| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <7bc2d96b-6a32-6eaa-2e51-203b78abec2e@amazon.com>
Date: Mon, 17 Apr 2023 17:54:16 +0300
From: Sabin Rapan <sabrapan@...zon.com>
To: Michael Roth <michael.roth@....com>, <kvm@...r.kernel.org>
CC: <linux-coco@...ts.linux.dev>, <linux-mm@...ck.org>,
<linux-crypto@...r.kernel.org>, <x86@...nel.org>,
<linux-kernel@...r.kernel.org>, <tglx@...utronix.de>,
<mingo@...hat.com>, <jroedel@...e.de>, <thomas.lendacky@....com>,
<hpa@...or.com>, <ardb@...nel.org>, <pbonzini@...hat.com>,
<seanjc@...gle.com>, <vkuznets@...hat.com>, <jmattson@...gle.com>,
<luto@...nel.org>, <dave.hansen@...ux.intel.com>, <slp@...hat.com>,
<pgonda@...gle.com>, <peterz@...radead.org>,
<srinivas.pandruvada@...ux.intel.com>, <rientjes@...gle.com>,
<dovmurik@...ux.ibm.com>, <tobin@....com>, <bp@...en8.de>,
<vbabka@...e.cz>, <kirill@...temov.name>, <ak@...ux.intel.com>,
<tony.luck@...el.com>, <marcorr@...gle.com>,
<sathyanarayanan.kuppuswamy@...ux.intel.com>,
<alpergun@...gle.com>, <dgilbert@...hat.com>, <jarkko@...nel.org>,
<ashish.kalra@....com>, <nikunj.dadhania@....com>,
Brijesh Singh <brijesh.singh@....com>
Subject: Re: [PATCH RFC v8 20/56] crypto:ccp: Define the SEV-SNP commands
On 20.02.2023 20:38, Michael Roth wrote:
> From: Brijesh Singh <brijesh.singh@....com>
>
> AMD introduced the next generation of SEV called SEV-SNP (Secure Nested
> Paging). SEV-SNP builds upon existing SEV and SEV-ES functionality
> while adding new hardware security protection.
>
> Define the commands and structures used to communicate with the AMD-SP
> when creating and managing the SEV-SNP guests. The SEV-SNP firmware spec
> is available at developer.amd.com/sev.
>
> Co-developed-by: Ashish Kalra <ashish.kalra@....com>
> Signed-off-by: Ashish Kalra <ashish.kalra@....com>
> Signed-off-by: Brijesh Singh <brijesh.singh@....com>
> Signed-off-by: Michael Roth <michael.roth@....com>
> ---
> drivers/crypto/ccp/sev-dev.c | 16 +++
> include/linux/psp-sev.h | 247 +++++++++++++++++++++++++++++++++++
> include/uapi/linux/psp-sev.h | 44 +++++++
> 3 files changed, 307 insertions(+)
>
> diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> index 06fc7156c04f..9d84720a41d7 100644
> --- a/drivers/crypto/ccp/sev-dev.c
> +++ b/drivers/crypto/ccp/sev-dev.c
> @@ -126,6 +126,8 @@ static int sev_cmd_buffer_len(int cmd)
> switch (cmd) {
> case SEV_CMD_INIT: return sizeof(struct sev_data_init);
> case SEV_CMD_INIT_EX: return sizeof(struct sev_data_init_ex);
> + case SEV_CMD_SNP_SHUTDOWN_EX: return sizeof(struct sev_data_snp_shutdown_ex);
> + case SEV_CMD_SNP_INIT_EX: return sizeof(struct sev_data_snp_init_ex);
> case SEV_CMD_PLATFORM_STATUS: return sizeof(struct sev_user_data_status);
> case SEV_CMD_PEK_CSR: return sizeof(struct sev_data_pek_csr);
> case SEV_CMD_PEK_CERT_IMPORT: return sizeof(struct sev_data_pek_cert_import);
> @@ -154,6 +156,20 @@ static int sev_cmd_buffer_len(int cmd)
> case SEV_CMD_GET_ID: return sizeof(struct sev_data_get_id);
> case SEV_CMD_ATTESTATION_REPORT: return sizeof(struct sev_data_attestation_report);
> case SEV_CMD_SEND_CANCEL: return sizeof(struct sev_data_send_cancel);
> + case SEV_CMD_SNP_GCTX_CREATE: return sizeof(struct sev_data_snp_addr);
> + case SEV_CMD_SNP_LAUNCH_START: return sizeof(struct sev_data_snp_launch_start);
> + case SEV_CMD_SNP_LAUNCH_UPDATE: return sizeof(struct sev_data_snp_launch_update);
