Re: [PATCH v2] KVM: SEV: Add KVM_SEV_SNP_HV_REPORT_REQ command

[Thomas Courrege]

On 12/5/25 3:28 PM, Tom Lendacky wrote:
> On 12/4/25 07:21, Thomas Courrege wrote:
>> On 12/2/25 8:29 PM, Tom Lendacky wrote:
>>
>>>> +
>>>> +e_free_rsp:
>>>> +	/* contains sensitive data */
>>>> +	memzero_explicit(report_rsp, PAGE_SIZE);
>>> Does it? What is sensitive that needs to be cleared?
>> Combine with others reports, it could allow to do an inventory of the guests,
>> which ones share the same author, measurement, policy...
>> It is not needed, but generating a report is not a common operation so
>> performance is not an issue here. What do you think is the best to do ?
> Can't userspace do that just by generating/requesting reports? If there
> are no keys, IVs, secrets, etc. in the memory, I don't see what the
> memzero_explicit() is accomplishing. Maybe I'm missing something here and
> others may have different advice.
You're right, and there's no warranty the userspace will memzero the report
And the SEV report isn't memzero too

Thanks, 
Thomas