linux-kernel - Re: [PATCH hyperv-next v3 01/15] Documentation: hyperv: Confidential VMBus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <615e0c5d-b516-49cd-907b-5b14dbeefb1c@oracle.com>
Date: Wed, 4 Jun 2025 18:50:50 +0530
From: ALOK TIWARI <alok.a.tiwari@...cle.com>
To: Roman Kisel <romank@...ux.microsoft.com>, arnd@...db.de, bp@...en8.de,
        corbet@....net, dave.hansen@...ux.intel.com, decui@...rosoft.com,
        haiyangz@...rosoft.com, hpa@...or.com, kys@...rosoft.com,
        mingo@...hat.com, mhklinux@...look.com, tglx@...utronix.de,
        wei.liu@...nel.org, linux-arch@...r.kernel.org,
        linux-doc@...r.kernel.org, linux-hyperv@...r.kernel.org,
        linux-kernel@...r.kernel.org, x86@...nel.org
Cc: apais@...rosoft.com, benhill@...rosoft.com, bperkins@...rosoft.com,
        sunilmut@...rosoft.com
Subject: Re: [PATCH hyperv-next v3 01/15] Documentation: hyperv: Confidential
 VMBus



On 04-06-2025 06:13, Roman Kisel wrote:
> +Confidential VMBus is an extension of Confidential Computing (CoCo) VMs
> +(a.k.a. "Isolated" VMs in Hyper-V terminology). Without Confidential VMBus,
> +guest VMBus device drivers (the "VSC"s in VMBus terminology) communicate
> +with VMBus servers (the VSPs) running on the Hyper-V host. The
> +communication must be through memory that has been decrypted so the
> +host can access it. With Confidential VMBus, one or more of the VSPs reside
> +in the trusted paravisor layer in the guest VM. Since the paravisor layer also
> +operates in encrypted memory, the memory used for communication with
> +such VSPs does not need to be decrypted and thereby exposed to the
> +Hyper-V host. The paravisor is responsible for communicating securely
> +with the Hyper-V host as necessary. In some cases (e.g. time synchonization,

Typo synchonization -> synchronization

> +key-value pairs exchange) the unencrypted data doesn't need to be communicated
> +with the host at all, and a conventional VMBus connection suffices.



Thanks,
Alok