github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 18:21:24 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

KVM: SEV: Add SEV-SNP CipherTextHiding support

Browse Source 
Ciphertext hiding prevents host accesses from reading the ciphertext of
SNP guest private memory. Instead of reading ciphertext, the host reads
will see constant default values (0xff).

The SEV ASID space is split into SEV and SEV-ES/SEV-SNP ASID ranges.
Enabling ciphertext hiding further splits the SEV-ES/SEV-SNP ASID space
into separate ASID ranges for SEV-ES and SEV-SNP guests.

Add a new off-by-default kvm-amd module parameter to enable ciphertext
hiding and allow the admin to configure the SEV-ES and SEV-SNP ASID
ranges. Simply cap the maximum SEV-SNP ASID as appropriate, i.e. don't
reject loading KVM or disable ciphertest hiding for a too-big value, as
KVM's general approach for module params is to sanitize inputs based on
hardware/kernel support, not burn the world down. This also allows the
admin to use -1u to assign all SEV-ES/SNP ASIDs to SNP without needing
dedicated handling in KVM.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
Co-developed-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/95abc49edfde36d4fb791570ea2a4be6ad95fd0d.1755721927.git.ashish.kalra@amd.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Ashish Kalra 2025-08-20 20:50:25 +00:00 committed by Sean Christopherson
parent d7fc7d9833
commit 6c7c620585
2 changed files with 52 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
Documentation/admin-guide/kernel-parameters.txt
View File

@ -2957,6 +2957,27 @@
(enabled). Disable by KVM if hardware lacks support
for NPT.
kvm-amd.ciphertext_hiding_asids=
[KVM,AMD] Ciphertext hiding prevents disallowed accesses
to SNP private memory from reading ciphertext. Instead,
reads will see constant default values (0xff).
If ciphertext hiding is enabled, the joint SEV-ES and
SEV-SNP ASID space is partitioned into separate SEV-ES
and SEV-SNP ASID ranges, with the SEV-SNP range being
[1..max_snp_asid] and the SEV-ES range being
(max_snp_asid..min_sev_asid), where min_sev_asid is
enumerated by CPUID.0x.8000_001F[EDX].
A non-zero value enables SEV-SNP ciphertext hiding and
adjusts the ASID ranges for SEV-ES and SEV-SNP guests.
KVM caps the number of SEV-SNP ASIDs at the maximum
possible value, e.g. specifying -1u will assign all
joint SEV-ES and SEV-SNP ASIDs to SEV-SNP. Note,
assigning all joint ASIDs to SEV-SNP, i.e. configuring
max_snp_asid == min_sev_asid-1, will effectively make
SEV-ES unusable.
kvm-arm.mode=
[KVM,ARM,EARLY] Select one of KVM/arm64's modes of
operation.

32
arch/x86/kvm/svm/sev.c
View File

@ -59,6 +59,9 @@ static bool sev_es_debug_swap_enabled = true;
module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444);
static u64 sev_supported_vmsa_features;
static unsigned int nr_ciphertext_hiding_asids;
module_param_named(ciphertext_hiding_asids, nr_ciphertext_hiding_asids, uint, 0444);
#define AP_RESET_HOLD_NONE 0
#define AP_RESET_HOLD_NAE_EVENT 1
#define AP_RESET_HOLD_MSR_PROTO 2
@ -201,6 +204,9 @@ static int sev_asid_new(struct kvm_sev_info *sev, unsigned long vm_type)
/*
* The min ASID can end up larger than the max if basic SEV support is
* effectively disabled by disallowing use of ASIDs for SEV guests.
* Similarly for SEV-ES guests the min ASID can end up larger than the
* max when ciphertext hiding is enabled, effectively disabling SEV-ES
* support.
*/
if (min_asid > max_asid)
return -ENOTTY;
@ -3068,10 +3074,32 @@ void __init sev_hardware_setup(void)
out:
if (sev_enabled) {
init_args.probe = true;
if (sev_is_snp_ciphertext_hiding_supported())
init_args.max_snp_asid = min(nr_ciphertext_hiding_asids,
min_sev_asid - 1);
if (sev_platform_init(&init_args))
sev_supported = sev_es_supported = sev_snp_supported = false;
else if (sev_snp_supported)
sev_snp_supported = is_sev_snp_initialized();
if (sev_snp_supported)
nr_ciphertext_hiding_asids = init_args.max_snp_asid;
/*
* If ciphertext hiding is enabled, the joint SEV-ES/SEV-SNP
* ASID range is partitioned into separate SEV-ES and SEV-SNP
* ASID ranges, with the SEV-SNP range being [1..max_snp_asid]
* and the SEV-ES range being (max_snp_asid..max_sev_es_asid].
* Note, SEV-ES may effectively be disabled if all ASIDs from
* the joint range are assigned to SEV-SNP.
*/
if (nr_ciphertext_hiding_asids) {
max_snp_asid = nr_ciphertext_hiding_asids;
min_sev_es_asid = max_snp_asid + 1;
pr_info("SEV-SNP ciphertext hiding enabled\n");
}
}
if (boot_cpu_has(X86_FEATURE_SEV))
@ -3082,7 +3110,9 @@ void __init sev_hardware_setup(void)
min_sev_asid, max_sev_asid);
if (boot_cpu_has(X86_FEATURE_SEV_ES))
pr_info("SEV-ES %s (ASIDs %u - %u)\n",
str_enabled_disabled(sev_es_supported),
sev_es_supported ? min_sev_es_asid <= max_sev_es_asid ? "enabled" :
"unusable" :
"disabled",
min_sev_es_asid, max_sev_es_asid);
if (boot_cpu_has(X86_FEATURE_SEV_SNP))
pr_info("SEV-SNP %s (ASIDs %u - %u)\n",