> + case SEV_CMD_SNP_ACTIVATE: return sizeof(struct sev_data_snp_activate);
> + case SEV_CMD_SNP_DECOMMISSION: return sizeof(struct sev_data_snp_addr);
> + case SEV_CMD_SNP_PAGE_RECLAIM: return sizeof(struct sev_data_snp_page_reclaim);
> + case SEV_CMD_SNP_GUEST_STATUS: return sizeof(struct sev_data_snp_guest_status);
> + case SEV_CMD_SNP_LAUNCH_FINISH: return sizeof(struct sev_data_snp_launch_finish);
> + case SEV_CMD_SNP_DBG_DECRYPT: return sizeof(struct sev_data_snp_dbg);
> + case SEV_CMD_SNP_DBG_ENCRYPT: return sizeof(struct sev_data_snp_dbg);
> + case SEV_CMD_SNP_PAGE_UNSMASH: return sizeof(struct sev_data_snp_page_unsmash);
> + case SEV_CMD_SNP_PLATFORM_STATUS: return sizeof(struct sev_data_snp_addr);
> + case SEV_CMD_SNP_GUEST_REQUEST: return sizeof(struct sev_data_snp_guest_request);
> + case SEV_CMD_SNP_CONFIG: return sizeof(struct sev_user_data_snp_config);
This needs SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX, SEV_CMD_SNP_COMMIT and
SEV_CMD_SNP_VLEK_LOAD from 1.54 ABI release.
> default: return 0;
> }
>
> +/**
> + * struct sev_user_data_snp_status - SNP status
> + *
> + * @major: API major version
> + * @minor: API minor version
> + * @state: current platform state
> + * @build: firmware build id for the API version
> + * @guest_count: the number of guest currently managed by the firmware
> + * @tcb_version: current TCB version
> + */
> +struct sev_user_data_snp_status {
> + __u8 api_major; /* Out */
> + __u8 api_minor; /* Out */
> + __u8 state; /* Out */
> + __u8 rsvd;
> + __u32 build_id; /* Out */
> + __u32 rsvd1;
> + __u32 guest_count; /* Out */
> + __u64 tcb_version; /* Out */
> + __u64 rsvd2;
> +} __packed;
Could you please update this to 1.54 ABI version?
Should include something along these lines:
diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h
index 60e7a8d1a18e..e9ebd24ef085 100644
--- a/include/uapi/linux/psp-sev.h
+++ b/include/uapi/linux/psp-sev.h
@@ -163,20 +163,29 @@ struct sev_user_data_get_id2 {
* @major: API major version
* @minor: API minor version
* @state: current platform state
+ * @is_rmp_initialized: whether RMP is initialized or not
* @build: firmware build id for the API version
+ * @mask_chip_id: whether chip id is present in attestation reports or not
+ * @mask_chip_key: whether attestation reports are signed or not
+ * @vlek_en: VLEK hashstick is loaded
* @guest_count: the number of guest currently managed by the firmware
- * @tcb_version: current TCB version
+ * @current_tcb_version: current TCB version
+ * @reported_tcb_version: reported TCB version
*/
struct sev_user_data_snp_status {
- __u8 api_major; /* Out */
- __u8 api_minor; /* Out */
- __u8 state; /* Out */
- __u8 rsvd;
- __u32 build_id; /* Out */
- __u32 rsvd1;
- __u32 guest_count; /* Out */
- __u64 tcb_version; /* Out */
- __u64 rsvd2;
+ __u8 api_major; /* Out */
+ __u8 api_minor; /* Out */
+ __u8 state; /* Out */
+ __u8 is_rmp_initialized:1; /* Out */
+ __u8 rsvd:7;
+ __u32 build_id; /* Out */
+ __u32 mask_chip_id:1; /* Out */
+ __u32 mask_chip_key:1; /* Out */
+ __u32 vlek_en:1; /* Out */
+ __u32 rsvd1:29;
+ __u32 guest_count; /* Out */
+ __u64 current_tcb_version; /* Out */
+ __u64 reported_tcb_version; /* Out */
} __packed;
/*
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
Powered by blists - more mailing lists