Re: [PATCH v12 27/29] crypto: ccp: Add the SNP_VLEK_LOAD command

[Tom Lendacky]

On 3/29/24 17:58, Michael Roth wrote:
> When requesting an attestation report a guest is able to specify whether
> it wants SNP firmware to sign the report using either a Versioned Chip
> Endorsement Key (VCEK), which is derived from chip-unique secrets, or a
> Versioned Loaded Endorsement Key (VLEK) which is obtained from an AMD
> Key Derivation Service (KDS) and derived from seeds allocated to
> enrolled cloud service providers (CSPs).
>
> For VLEK keys, an SNP_VLEK_LOAD SNP firmware command is used to load
> them into the system after obtaining them from the KDS. Add a
> corresponding userspace interface so to allow the loading of VLEK keys
> into the system.
>
> See SEV-SNP Firmware ABI 1.54, SNP_VLEK_LOAD for more details.
>
> Signed-off-by: Michael Roth <michael.roth@xxxxxxx>

Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>