Hygon SEV follows AMD SEV work flow, but uses China national standard cryptographic algorithms SM2/SM3/SM4 instead of (RSA, ECDSA, ECDH)/SHA/AES. Reuse most AMD SEV code path to support Hygon SEV, also adds 3 new commands(GM_PUBKEY_GEN, GM_GET_DIGEST, GM_VERIFY_DIGEST) to support SM2 key exchange protocol. SM2 is based on ECC(Elliptic Curve Cryptography), and uses a special curve. It can be used in digital signature, key exchange and asymmetric cryptography. For key exchange, SM2 is similar to ECDH, but involves new random key, meaning the two sides need to exchange extra random public key besides their public key, that's why additional APIs are needed to support Hygon SEV. SM3 is a hash algorithm, similar to SHA-256. SM4 is a block cipher algorithm, similar to AES-128. 1. GM_PUBKEY_GEN ---------------- The command is used to get SM2 random public key from SEV firmware to compute share key. Parameters: * GM_KEY_ID_PADDR (in) - Address of key ID for the random public key. * GM_KEY_ID_LEN (in) - Length of key ID. * GM_PUBKEY_PADDR (in) - Address of the random public key. * GM_PUBKEY_LEN (in,out) - Length of the random public key. 2. GM_GET_DIGEST ---------------- The command is used to get key digest from SEV firmware during SM2 key exchange, guest owner can check the digest to see if the key negotiation is successful or not. Parameters: * HANDLE (in) - Guest handle * DIGEST_PADDR (in) - Address of the key digest * DIGEST_LEN (in, out) - Length of the key digest 3. GM_VERIFY_DIGEST ------------------- The command is used to send guest owner's key digest to SEV firmware during SM2 key exchange, firmware can check the digest to see if the negotiation is successful or not. Parameters: * HANDLE (in) - Guest handle * DIGEST_PADDR (in) - Address of the key digest * DIGEST_LEN (in) - Length of the key digest Already tested successfully on Hygon DhyanaPlus processor, also tested successfully on AMD EPYC processor, results show no side effect on current AMD SEV implementation. Hao Feng (6): crypto: ccp: Add Hygon Dhyana support crypto: ccp: Define Hygon SEV commands crypto: ccp: Implement SEV_GM_PUBKEY_GEN ioctl command KVM: Define Hygon SEV commands KVM: SVM: Add support for KVM_SEV_GM_GET_DIGEST command KVM: SVM: Add KVM_SEV_GM_VERIFY_DIGEST command arch/x86/kvm/svm.c | 119 +++++++++++++++++++++++++++++++++++++++++++ drivers/crypto/ccp/psp-dev.c | 86 +++++++++++++++++++++++++++++++ drivers/crypto/ccp/sp-pci.c | 2 + include/linux/psp-sev.h | 49 ++++++++++++++++++ include/uapi/linux/kvm.h | 14 +++++ include/uapi/linux/psp-sev.h | 17 +++++++ 6 files changed, 287 insertions(+) -- 2.7.4
