linux-kernel - Re: [GIT PULL] KVM: x86: SNP CipherTextHiding for 6.18

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABgObfY0xtd1nB74deM3xNinFkb1tixHL0WYMd=qmT77tTCLAA@mail.gmail.com>
Date: Tue, 30 Sep 2025 19:35:40 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] KVM: x86: SNP CipherTextHiding for 6.18

On Sat, Sep 27, 2025 at 8:09 AM Sean Christopherson <seanjc@...gle.com> wrote:
>
> The tag has all the details of the feature.  Note that this is based directly
> on the v6.18-ccp tag from the cryptodev tree.  I included all of the ccp
> commits in the shortlog just in case the KVM pull request lands before the
> crypto pull request.
>
> The following changes since commit 8f5ae30d69d7543eee0d70083daf4de8fe15d585:
>
>   Linux 6.17-rc1 (2025-08-10 19:41:16 +0300)
>
> are available in the Git repository at:
>
>   https://github.com/kvm-x86/linux.git tags/kvm-x86-ciphertext-6.18

Pulled, thanks.

Paolo

> for you to fetch changes up to 6c7c620585c6537dd5dcc75f972b875caf00f773:
>
>   KVM: SEV: Add SEV-SNP CipherTextHiding support (2025-09-15 10:14:11 -0700)
>
> ----------------------------------------------------------------
> KVM SEV-SNP CipherText Hiding support for 6.18
>
> Add support for SEV-SNP's CipherText Hiding, an opt-in feature that prevents
> unauthorized CPU accesses from reading the ciphertext of SNP guest private
> memory, e.g. to attempt an offline attack.  Instead of ciphertext, the CPU
> will always read back all FFs when CipherText Hiding is enabled.
>
> Add new module parameter to the KVM module to enable CipherText Hiding and
> control the number of ASIDs that can be used for VMs with CipherText Hiding,
> which is in effect the number of SNP VMs.  When CipherText Hiding is enabled,
> the hared SEV-ES/SEV-SNP ASID space is split into separate ranges for SEV-ES
> and SEV-SNP guests, i.e. ASIDs that can be used for CipherText Hiding cannot
> be used to run SEV-ES guests.
>
> ----------------------------------------------------------------
> Ashish Kalra (7):
>       crypto: ccp - New bit-field definitions for SNP_PLATFORM_STATUS command
>       crypto: ccp - Cache SEV platform status and platform state
>       crypto: ccp - Add support for SNP_FEATURE_INFO command
>       crypto: ccp - Introduce new API interface to indicate SEV-SNP Ciphertext hiding feature
>       crypto: ccp - Add support to enable CipherTextHiding on SNP_INIT_EX
>       KVM: SEV: Introduce new min,max sev_es and sev_snp asid variables
>       KVM: SEV: Add SEV-SNP CipherTextHiding support
>
>  Documentation/admin-guide/kernel-parameters.txt |  21 ++++
>  arch/x86/kvm/svm/sev.c                          |  68 +++++++++++--
>  drivers/crypto/ccp/sev-dev.c                    | 127 +++++++++++++++++++++---
>  drivers/crypto/ccp/sev-dev.h                    |   6 +-
>  include/linux/psp-sev.h                         |  44 +++++++-
>  include/uapi/linux/psp-sev.h                    |  10 +-
>  6 files changed, 249 insertions(+), 27 deletions(-)
>