linux-kernel - Re: [PATCH v1 3/5] KVM: SEV: Provide support for SNP_EXTENDED_GUEST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15731bec-d137-4671-a580-c662fbef9c47@oracle.com>
Date: Fri, 21 Jun 2024 16:45:01 +0000
From: Liam Merwick <liam.merwick@...cle.com>
To: Michael Roth <michael.roth@....com>,
        "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>
CC: "linux-coco@...ts.linux.dev" <linux-coco@...ts.linux.dev>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        "pbonzini@...hat.com"
	<pbonzini@...hat.com>,
        "seanjc@...gle.com" <seanjc@...gle.com>,
        "jroedel@...e.de" <jroedel@...e.de>,
        "thomas.lendacky@....com"
	<thomas.lendacky@....com>,
        "pgonda@...gle.com" <pgonda@...gle.com>,
        "ashish.kalra@....com" <ashish.kalra@....com>,
        "bp@...en8.de" <bp@...en8.de>,
        "pankaj.gupta@....com" <pankaj.gupta@....com>,
        Liam Merwick
	<liam.merwick@...cle.com>
Subject: Re: [PATCH v1 3/5] KVM: SEV: Provide support for
 SNP_EXTENDED_GUEST_REQUEST NAE event

On 21/06/2024 14:40, Michael Roth wrote:
> Version 2 of GHCB specification added support for the SNP Extended Guest
> Request Message NAE event. This event serves a nearly identical purpose
> to the previously-added SNP_GUEST_REQUEST event, but for certain message
> types it allows the guest to supply a buffer to be used for additional
> information in some cases.
> 
> Currently the GHCB spec only defines extended handling of this sort in
> the case of attestation requests, where the additional buffer is used to
> supply a table of certificate data corresponding to the attestion

typo: attestion

> report's signing key. Support for this extended handling will require
> additional KVM APIs to handle coordinating with userspace.
> 
> Whether or not the hypervisor opts to provide this certificate data is
> optional. However, support for processing SNP_EXTENDED_GUEST_REQUEST
> GHCB requests is required by the GHCB 2.0 specification for SNP guests,
> so for now implement a stub implementation that provides an empty
> certificate table to the guest if it supplies an additional buffer, but
> otherwise behaves identically to SNP_GUEST_REQUEST.
> 
> Signed-off-by: Michael Roth <michael.roth@....com>

Reviewed-by: Liam Merwick <liam.merwick@...cle.com>


> ---
>   arch/x86/kvm/svm/sev.c | 60 ++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 60 insertions(+)