| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <96c66528-6149-4f5b-abb1-76b557f47927@linux.microsoft.com>
Date: Tue, 13 May 2025 09:26:08 -0700
From: Roman Kisel <romank@...ux.microsoft.com>
To: ALOK TIWARI <alok.a.tiwari@...cle.com>
Cc: apais@...rosoft.com, benhill@...rosoft.com, bperkins@...rosoft.com,
sunilmut@...rosoft.com, arnd@...db.de, bp@...en8.de,
catalin.marinas@....com, corbet@....net, dave.hansen@...ux.intel.com,
decui@...rosoft.com, haiyangz@...rosoft.com, hpa@...or.com,
kys@...rosoft.com, mingo@...hat.com, tglx@...utronix.de, wei.liu@...nel.org,
will@...nel.org, x86@...nel.org, linux-hyperv@...r.kernel.org,
linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, linux-arch@...r.kernel.org
Subject: Re: [PATCH hyperv-next v2 2/4] drivers: hyperv: VMBus protocol
version 6.0
On 5/12/2025 2:49 AM, ALOK TIWARI wrote:
>
>
> On 12-05-2025 04:37, Roman Kisel wrote:
>> The confidential VMBus is supported starting from the protocol
>> version 6.0 onwards.
>>
>> Update the relevant definitions, provide a function that returns
>> whether VMBus is condifential or not.
>
> typo condifential -> confidential
>
>>
>> Signed-off-by: Roman Kisel <romank@...ux.microsoft.com>
>> ---
>> drivers/hv/vmbus_drv.c | 12 ++++++
>> include/asm-generic/mshyperv.h | 1 +
>> include/linux/hyperv.h | 71 +++++++++++++++++++++++++---------
>> 3 files changed, 65 insertions(+), 19 deletions(-)
>>
>> diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
>> index 1d5c9dcf712e..e431978fa408 100644
>> --- a/drivers/hv/vmbus_drv.c
>> +++ b/drivers/hv/vmbus_drv.c
>> @@ -56,6 +56,18 @@ static long __percpu *vmbus_evt;
>> int vmbus_irq;
>> int vmbus_interrupt;
>> +/*
>> + * If the Confidential VMBus is used, the data on the "wire" is not
>> + * visible to either the host or the hypervisor.
>> + */
>> +static bool is_confidential;
>> +
>> +bool vmbus_is_confidential(void)
>> +{
>> + return is_confidential;
>> +}
>> +EXPORT_SYMBOL_GPL(vmbus_is_confidential);
>> +
>> /*
>> * The panic notifier below is responsible solely for unloading the
>> * vmbus connection, which is necessary in a panic event.
>> diff --git a/include/asm-generic/mshyperv.h b/include/asm-generic/
>> mshyperv.h
>> index 6c51a25ed7b5..96e0723d0720 100644
>> --- a/include/asm-generic/mshyperv.h
>> +++ b/include/asm-generic/mshyperv.h
>> @@ -377,6 +377,7 @@ static inline int hv_call_create_vp(int node, u64
>> partition_id, u32 vp_index, u3
>> return -EOPNOTSUPP;
>> }
>> #endif /* CONFIG_MSHV_ROOT */
>> +bool vmbus_is_confidential(void);
>> #if IS_ENABLED(CONFIG_HYPERV_VTL_MODE)
>> u8 __init get_vtl(void);
>> diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
>> index 1f310fbbc4f9..3cf48f29e6b4 100644
>> --- a/include/linux/hyperv.h
>> +++ b/include/linux/hyperv.h
>> @@ -265,16 +265,19 @@ static inline u32 hv_get_avail_to_write_percent(
>> * Linux kernel.
