linux-kernel - [PATCH 0/6] Add Hygon SEV support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Apr 2019 20:04:22 +0800
From:   Hao Feng <fenghao@...on.cn>
To:     "'Tom Lendacky '" <thomas.lendacky@....com>,
        "'Gary Hook '" <gary.hook@....com>,
        "'Herbert Xu '" <herbert@...dor.apana.org.au>,
        "' David S. Miller '" <davem@...emloft.net>,
        "'Janakarajan Natarajan '" <Janakarajan.Natarajan@....com>,
        "'Joerg Roedel '" <joro@...tes.org>,
        "'Paolo Bonzini '" <pbonzini@...hat.com>,
        ' Radim Krčmář ' 
        <rkrcmar@...hat.com>, "'Thomas Gleixner '" <tglx@...utronix.de>,
        "'Ingo Molnar '" <mingo@...hat.com>,
        "'Borislav Petkov '" <bp@...en8.de>,
        "' H. Peter Anvin '" <hpa@...or.com>
CC:     "'Zhaohui Du '" <duzhaohui@...on.cn>,
        "'Zhiwei Ying '" <yingzhiwei@...on.cn>,
        "'Wen Pu '" <puwen@...on.cn>, Hao Feng <fenghao@...on.cn>,
        <x86@...nel.org>, <linux-crypto@...r.kernel.org>,
        <kvm@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH 0/6] Add Hygon SEV support

Hygon SEV follows AMD SEV work flow, but uses China national standard
cryptographic algorithms SM2/SM3/SM4 instead of (RSA, ECDSA,
ECDH)/SHA/AES. Reuse most AMD SEV code path to support Hygon SEV,
also adds 3 new commands(GM_PUBKEY_GEN, GM_GET_DIGEST,
GM_VERIFY_DIGEST) to support SM2 key exchange protocol.

SM2 is based on ECC(Elliptic Curve Cryptography), and uses a special
curve. It can be used in digital signature, key exchange and
asymmetric cryptography. For key exchange, SM2 is similar to ECDH, but
involves new random key, meaning the two sides need to exchange extra
random public key besides their public key, that's why additional APIs
are needed to support Hygon SEV.
SM3 is a hash algorithm, similar to SHA-256.
SM4 is a block cipher algorithm, similar to AES-128.

1. GM_PUBKEY_GEN
----------------
The command is used to get SM2 random public key from SEV firmware to
compute share key.

Parameters:
* GM_KEY_ID_PADDR (in) - Address of key ID for the random public key.
* GM_KEY_ID_LEN (in) - Length of key ID.
* GM_PUBKEY_PADDR (in) - Address of the random public key.
* GM_PUBKEY_LEN (in,out) - Length of the random public key.

2. GM_GET_DIGEST
----------------
The command is used to get key digest from SEV firmware during SM2 key
exchange, guest owner can check the digest to see if the key
negotiation is successful or not.

Parameters:
* HANDLE (in) - Guest handle
* DIGEST_PADDR (in) - Address of the key digest
* DIGEST_LEN (in, out) - Length of the key digest

3. GM_VERIFY_DIGEST
-------------------
The command is used to send guest owner's key digest to SEV firmware
during SM2 key exchange, firmware can check the digest to see if the
negotiation is successful or not.

Parameters:
* HANDLE (in) - Guest handle
* DIGEST_PADDR (in) - Address of the key digest
* DIGEST_LEN (in) - Length of the key digest

Already tested successfully on Hygon DhyanaPlus processor, also tested
successfully on AMD EPYC processor, results show no side effect on
current AMD SEV implementation.

Hao Feng (6):
  crypto: ccp: Add Hygon Dhyana support
  crypto: ccp: Define Hygon SEV commands
  crypto: ccp: Implement SEV_GM_PUBKEY_GEN ioctl command
  KVM: Define Hygon SEV commands
  KVM: SVM: Add support for KVM_SEV_GM_GET_DIGEST command
  KVM: SVM: Add KVM_SEV_GM_VERIFY_DIGEST command

 arch/x86/kvm/svm.c           | 119 +++++++++++++++++++++++++++++++++++++++++++
 drivers/crypto/ccp/psp-dev.c |  86 +++++++++++++++++++++++++++++++
 drivers/crypto/ccp/sp-pci.c  |   2 +
 include/linux/psp-sev.h      |  49 ++++++++++++++++++
 include/uapi/linux/kvm.h     |  14 +++++
 include/uapi/linux/psp-sev.h |  17 +++++++
 6 files changed, 287 insertions(+)

-- 
2.7.4