Virtualization - Oct 2021 - [PATCH v5 16/16] x86/tdx: Add cmdline option to force use of ioremap_host_shared

On Mon, Oct 11, 2021 at 10:35:18AM -0700, Andi Kleen
wrote:
> 
> > Presumably bios code is in arch/x86 and drivers/acpi, right?
> > Up to 200 calls the majority of which is likely private ...
> 
> Yes.
> 
> > I don't have better ideas but the current setup will just
> > result in people making their guests vulnerable whenever they
> > want to allow device pass-through.
> 
> 
> Yes that's true. For current TDX our target is virtual devices only.
But if
> pass through usage will be really wide spread we may need to revisit.
> 
> 
> -Andi
I mean ... it's already wide spread. If we support it with TDX
it will be used with TDX. If we don't then I guess it won't,
exposing this kind of limitation in a userspace visible way isn't great
though. I guess it boils down to the fact that
ioremap_host_shared is just not a great interface, users simply
have no idea whether a given driver uses ioremap.

-- 
MST

> I mean ... it's already wide spread.

I meant wide spread usage with confidential guests.
> If we support it with TDX
> it will be used with TDX.
It has some security trade offs. The main reason to use TDX is security. 
Also when people take the VT-d tradeoffs they might be ok with the BIOS 
trade offs too.

-Andi