On 20.02.2023 20:38, Michael Roth wrote:
> From: Brijesh Singh <brijesh.singh@xxxxxxx>
>
> AMD introduced the next generation of SEV called SEV-SNP (Secure Nested
> Paging). SEV-SNP builds upon existing SEV and SEV-ES functionality
> while adding new hardware security protection.
>
> Define the commands and structures used to communicate with the AMD-SP
> when creating and managing the SEV-SNP guests. The SEV-SNP firmware spec
> is available at developer.amd.com/sev.
>
> Co-developed-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> ---
> drivers/crypto/ccp/sev-dev.c | 16 +++
> include/linux/psp-sev.h | 247 +++++++++++++++++++++++++++++++++++
> include/uapi/linux/psp-sev.h | 44 +++++++
> 3 files changed, 307 insertions(+)
>
> diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> index 06fc7156c04f..9d84720a41d7 100644
> --- a/drivers/crypto/ccp/sev-dev.c
> +++ b/drivers/crypto/ccp/sev-dev.c
> @@ -126,6 +126,8 @@ static int sev_cmd_buffer_len(int cmd)
> switch (cmd) {
> case SEV_CMD_INIT: return sizeof(struct sev_data_init);
> case SEV_CMD_INIT_EX: return sizeof(struct sev_data_init_ex);
> + case SEV_CMD_SNP_SHUTDOWN_EX: return sizeof(struct sev_data_snp_shutdown_ex);
> + case SEV_CMD_SNP_INIT_EX: return sizeof(struct sev_data_snp_init_ex);
> case SEV_CMD_PLATFORM_STATUS: return sizeof(struct sev_user_data_status);
> case SEV_CMD_PEK_CSR: return sizeof(struct sev_data_pek_csr);
> case SEV_CMD_PEK_CERT_IMPORT: return sizeof(struct sev_data_pek_cert_import);
> @@ -154,6 +156,20 @@ static int sev_cmd_buffer_len(int cmd)
> case SEV_CMD_GET_ID: return sizeof(struct sev_data_get_id);
> case SEV_CMD_ATTESTATION_REPORT: return sizeof(struct sev_data_attestation_report);
> case SEV_CMD_SEND_CANCEL: return sizeof(struct sev_data_send_cancel);
> + case SEV_CMD_SNP_GCTX_CREATE: return sizeof(struct sev_data_snp_addr);
> + case SEV_CMD_SNP_LAUNCH_START: return sizeof(struct sev_data_snp_launch_start);
> + case SEV_CMD_SNP_LAUNCH_UPDATE: return sizeof(struct sev_data_snp_launch_update);
> + case SEV_CMD_SNP_ACTIVATE: return sizeof(struct sev_data_snp_activate);
> + case SEV_CMD_SNP_DECOMMISSION: return sizeof(struct sev_data_snp_addr);
> + case SEV_CMD_SNP_PAGE_RECLAIM: return sizeof(struct sev_data_snp_page_reclaim);
> + case SEV_CMD_SNP_GUEST_STATUS: return sizeof(struct sev_data_snp_guest_status);
> + case SEV_CMD_SNP_LAUNCH_FINISH: return sizeof(struct sev_data_snp_launch_finish);
> + case SEV_CMD_SNP_DBG_DECRYPT: return sizeof(struct sev_data_snp_dbg);
> + case SEV_CMD_SNP_DBG_ENCRYPT: return sizeof(struct sev_data_snp_dbg);
> + case SEV_CMD_SNP_PAGE_UNSMASH: return sizeof(struct sev_data_snp_page_unsmash);
> + case SEV_CMD_SNP_PLATFORM_STATUS: return sizeof(struct sev_data_snp_addr);
> + case SEV_CMD_SNP_GUEST_REQUEST: return sizeof(struct sev_data_snp_guest_request);
> + case SEV_CMD_SNP_CONFIG: return sizeof(struct sev_user_data_snp_config);
This needs SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX, SEV_CMD_SNP_COMMIT and
SEV_CMD_SNP_VLEK_LOAD from 1.54 ABI release.
> default: return 0;
> }
>
> +/**
> + * struct sev_user_data_snp_status - SNP status
> + *
> + * @major: API major version
> + * @minor: API minor version
> + * @state: current platform state
> + * @build: firmware build id for the API version
> + * @guest_count: the number of guest currently managed by the firmware
> + * @tcb_version: current TCB version
> + */
> +struct sev_user_data_snp_status {
> + __u8 api_major; /* Out */
> + __u8 api_minor; /* Out */
> + __u8 state; /* Out */
> + __u8 rsvd;
> + __u32 build_id; /* Out */
> + __u32 rsvd1;
> + __u32 guest_count; /* Out */
> + __u64 tcb_version; /* Out */
> + __u64 rsvd2;
> +} __packed;
Could you please update this to 1.54 ABI version?
Should include something along these lines:
diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h
index 60e7a8d1a18e..e9ebd24ef085 100644
--- a/include/uapi/linux/psp-sev.h
+++ b/include/uapi/linux/psp-sev.h
@@ -163,20 +163,29 @@ struct sev_user_data_get_id2 {
* @major: API major version
* @minor: API minor version
* @state: current platform state
+ * @is_rmp_initialized: whether RMP is initialized or not
* @build: firmware build id for the API version
+ * @mask_chip_id: whether chip id is present in attestation reports or not
+ * @mask_chip_key: whether attestation reports are signed or not
+ * @vlek_en: VLEK hashstick is loaded
* @guest_count: the number of guest currently managed by the firmware
- * @tcb_version: current TCB version
+ * @current_tcb_version: current TCB version
+ * @reported_tcb_version: reported TCB version
*/
struct sev_user_data_snp_status {
- __u8 api_major; /* Out */
- __u8 api_minor; /* Out */
- __u8 state; /* Out */
- __u8 rsvd;
- __u32 build_id; /* Out */
- __u32 rsvd1;
- __u32 guest_count; /* Out */
- __u64 tcb_version; /* Out */
- __u64 rsvd2;
+ __u8 api_major; /* Out */
+ __u8 api_minor; /* Out */
+ __u8 state; /* Out */
+ __u8 is_rmp_initialized:1; /* Out */
+ __u8 rsvd:7;
+ __u32 build_id; /* Out */
+ __u32 mask_chip_id:1; /* Out */
+ __u32 mask_chip_key:1; /* Out */
+ __u32 vlek_en:1; /* Out */
+ __u32 rsvd1:29;
+ __u32 guest_count; /* Out */
+ __u64 current_tcb_version; /* Out */
+ __u64 reported_tcb_version; /* Out */
} __packed;
/*
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
