Re: [PATCH RFC v8 20/56] crypto:ccp: Define the SEV-SNP commands

[Sabin Rapan]

On 20.02.2023 20:38, Michael Roth wrote:
> From: Brijesh Singh <brijesh.singh@xxxxxxx>
> 
> AMD introduced the next generation of SEV called SEV-SNP (Secure Nested
> Paging). SEV-SNP builds upon existing SEV and SEV-ES functionality
> while adding new hardware security protection.
> 
> Define the commands and structures used to communicate with the AMD-SP
> when creating and managing the SEV-SNP guests. The SEV-SNP firmware spec
> is available at developer.amd.com/sev.
> 
> Co-developed-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> ---
>  drivers/crypto/ccp/sev-dev.c |  16 +++
>  include/linux/psp-sev.h      | 247 +++++++++++++++++++++++++++++++++++
>  include/uapi/linux/psp-sev.h |  44 +++++++
>  3 files changed, 307 insertions(+)
> 
> diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> index 06fc7156c04f..9d84720a41d7 100644
> --- a/drivers/crypto/ccp/sev-dev.c
> +++ b/drivers/crypto/ccp/sev-dev.c
> @@ -126,6 +126,8 @@ static int sev_cmd_buffer_len(int cmd)
>  	switch (cmd) {
>  	case SEV_CMD_INIT:			return sizeof(struct sev_data_init);
>  	case SEV_CMD_INIT_EX:                   return sizeof(struct sev_data_init_ex);
> +	case SEV_CMD_SNP_SHUTDOWN_EX:		return sizeof(struct sev_data_snp_shutdown_ex);
> +	case SEV_CMD_SNP_INIT_EX:		return sizeof(struct sev_data_snp_init_ex);
>  	case SEV_CMD_PLATFORM_STATUS:		return sizeof(struct sev_user_data_status);
>  	case SEV_CMD_PEK_CSR:			return sizeof(struct sev_data_pek_csr);
>  	case SEV_CMD_PEK_CERT_IMPORT:		return sizeof(struct sev_data_pek_cert_import);
> @@ -154,6 +156,20 @@ static int sev_cmd_buffer_len(int cmd)
>  	case SEV_CMD_GET_ID:			return sizeof(struct sev_data_get_id);
>  	case SEV_CMD_ATTESTATION_REPORT:	return sizeof(struct sev_data_attestation_report);
>  	case SEV_CMD_SEND_CANCEL:		return sizeof(struct sev_data_send_cancel);
> +	case SEV_CMD_SNP_GCTX_CREATE:		return sizeof(struct sev_data_snp_addr);
> +	case SEV_CMD_SNP_LAUNCH_START:		return sizeof(struct sev_data_snp_launch_start);
> +	case SEV_CMD_SNP_LAUNCH_UPDATE:		return sizeof(struct sev_data_snp_launch_update);
> +	case SEV_CMD_SNP_ACTIVATE:		return sizeof(struct sev_data_snp_activate);
> +	case SEV_CMD_SNP_DECOMMISSION:		return sizeof(struct sev_data_snp_addr);
> +	case SEV_CMD_SNP_PAGE_RECLAIM:		return sizeof(struct sev_data_snp_page_reclaim);
> +	case SEV_CMD_SNP_GUEST_STATUS:		return sizeof(struct sev_data_snp_guest_status);
> +	case SEV_CMD_SNP_LAUNCH_FINISH:		return sizeof(struct sev_data_snp_launch_finish);
> +	case SEV_CMD_SNP_DBG_DECRYPT:		return sizeof(struct sev_data_snp_dbg);
> +	case SEV_CMD_SNP_DBG_ENCRYPT:		return sizeof(struct sev_data_snp_dbg);
> +	case SEV_CMD_SNP_PAGE_UNSMASH:		return sizeof(struct sev_data_snp_page_unsmash);
> +	case SEV_CMD_SNP_PLATFORM_STATUS:	return sizeof(struct sev_data_snp_addr);
> +	case SEV_CMD_SNP_GUEST_REQUEST:		return sizeof(struct sev_data_snp_guest_request);
> +	case SEV_CMD_SNP_CONFIG:		return sizeof(struct sev_user_data_snp_config);

This needs SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX, SEV_CMD_SNP_COMMIT and
SEV_CMD_SNP_VLEK_LOAD from 1.54 ABI release.

>  	default:				return 0;
>  	}
>  
> +/**
> + * struct sev_user_data_snp_status - SNP status
> + *
> + * @major: API major version
> + * @minor: API minor version
> + * @state: current platform state
> + * @build: firmware build id for the API version
> + * @guest_count: the number of guest currently managed by the firmware
> + * @tcb_version: current TCB version
> + */
> +struct sev_user_data_snp_status {
> +	__u8 api_major;		/* Out */
> +	__u8 api_minor;		/* Out */
> +	__u8 state;		/* Out */
> +	__u8 rsvd;
> +	__u32 build_id;		/* Out */
> +	__u32 rsvd1;
> +	__u32 guest_count;	/* Out */
> +	__u64 tcb_version;	/* Out */
> +	__u64 rsvd2;
> +} __packed;

Could you please update this to 1.54 ABI version?
Should include something along these lines:

diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h
index 60e7a8d1a18e..e9ebd24ef085 100644
--- a/include/uapi/linux/psp-sev.h
+++ b/include/uapi/linux/psp-sev.h
@@ -163,20 +163,29 @@ struct sev_user_data_get_id2 {
  * @major: API major version
  * @minor: API minor version
  * @state: current platform state
+ * @is_rmp_initialized: whether RMP is initialized or not
  * @build: firmware build id for the API version
+ * @mask_chip_id: whether chip id is present in attestation reports or not
+ * @mask_chip_key: whether attestation reports are signed or not
+ * @vlek_en: VLEK hashstick is loaded
  * @guest_count: the number of guest currently managed by the firmware
- * @tcb_version: current TCB version
+ * @current_tcb_version: current TCB version
+ * @reported_tcb_version: reported TCB version
  */
 struct sev_user_data_snp_status {
-       __u8 api_major;         /* Out */
-       __u8 api_minor;         /* Out */
-       __u8 state;             /* Out */
-       __u8 rsvd;
-       __u32 build_id;         /* Out */
-       __u32 rsvd1;
-       __u32 guest_count;      /* Out */
-       __u64 tcb_version;      /* Out */
-       __u64 rsvd2;
+       __u8 api_major;             /* Out */
+       __u8 api_minor;             /* Out */
+       __u8 state;                 /* Out */
+       __u8 is_rmp_initialized:1;  /* Out */
+       __u8 rsvd:7;
+       __u32 build_id;             /* Out */
+       __u32 mask_chip_id:1;       /* Out */
+       __u32 mask_chip_key:1;      /* Out */
+       __u32 vlek_en:1;            /* Out */
+       __u32 rsvd1:29;
+       __u32 guest_count;          /* Out */
+       __u64 current_tcb_version;  /* Out */
+       __u64 reported_tcb_version; /* Out */
 } __packed;

 /*



Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.