>> */
>> -#define VERSION_WS2008 ((0 << 16) | (13))
>> -#define VERSION_WIN7 ((1 << 16) | (1))
>> -#define VERSION_WIN8 ((2 << 16) | (4))
>> -#define VERSION_WIN8_1 ((3 << 16) | (0))
>> -#define VERSION_WIN10 ((4 << 16) | (0))
>> -#define VERSION_WIN10_V4_1 ((4 << 16) | (1))
>> -#define VERSION_WIN10_V5 ((5 << 16) | (0))
>> -#define VERSION_WIN10_V5_1 ((5 << 16) | (1))
>> -#define VERSION_WIN10_V5_2 ((5 << 16) | (2))
>> -#define VERSION_WIN10_V5_3 ((5 << 16) | (3))
>> +#define VMBUS_MAKE_VERSION(MAJ, MIN) ((((u32)MAJ) << 16) | (MIN))
>> +#define VERSION_WS2008 VMBUS_MAKE_VERSION(0, 13)
>> +#define VERSION_WIN7 VMBUS_MAKE_VERSION(1, 1)
>> +#define VERSION_WIN8 VMBUS_MAKE_VERSION(2, 4)
>> +#define VERSION_WIN8_1 VMBUS_MAKE_VERSION(3, 0)
>> +#define VERSION_WIN10 VMBUS_MAKE_VERSION(4, 0)
>> +#define VERSION_WIN10_V4_1 VMBUS_MAKE_VERSION(4, 1)
>> +#define VERSION_WIN10_V5 VMBUS_MAKE_VERSION(5, 0)
>> +#define VERSION_WIN10_V5_1 VMBUS_MAKE_VERSION(5, 1)
>> +#define VERSION_WIN10_V5_2 VMBUS_MAKE_VERSION(5, 2)
>> +#define VERSION_WIN10_V5_3 VMBUS_MAKE_VERSION(5, 3)
>> +#define VERSION_WIN_IRON VERSION_WIN10_V5_3
>> +#define VERSION_WIN_COPPER VMBUS_MAKE_VERSION(6, 0)
>> /* Make maximum size of pipe payload of 16K */
>> #define MAX_PIPE_DATA_PAYLOAD (sizeof(u8) * 16384)
>> @@ -335,14 +338,22 @@ struct vmbus_channel_offer {
>> } __packed;
>> /* Server Flags */
>> -#define VMBUS_CHANNEL_ENUMERATE_DEVICE_INTERFACE 1
>> -#define VMBUS_CHANNEL_SERVER_SUPPORTS_TRANSFER_PAGES 2
>> -#define VMBUS_CHANNEL_SERVER_SUPPORTS_GPADLS 4
>> -#define VMBUS_CHANNEL_NAMED_PIPE_MODE 0x10
>> -#define VMBUS_CHANNEL_LOOPBACK_OFFER 0x100
>> -#define VMBUS_CHANNEL_PARENT_OFFER 0x200
>> -#define VMBUS_CHANNEL_REQUEST_MONITORED_NOTIFICATION 0x400
>> -#define VMBUS_CHANNEL_TLNPI_PROVIDER_OFFER 0x2000
>> +#define VMBUS_CHANNEL_ENUMERATE_DEVICE_INTERFACE 0x0001
>> +/*
>> + * This flag indicates that the channel is offered by the paravisor,
>> and must
>> + * use encrypted memory for the channel ring buffer.
>> + */
>> +#define VMBUS_CHANNEL_CONFIDENTIAL_RING_BUFFER 0x0002
>> +/*
>> + * This flag indicates that the channel is offered by the paravisor,
>> and must
>> + * use encrypted memory for GPA direct packets and additional GPADLs.
>> + */
>> +#define VMBUS_CHANNEL_CONFIDENTIAL_EXTERNAL_MEMORY 0x0004
>> +#define VMBUS_CHANNEL_NAMED_PIPE_MODE 0x0010
>> +#define VMBUS_CHANNEL_LOOPBACK_OFFER 0x0100
>> +#define VMBUS_CHANNEL_PARENT_OFFER 0x0200
>> +#define VMBUS_CHANNEL_REQUEST_MONITORED_NOTIFICATION 0x0400
>> +#define VMBUS_CHANNEL_TLNPI_PROVIDER_OFFER 0x2000
>> struct vmpacket_descriptor {
>> u16 type;
>> @@ -621,6 +632,12 @@ struct vmbus_channel_relid_released {
>> u32 child_relid;
>> } __packed;
>> +/*
>> + * Used by the paravisor only, means that the encrypted ring buffers and
>> + * the encrypted external memory are supported
>
> Clearly convey the purpose of the flag, similar to the previous one
> For example ->"Indicates support for encrypted ring buffers and external
> memory, used exclusively by the paravisor."
>
Will do, appreciate your help!!
>> + */
>> +#define VMBUS_FEATURE_FLAG_CONFIDENTIAL_CHANNELS 0x10
>> +
>> struct vmbus_channel_initiate_contact {
>> struct vmbus_channel_message_header header;
>> u32 vmbus_version_requested;
>> @@ -630,7 +647,8 @@ struct vmbus_channel_initiate_contact {
>> struct {
>> u8 msg_sint;
>> u8 msg_vtl;
>> - u8 reserved[6];
>> + u8 reserved[2];
>> + u32 feature_flags; /* VMBus version 6.0 */
>> };
>> };
>> u64 monitor_page1;
>> @@ -1002,6 +1020,11 @@ struct vmbus_channel {
>> /* The max size of a packet on this channel */
>> u32 max_pkt_size;
>> +
>> + /* The ring buffer is encrypted */
>> + bool confidential_ring_buffer;
>> + /* The external memory is encrypted */
>> + bool confidential_external_memory;
>> };
>
> Thanks,
> Alok
>
--
Thank you,
Roman
Powered by blists - more mailing lists