On 20.02.2023 20:38, Michael Roth wrote: > From: Brijesh Singh <brijesh.singh@xxxxxxx> > > AMD introduced the next generation of SEV called SEV-SNP (Secure Nested > Paging). SEV-SNP builds upon existing SEV and SEV-ES functionality > while adding new hardware security protection. > > Define the commands and structures used to communicate with the AMD-SP > when creating and managing the SEV-SNP guests. The SEV-SNP firmware spec > is available at developer.amd.com/sev. > > Co-developed-by: Ashish Kalra <ashish.kalra@xxxxxxx> > Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx> > Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx> > Signed-off-by: Michael Roth <michael.roth@xxxxxxx> > --- > drivers/crypto/ccp/sev-dev.c | 16 +++ > include/linux/psp-sev.h | 247 +++++++++++++++++++++++++++++++++++ > include/uapi/linux/psp-sev.h | 44 +++++++ > 3 files changed, 307 insertions(+) > > diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c > index 06fc7156c04f..9d84720a41d7 100644 > --- a/drivers/crypto/ccp/sev-dev.c > +++ b/drivers/crypto/ccp/sev-dev.c > @@ -126,6 +126,8 @@ static int sev_cmd_buffer_len(int cmd) > switch (cmd) { > case SEV_CMD_INIT: return sizeof(struct sev_data_init); > case SEV_CMD_INIT_EX: return sizeof(struct sev_data_init_ex); > + case SEV_CMD_SNP_SHUTDOWN_EX: return sizeof(struct sev_data_snp_shutdown_ex); > + case SEV_CMD_SNP_INIT_EX: return sizeof(struct sev_data_snp_init_ex); > case SEV_CMD_PLATFORM_STATUS: return sizeof(struct sev_user_data_status); > case SEV_CMD_PEK_CSR: return sizeof(struct sev_data_pek_csr); > case SEV_CMD_PEK_CERT_IMPORT: return sizeof(struct sev_data_pek_cert_import); > @@ -154,6 +156,20 @@ static int sev_cmd_buffer_len(int cmd) > case SEV_CMD_GET_ID: return sizeof(struct sev_data_get_id); > case SEV_CMD_ATTESTATION_REPORT: return sizeof(struct sev_data_attestation_report); > case SEV_CMD_SEND_CANCEL: return sizeof(struct sev_data_send_cancel); > + case SEV_CMD_SNP_GCTX_CREATE: return sizeof(struct sev_data_snp_addr); > + case SEV_CMD_SNP_LAUNCH_START: return sizeof(struct sev_data_snp_launch_start); > + case SEV_CMD_SNP_LAUNCH_UPDATE: return sizeof(struct sev_data_snp_launch_update); > + case SEV_CMD_SNP_ACTIVATE: return sizeof(struct sev_data_snp_activate); > + case SEV_CMD_SNP_DECOMMISSION: return sizeof(struct sev_data_snp_addr); > + case SEV_CMD_SNP_PAGE_RECLAIM: return sizeof(struct sev_data_snp_page_reclaim); > + case SEV_CMD_SNP_GUEST_STATUS: return sizeof(struct sev_data_snp_guest_status); > + case SEV_CMD_SNP_LAUNCH_FINISH: return sizeof(struct sev_data_snp_launch_finish); > + case SEV_CMD_SNP_DBG_DECRYPT: return sizeof(struct sev_data_snp_dbg); > + case SEV_CMD_SNP_DBG_ENCRYPT: return sizeof(struct sev_data_snp_dbg); > + case SEV_CMD_SNP_PAGE_UNSMASH: return sizeof(struct sev_data_snp_page_unsmash); > + case SEV_CMD_SNP_PLATFORM_STATUS: return sizeof(struct sev_data_snp_addr); > + case SEV_CMD_SNP_GUEST_REQUEST: return sizeof(struct sev_data_snp_guest_request); > + case SEV_CMD_SNP_CONFIG: return sizeof(struct sev_user_data_snp_config); This needs SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX, SEV_CMD_SNP_COMMIT and SEV_CMD_SNP_VLEK_LOAD from 1.54 ABI release. > default: return 0; > } > > +/** > + * struct sev_user_data_snp_status - SNP status > + * > + * @major: API major version > + * @minor: API minor version > + * @state: current platform state > + * @build: firmware build id for the API version > + * @guest_count: the number of guest currently managed by the firmware > + * @tcb_version: current TCB version > + */ > +struct sev_user_data_snp_status { > + __u8 api_major; /* Out */ > + __u8 api_minor; /* Out */ > + __u8 state; /* Out */ > + __u8 rsvd; > + __u32 build_id; /* Out */ > + __u32 rsvd1; > + __u32 guest_count; /* Out */ > + __u64 tcb_version; /* Out */ > + __u64 rsvd2; > +} __packed; Could you please update this to 1.54 ABI version? Should include something along these lines: diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h index 60e7a8d1a18e..e9ebd24ef085 100644 --- a/include/uapi/linux/psp-sev.h +++ b/include/uapi/linux/psp-sev.h @@ -163,20 +163,29 @@ struct sev_user_data_get_id2 { * @major: API major version * @minor: API minor version * @state: current platform state + * @is_rmp_initialized: whether RMP is initialized or not * @build: firmware build id for the API version + * @mask_chip_id: whether chip id is present in attestation reports or not + * @mask_chip_key: whether attestation reports are signed or not + * @vlek_en: VLEK hashstick is loaded * @guest_count: the number of guest currently managed by the firmware - * @tcb_version: current TCB version + * @current_tcb_version: current TCB version + * @reported_tcb_version: reported TCB version */ struct sev_user_data_snp_status { - __u8 api_major; /* Out */ - __u8 api_minor; /* Out */ - __u8 state; /* Out */ - __u8 rsvd; - __u32 build_id; /* Out */ - __u32 rsvd1; - __u32 guest_count; /* Out */ - __u64 tcb_version; /* Out */ - __u64 rsvd2; + __u8 api_major; /* Out */ + __u8 api_minor; /* Out */ + __u8 state; /* Out */ + __u8 is_rmp_initialized:1; /* Out */ + __u8 rsvd:7; + __u32 build_id; /* Out */ + __u32 mask_chip_id:1; /* Out */ + __u32 mask_chip_key:1; /* Out */ + __u32 vlek_en:1; /* Out */ + __u32 rsvd1:29; + __u32 guest_count; /* Out */ + __u64 current_tcb_version; /* Out */ + __u64 reported_tcb_version; /* Out */ } __packed; /* Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.