From: Tianyu Lan <redacted> Sent: Monday, August 9, 2021 10:56 AM
Hyper-V provides two kinds of Isolation VMs. VBS(Virtualization-based
security) and AMD SEV-SNP unenlightened Isolation VMs. This patchset
is to add support for these Isolation VM support in Linux.
A general comment about this series: I have not seen any statements
made about whether either type of Isolated VM is supported for 32-bit
Linux guests. arch/x86/Kconfig has CONFIG_AMD_MEM_ENCRYPT as
64-bit only, so evidently SEV-SNP Isolated VMs would be 64-bit only.
But I don't know if VBS VMs are any different.
I didn't track down what happens if a 32-bit Linux is booted in
a VM that supports SEV-SNP. Presumably some kind of message
is output that no encryption is being done. But at a slightly
higher level, the Hyper-V initialization path should probably
also check for 32-bit and output a clear message that no isolation
is being provided. At that point, I don't know if it is possible to
continue in non-isolated mode or whether the only choice is to
panic. Continuing in non-isolated mode might be a bad idea
anyway since presumably the user has explicitly requested an
Isolated VM.
Related, I noticed usage of "unsigned long" for holding physical
addresses, which works when running 64-bit, but not when running
32-bit. But even if Isolated VMs are always 64-bit, it would be still be
better to clean this up and use phys_addr_t instead. Unfortunately,
more generic functions like set_memory_encrypted() and
set_memory_decrypted() have physical address arguments that
are of type unsigned long.
Michael