-5165a275f74mr79497231cf.29.1778885475017; Fri, 15 May 2026 15:51:15 -0700 (PDT) Received: from ziepe.ca (crbknf0213w-47-54-130-67.pppoe-dynamic.high-speed.nl.bellaliant.net. [47.54.130.67]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5164585c5e0sm56735501cf.29.2026.05.15.15.51.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 15:51:14 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wO1NC-00000008Fgc-00Mh; Fri, 15 May 2026 19:51:14 -0300 Date: Fri, 15 May 2026 19:51:13 -0300 From: Jason Gunthorpe To: Mostafa Saleh Cc: "Aneesh Kumar K.V (Arm)" , iommu@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-coco@lists.linux.dev, Robin Murphy , Marek Szyprowski , Will Deacon , Marc Zyngier , Steven Price , Suzuki K Poulose , Catalin Marinas , Jiri Pirko , Petr Tesarik , Alexey Kardashevskiy , Dan Williams , Xu Yilun , linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , Alexander Gordeev , Gerald Schaefer , Heiko Carstens , Vasily Gorbik , Christian Borntraeger , Sven Schnelle , x86@kernel.org Subject: Re: [PATCH v4 04/13] dma: swiotlb: track pool encryption state and honor DMA_ATTR_CC_SHARED Message-ID: <20260515225113.GN7702@ziepe.ca> References: <20260512090408.794195-1-aneesh.kumar@kernel.org> <20260512090408.794195-5-aneesh.kumar@kernel.org> <20260513172450.GR7702@ziepe.ca> <20260514123529.GZ7702@ziepe.ca> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Thu, May 14, 2026 at 02:43:39PM +0000, Mostafa Saleh wrote: > > That's a somewhat different problem, we have the dev->trusted stuff > > that is supposed to deal with this kind of security. We need it for > > IOMMU based systems too, eg hot plug thunderbolt should have it. > > I see that it is used only for dma-iommu and for PCI devices. > However, I think that should be a problem with other CCA solutions > with emulated devices as they are untrusted. As I'd expect they > would have virtio devices. Yes, any security solution with an out of TCB device should be using either memory encryption so the kernel already bounces or this trusted stuff and a force strict dma-iommu so the dma layer is careful. This is more policy from userspace what devices they want in or out of their TCB. Like you make accept the device into T=1 but then still want to keep it out of your TCB with the vIOMMU, I can see good arguments for something like that. > > > While we can debate the aesthetics of the setup , this is > > > the exisitng behaviour for Linux, which existed for years > > > and pKVM relies on and is used extensively. > > > And, this patch alters that long-standing logic and introduces > > > a functional regression. > > > > Yeah, Aneesh needs to do something here, I'm pointing out it is > > entirely seperate thing from the CC path we are working on which is > > decoupling CC from reylying on force swiotlb. > > I am looking into converting pKVM to use the CC stuff, I replied with > a patch to Aneesh in this thread. However, I need to do more testing > and make sure there are not any unwanted consequences. Yeah, it is a nice patch and I think it will help reduce the complexity if it aligns to CCA type stuff. > > In a pkvm world it should be the same, the S2 table for the SMMU will > > control what the device can access, and if the SMMU points to a > > "private" or "shared" page is not something the device needs to know > > or care about. > > I see that's because dma-iommu chooses the attrs for iommu_map(). Long term the DMA API path through the dma-iommu will pass the ATTR_CC_SHARED through to iommu_map so when the arch requires a different IOPTE it can construct it. > In pKVM, dma_addr_t and IOPTE are the same for private and shared, > so nothing differs in that case. Yes, so you don't have to worry. > We don’t expect pass-through devices to interact with shared > memory (T=0) at the moment. > However, I can see use cases for that, where the host and the guest > collaborate with device passthrough and require zero copy. Once you add the CC patch it becomes immediately possible though because the user can allocate a CC shared DMA HEAP and feed that all over the place. > One other interesting case for device-passthrough is non-coherent > devices which then require private pools for bouncing. Why does shared/private matter for bouncing? Why do you need to bounce at all? Do cmo's not work in pkvm guests? Jason