[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <dd988a9d-edad-4362-a4c2-a6e6b1667e9b@linux.microsoft.com>
Date: Tue, 13 May 2025 09:24:43 -0700
From: Roman Kisel <romank@...ux.microsoft.com>
To: ALOK TIWARI <alok.a.tiwari@...cle.com>
Cc: apais@...rosoft.com, benhill@...rosoft.com, bperkins@...rosoft.com,
sunilmut@...rosoft.com, arnd@...db.de, bp@...en8.de,
catalin.marinas@....com, corbet@....net, dave.hansen@...ux.intel.com,
decui@...rosoft.com, haiyangz@...rosoft.com, hpa@...or.com,
kys@...rosoft.com, mingo@...hat.com, tglx@...utronix.de, wei.liu@...nel.org,
will@...nel.org, x86@...nel.org, linux-hyperv@...r.kernel.org,
linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, linux-arch@...r.kernel.org
Subject: Re: [PATCH hyperv-next v2 1/4] Documentation: hyperv: Confidential
VMBus
On 5/11/2025 10:22 PM, ALOK TIWARI wrote:
>
>
> On 12-05-2025 04:37, Roman Kisel wrote:
>> Define what the confidential VMBus is and describe what advantages
>> it offers on the capable hardware.
>>
>> Signed-off-by: Roman Kisel <romank@...ux.microsoft.com>
>> ---
>> Documentation/virt/hyperv/vmbus.rst | 41 +++++++++++++++++++++++++++++
>> 1 file changed, 41 insertions(+)
>>
>> diff --git a/Documentation/virt/hyperv/vmbus.rst b/Documentation/virt/
>> hyperv/vmbus.rst
>> index 1dcef6a7fda3..ca2b948e5070 100644
>> --- a/Documentation/virt/hyperv/vmbus.rst
>> +++ b/Documentation/virt/hyperv/vmbus.rst
>> @@ -324,3 +324,44 @@ rescinded, neither Hyper-V nor Linux retains any
>> state about
>> its previous existence. Such a device might be re-added later,
>> in which case it is treated as an entirely new device. See
>> vmbus_onoffer_rescind().
>> +
>> +Confidential VMBus
>> +------------------
>> +
>
> The purpose and benefits of the Confidential VMBus are not clearly stated.
> for example:
> "Confidential VMBus provides a secure communication channel between
> guest and paravisor, ensuring that sensitive data is protected from
> hypervisor-level access through memory encryption and register state
> isolation."
>
>> +The confidential VMBus provides the control and data planes where
>> +the guest doesn't talk to either the hypervisor or the host. Instead,
>> +it relies on the trusted paravisor. The hardware (SNP or TDX) encrypts
>> +the guest memory and the register state also measuring the paravisor
>
> s/alos/while and s/via using/using
> "register state while measuring the paravisor image using the platform
> security"
>
>> +image via using the platform security processor to ensure trusted and
>> +confidential computing.
>> +
>> +To support confidential communication with the paravisor, a VMBus client
>> +will first attempt to use regular, non-isolated mechanisms for
>> communication.
>> +To do this, it must:
>> +
>> +* Configure the paravisor SIMP with an encrypted page. The paravisor
>> SIMP is
>> + configured by setting the relevant MSR directly, without using GHCB
>> or tdcall.
>> +
>> +* Enable SINT 2 on both the paravisor and hypervisor, without setting
>> the proxy
>> + flag on the paravisor SINT. Enable interrupts on the paravisor SynIC.
>> +
>> +* Configure both the paravisor and hypervisor event flags page.
>> + Both pages will need to be scanned when VMBus receives a channel
>> interrupt.
>> +
>> +* Send messages to the paravisor by calling HvPostMessage directly,
>> without using
>> + GHCB or tdcall.
>> +
>> +* Set the EOM MSR directly in the paravisor, without using GHCB or
>> tdcall.
>> +
>> +If sending the InitiateContact message using non-isolated
>> HvPostMessage fails,
>> +the client must fall back to using the hypervisor synic, by using the
>> GHCB/tdcall
>> +as appropriate.
>> +
>> +To fall back, the client will have to reconfigure the following:
>> +
>> +* Configure the hypervisor SIMP with a host-visible page.
>> + Since the hypervisor SIMP is not used when in confidential mode,
>> + this can be done up front, or only when needed, whichever makes
>> sense for
>> + the particular implementation.
>
> "SIMP is not used in confidential mode,
> this can be done either upfront or only when needed, depending on the
> specific implementation."
>
>> +
>> +* Set the proxy flag on SINT 2 for the paravisor.
>
Alok, thanks for you continued interest and support! I'll incorporate
your suggestions in the next version of the patchset, great points!
>
> Thanks,
> Alok
>
--
Thank you,
Roman
Powered by blists - more mailing lists