linux-kernel - Re: [PATCH kernel v2 4/5] crypto: ccp: Enable SEV-TIO feature in the PSP when supported

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b5d1dd97-4e76-461f-91b5-864de2157b3f@amd.com>
Date: Mon, 1 Dec 2025 08:31:45 -0600
From: Tom Lendacky <thomas.lendacky@....com>
To: Alexey Kardashevskiy <aik@....com>, linux-kernel@...r.kernel.org
Cc: linux-crypto@...r.kernel.org, John Allen <john.allen@....com>,
 Herbert Xu <herbert@...dor.apana.org.au>,
 "David S. Miller" <davem@...emloft.net>, Ashish Kalra
 <ashish.kalra@....com>, Joerg Roedel <joro@...tes.org>,
 Suravee Suthikulpanit <suravee.suthikulpanit@....com>,
 Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>,
 "Borislav Petkov (AMD)" <bp@...en8.de>, Kim Phillips <kim.phillips@....com>,
 Jerry Snitselaar <jsnitsel@...hat.com>, Vasant Hegde <vasant.hegde@....com>,
 Jason Gunthorpe <jgg@...pe.ca>, Gao Shiyuan <gaoshiyuan@...du.com>,
 Sean Christopherson <seanjc@...gle.com>, Nikunj A Dadhania <nikunj@....com>,
 Michael Roth <michael.roth@....com>, Amit Shah <amit.shah@....com>,
 Peter Gonda <pgonda@...gle.com>, iommu@...ts.linux.dev
Subject: Re: [PATCH kernel v2 4/5] crypto: ccp: Enable SEV-TIO feature in the
 PSP when supported

On 11/21/25 02:06, Alexey Kardashevskiy wrote:
> The PSP advertises the SEV-TIO support via the FEATURE_INFO command
> advertised via SNP_PLATFORM_STATUS.
> 
> The BIOS advertises the SEV-TIO enablement via the IOMMU EFR2 register
> (added in an earlier patch).
> 
> Enable SEV-TIO during the SNP_INIT_EX call if both the PSP and the BIOS
> advertise support for it.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@....com>
> ---
>  include/linux/psp-sev.h      |  4 +++-
>  drivers/crypto/ccp/sev-dev.c | 10 +++++++++-
>  2 files changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h
> index 34a25209f909..c0c817ca3615 100644
> --- a/include/linux/psp-sev.h
> +++ b/include/linux/psp-sev.h
> @@ -750,7 +750,8 @@ struct sev_data_snp_init_ex {
>  	u32 list_paddr_en:1;
>  	u32 rapl_dis:1;
>  	u32 ciphertext_hiding_en:1;
> -	u32 rsvd:28;
> +	u32 tio_en:1;
> +	u32 rsvd:27;
>  	u32 rsvd1;
>  	u64 list_paddr;
>  	u16 max_snp_asid;
> @@ -850,6 +851,7 @@ struct snp_feature_info {
>  } __packed;
>  
>  #define SNP_CIPHER_TEXT_HIDING_SUPPORTED	BIT(3)
> +#define SNP_SEV_TIO_SUPPORTED			BIT(1) /* EBX */
>  
>  #ifdef CONFIG_CRYPTO_DEV_SP_PSP
>  
> diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> index 9e0c16b36f9c..2f1c9614d359 100644
> --- a/drivers/crypto/ccp/sev-dev.c
> +++ b/drivers/crypto/ccp/sev-dev.c
> @@ -1358,6 +1358,11 @@ static int snp_filter_reserved_mem_regions(struct resource *rs, void *arg)
>  	return 0;
>  }
>  
> +static bool sev_tio_present(struct sev_device *sev)
> +{
> +	return (sev->snp_feat_info_0.ebx & SNP_SEV_TIO_SUPPORTED) != 0;
> +}
> +
>  static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
>  {
>  	struct psp_device *psp = psp_master;
> @@ -1434,6 +1439,8 @@ static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
>  		data.init_rmp = 1;
>  		data.list_paddr_en = 1;
>  		data.list_paddr = __psp_pa(snp_range_list);
> +		data.tio_en = sev_tio_present(sev) &&
> +			amd_iommu_sev_tio_supported();

Align amd_iommu_sev_tio_supported() with sev_tio_present() or just make
a single line. But...

I would move the IOMMU check into the sev_tio_present() function and
then rename sev_tio_present() to sev_tio_supported() unless
sev_tio_present() is going to be used more somewhere else?

Those can be follow-up patches, though, if this needs to get into 6.19.

Thanks,
Tom

>  		cmd = SEV_CMD_SNP_INIT_EX;
>  	} else {
>  		cmd = SEV_CMD_SNP_INIT;
> @@ -1471,7 +1478,8 @@ static int __sev_snp_init_locked(int *error, unsigned int max_snp_asid)
>  
>  	snp_hv_fixed_pages_state_update(sev, HV_FIXED);
>  	sev->snp_initialized = true;
> -	dev_dbg(sev->dev, "SEV-SNP firmware initialized\n");
> +	dev_dbg(sev->dev, "SEV-SNP firmware initialized, SEV-TIO is %s\n",
> +		data.tio_en ? "enabled" : "disabled");
>  
>  	dev_info(sev->dev, "SEV-SNP API:%d.%d build:%d\n", sev->api_major,
>  		 sev->api_minor, sev->build);