linux-kernel - Re: [PATCH v7 0/2] SEV-SNP: Add KVM support for SNP certificate fetching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <df5734e6-c41e-4f3a-bc63-21e6b083fdc9@oracle.com>
Date: Tue, 13 Jan 2026 12:23:50 +0000
From: Liam Merwick <liam.merwick@...cle.com>
To: Michael Roth <michael.roth@....com>, kvm@...r.kernel.org
Cc: linux-coco@...ts.linux.dev, linux-kernel@...r.kernel.org,
        pbonzini@...hat.com, seanjc@...gle.com, jroedel@...e.de,
        thomas.lendacky@....com, huibo.wang@....com, liam.merwick@...cle.com
Subject: Re: [PATCH v7 0/2] SEV-SNP: Add KVM support for SNP certificate
 fetching



On 09/01/2026 23:17, Michael Roth wrote:
> This patchset is also available at:
> 
>    https://github.com/amdese/linux/commits/snp-certs-v7
> 
> and is based on top of kvm/next (0499add8efd7)
> 
> 
> Overview
> --------
> 
> The GHCB 2.0 specification defines 2 GHCB request types to allow SNP guests
> to send encrypted messages/requests to firmware: SNP Guest Requests and SNP
> Extended Guest Requests. These encrypted messages are used for things like
> servicing attestation requests issued by the guest. Implementing support for
> these is required to be fully GHCB-compliant.
> 

(...)

> 
> Changes since v6:
> 
>   * Incorporate documentation/comment suggestions from Sean, along with
>     additional clarity/grammar fixups.
>   * Don't define SNP_GUEST_VMM_ERR_GENERIC for general use within kernel,
>     instead limit it to a KVM-specific choice of value in lieu of any
>     formally-defined guest message return code for generic/undefined errors.
>   * switch struct kvm_exit_snp_req_certs to using a 'gpa' argument instead
>     of 'gfn' (Sean)
>   * rebase to kvm/next, re-test, and collect R-b/T-b's
> 

v7 also
Tested-by: Liam Merwick <liam.merwick@...cle.com>


(...)
> 
> ----------------------------------------------------------------
> Michael Roth (2):
>        KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching
>        KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command
> 
>   Documentation/virt/kvm/api.rst                     | 44 ++++++++++++
>   .../virt/kvm/x86/amd-memory-encryption.rst         | 52 ++++++++++++++-
>   arch/x86/include/uapi/asm/kvm.h                    |  2 +
>   arch/x86/kvm/svm/sev.c                             | 78 ++++++++++++++++++++--
>   arch/x86/kvm/svm/svm.h                             |  1 +
>   include/uapi/linux/kvm.h                           |  9 +++
>   6 files changed, 179 insertions(+), 7 deletions(-)
> 
> 
>