Some confidential computing implementations only accept linear-map addresses in set_memory_decrypted(); for example, Arm CCA Realms reject vmalloc()/vmap() addresses. netvsc currently allocates its large send/receive buffers via vzalloc() and relies on vmbus_establish_gpadl() to decrypt them, which fails on those implementations.
This fix allocates the buffers as a list of physically-contiguous chunks, decrypts each chunk on its direct-map address, and vmap() them together. Here netvsc fully owns the encryption lifecycle and the vmbus layer must not call set_memory_decrypted() on establish or set_memory_encrypted() on teardown. Kameron Carr (2): Drivers: hv: vmbus: add vmbus_establish_gpadl_caller_decrypted() hv_netvsc: back GPADL buffers with kmalloc + decrypt + vmap drivers/hv/channel.c | 123 ++++++++++----- drivers/net/hyperv/hyperv_net.h | 18 ++- drivers/net/hyperv/netvsc.c | 271 ++++++++++++++++++++++++++++---- drivers/net/hyperv/netvsc_drv.c | 6 + include/linux/hyperv.h | 11 ++ 5 files changed, 354 insertions(+), 75 deletions(-) base-commit: a4ffc59238be84dd1c26bf1c001543e832674fc6 -- 2.45.4
