KVM SEV-SNP CipherText Hiding support for 6.18 Add support for SEV-SNP's CipherText Hiding, an opt-in feature that prevents unauthorized CPU accesses from reading the ciphertext of SNP guest private memory, e.g. to attempt an offline attack. Instead of ciphertext, the CPU will always read back all FFs when CipherText Hiding is enabled. Add new module parameter to the KVM module to enable CipherText Hiding and control the number of ASIDs that can be used for VMs with CipherText Hiding, which is in effect the number of SNP VMs. When CipherText Hiding is enabled, the shared SEV-ES/SEV-SNP ASID space is split into separate ranges for SEV-ES and SEV-SNP guests, i.e. ASIDs that can be used for CipherText Hiding cannot be used to run SEV-ES guests.
Showing the changes to include/uapi (1 of 6 files). Show all
Unified · Split
| @@ -185,6 +185,10 @@ struct sev_user_data_get_id2 { · 184 unmodified lines | |||
| 185 | * @mask_chip_id: whether chip id is present in attestation reports or not | 185 | * @mask_chip_id: whether chip id is present in attestation reports or not |
| 186 | * @mask_chip_key: whether attestation reports are signed or not | 186 | * @mask_chip_key: whether attestation reports are signed or not |
| 187 | * @vlek_en: VLEK (Version Loaded Endorsement Key) hashstick is loaded | 187 | * @vlek_en: VLEK (Version Loaded Endorsement Key) hashstick is loaded |
| 188 | * @feature_info: whether SNP_FEATURE_INFO command is available | ||
| 189 | * @rapl_dis: whether RAPL is disabled | ||
| 190 | * @ciphertext_hiding_cap: whether platform has ciphertext hiding capability | ||
| 191 | * @ciphertext_hiding_en: whether ciphertext hiding is enabled | ||
| 188 | * @rsvd1: reserved | 192 | * @rsvd1: reserved |
| 189 | * @guest_count: the number of guest currently managed by the firmware | 193 | * @guest_count: the number of guest currently managed by the firmware |
| 190 | * @current_tcb_version: current TCB version | 194 | * @current_tcb_version: current TCB version |
| @@ -200,7 +204,11 @@ struct sev_user_data_snp_status { · 9 unmodified lines | |||
| 200 | __u32 mask_chip_id:1; /* Out */ | 204 | __u32 mask_chip_id:1; /* Out */ |
| 201 | __u32 mask_chip_key:1; /* Out */ | 205 | __u32 mask_chip_key:1; /* Out */ |
| 202 | __u32 vlek_en:1; /* Out */ | 206 | __u32 vlek_en:1; /* Out */ |
| 203 | __u32 rsvd1:29; | 207 | __u32 feature_info:1; /* Out */ |
| 208 | __u32 rapl_dis:1; /* Out */ | ||
| 209 | __u32 ciphertext_hiding_cap:1; /* Out */ | ||
| 210 | __u32 ciphertext_hiding_en:1; /* Out */ | ||
| 211 | __u32 rsvd1:25; | ||
| 204 | __u32 guest_count; /* Out */ | 212 | __u32 guest_count; /* Out */ |
| 205 | __u64 current_tcb_version; /* Out */ | 213 | __u64 current_tcb_version; /* Out */ |
| 206 | __u64 reported_tcb_version; /* Out */ | 214 | __u64 reported_tcb_version; /* Out */ |