Re: [PATCH 0/6] Add Hygon SEV support

[Lendacky, Thomas]

On 4/15/19 7:04 AM, Hao Feng wrote:
> Hygon SEV follows AMD SEV work flow, but uses China national standard
> cryptographic algorithms SM2/SM3/SM4 instead of (RSA, ECDSA,
> ECDH)/SHA/AES. Reuse most AMD SEV code path to support Hygon SEV,
> also adds 3 new commands(GM_PUBKEY_GEN, GM_GET_DIGEST,
> GM_VERIFY_DIGEST) to support SM2 key exchange protocol.
> 
> SM2 is based on ECC(Elliptic Curve Cryptography), and uses a special
> curve. It can be used in digital signature, key exchange and
> asymmetric cryptography. For key exchange, SM2 is similar to ECDH, but
> involves new random key, meaning the two sides need to exchange extra
> random public key besides their public key, that's why additional APIs
> are needed to support Hygon SEV.
> SM3 is a hash algorithm, similar to SHA-256.
> SM4 is a block cipher algorithm, similar to AES-128.
> 
> 1. GM_PUBKEY_GEN
> ----------------
> The command is used to get SM2 random public key from SEV firmware to
> compute share key.
> 
> Parameters:
> * GM_KEY_ID_PADDR (in) - Address of key ID for the random public key.
> * GM_KEY_ID_LEN (in) - Length of key ID.
> * GM_PUBKEY_PADDR (in) - Address of the random public key.
> * GM_PUBKEY_LEN (in,out) - Length of the random public key.
> 
> 2. GM_GET_DIGEST
> ----------------
> The command is used to get key digest from SEV firmware during SM2 key
> exchange, guest owner can check the digest to see if the key
> negotiation is successful or not.
> 
> Parameters:
> * HANDLE (in) - Guest handle
> * DIGEST_PADDR (in) - Address of the key digest
> * DIGEST_LEN (in, out) - Length of the key digest
> 
> 3. GM_VERIFY_DIGEST
> -------------------
> The command is used to send guest owner's key digest to SEV firmware
> during SM2 key exchange, firmware can check the digest to see if the
> negotiation is successful or not.
> 
> Parameters:
> * HANDLE (in) - Guest handle
> * DIGEST_PADDR (in) - Address of the key digest
> * DIGEST_LEN (in) - Length of the key digest
> 
> Already tested successfully on Hygon DhyanaPlus processor, also tested
> successfully on AMD EPYC processor, results show no side effect on
> current AMD SEV implementation.

You can't just randomly add commands to the SEV API.  You will need to
work with the SEV API specification owner to be sure there are not any
conflicts or other issues with what you are trying to do. Please work
with Richard Relph (Richard.Relph@xxxxxxx) on this.

For now, NAK on all of this.

Thanks,
Tom

> 
> Hao Feng (6):
>   crypto: ccp: Add Hygon Dhyana support
>   crypto: ccp: Define Hygon SEV commands
>   crypto: ccp: Implement SEV_GM_PUBKEY_GEN ioctl command
>   KVM: Define Hygon SEV commands
>   KVM: SVM: Add support for KVM_SEV_GM_GET_DIGEST command
>   KVM: SVM: Add KVM_SEV_GM_VERIFY_DIGEST command
> 
>  arch/x86/kvm/svm.c           | 119 +++++++++++++++++++++++++++++++++++++++++++
>  drivers/crypto/ccp/psp-dev.c |  86 +++++++++++++++++++++++++++++++
>  drivers/crypto/ccp/sp-pci.c  |   2 +
>  include/linux/psp-sev.h      |  49 ++++++++++++++++++
>  include/uapi/linux/kvm.h     |  14 +++++
>  include/uapi/linux/psp-sev.h |  17 +++++++
>  6 files changed, 287 insertions(+)
>