From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31263C46467 for ; Thu, 19 Jan 2023 07:24:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 700986B0072; Thu, 19 Jan 2023 02:24:04 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 6B06E6B0073; Thu, 19 Jan 2023 02:24:04 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 578D26B0074; Thu, 19 Jan 2023 02:24:04 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 4885E6B0072 for ; Thu, 19 Jan 2023 02:24:04 -0500 (EST) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 20BC01C6012 for ; Thu, 19 Jan 2023 07:24:04 +0000 (UTC) X-FDA: 80370709608.30.69A481C Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by imf25.hostedemail.com (Postfix) with ESMTP id E09A8A0004 for ; Thu, 19 Jan 2023 07:24:01 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=ibm.com header.s=pp1 header.b=gGqM15HY; dmarc=pass (policy=none) header.from=ibm.com; spf=pass (imf25.hostedemail.com: domain of dovmurik@linux.ibm.com designates 148.163.158.5 as permitted sender) smtp.mailfrom=dovmurik@linux.ibm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1674113042; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=FaOVjx07ztTIdT60txx0s0b5gk5cg+3GhJNm7FRrqxA=; b=bGbJS0PeD0qALtZrXxcBlAUAl7QIqloRYRNkD+M/kzpkrhLpZFbX9oAzi4PD6NHYIZ+Mgu NWGdyG9h988EnJ9O3DY4VSbuzqsy6DvLAmhXNZor12EA53QpopWmF3Qv6rPig6U1hOzI7M ZdKqrTt5ZqlA2CEYpT/UwyQ7+dFsl+4= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=pass header.d=ibm.com header.s=pp1 header.b=gGqM15HY; dmarc=pass (policy=none) header.from=ibm.com; spf=pass (imf25.hostedemail.com: domain of dovmurik@linux.ibm.com designates 148.163.158.5 as permitted sender) smtp.mailfrom=dovmurik@linux.ibm.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1674113042; a=rsa-sha256; cv=none; b=V/vj/z+mqHjxfoNeDVBR35OnaH/IFDplFkn0XclxNX+r7wJpLBdMsMHZBb5nOp6+/pUNKf cLufjiPDlNPcJPHafnzb0/klflKQ6EiK8nU7h2b9NYndnytcIppowmZLkH+y8LzU8DCJjn CW5imwHEsqUnj8jlXRSj2/fndzd9Gqo= Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 30J67eJR030173; Thu, 19 Jan 2023 07:23:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=message-id : date : mime-version : subject : to : cc : references : from : in-reply-to : content-type : content-transfer-encoding; s=pp1; bh=FaOVjx07ztTIdT60txx0s0b5gk5cg+3GhJNm7FRrqxA=; b=gGqM15HYRcnG3WHsQqKbdungpZdZvmGzS2AtsdqaSW/xfjHO3tqDkZ25Hz8DIWEm2B7I CZIrfeE1k3waUKwBNVVhBd+wbT/dshUzvjnPyhnHQ0PNJuTxFOPsnO/p0R/Zs86BeGLW TNW/jXn2lZeMZOoJbFtLvH735N0X2+RIqgUB05N2MU4eDKCi2j7IxHPoFCaEA5Cs13gZ 2xvzCM1CDorHq0AVtMhIKRmiXHPq7hUFGf5MIxbu1sEP92FQgZkgLLUbJOMldpnILphX rc8jaP48Bu/BMhY4srYRuy7xajXYE1Lq4CXc2BrzuC5rah5fVX+eCre0o1NfExG5wx+Q QA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3n6h5f6mkq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 19 Jan 2023 07:23:41 +0000 Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 30J7DI0V030240; Thu, 19 Jan 2023 07:23:40 GMT Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3n6h5f6mk8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 19 Jan 2023 07:23:40 +0000 Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 30J73lel009766; Thu, 19 Jan 2023 07:23:39 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([9.208.130.97]) by ppma01dal.us.ibm.com (PPS) with ESMTPS id 3n3m1837vq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 19 Jan 2023 07:23:39 +0000 Received: from smtpav05.wdc07v.mail.ibm.com (smtpav05.wdc07v.mail.ibm.com [10.39.53.232]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 30J7NbQw42271318 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 19 Jan 2023 07:23:37 GMT Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 868EA58059; Thu, 19 Jan 2023 07:23:37 +0000 (GMT) Received: from smtpav05.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4FFC358043; Thu, 19 Jan 2023 07:23:28 +0000 (GMT) Received: from [9.160.127.29] (unknown [9.160.127.29]) by smtpav05.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 19 Jan 2023 07:23:28 +0000 (GMT) Message-ID: Date: Thu, 19 Jan 2023 09:23:26 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.6.1 Subject: Re: [PATCH RFC v7 31/64] crypto: ccp: Add the SNP_{SET,GET}_EXT_CONFIG command Content-Language: en-US To: Michael Roth , kvm@vger.kernel.org Cc: linux-coco@lists.linux.dev, linux-mm@kvack.org, linux-crypto@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, jroedel@suse.de, thomas.lendacky@amd.com, hpa@zytor.com, ardb@kernel.org, pbonzini@redhat.com, seanjc@google.com, vkuznets@redhat.com, wanpengli@tencent.com, jmattson@google.com, luto@kernel.org, dave.hansen@linux.intel.com, slp@redhat.com, pgonda@google.com, peterz@infradead.org, srinivas.pandruvada@linux.intel.com, rientjes@google.com, tobin@ibm.com, bp@alien8.de, vbabka@suse.cz, kirill@shutemov.name, ak@linux.intel.com, tony.luck@intel.com, marcorr@google.com, sathyanarayanan.kuppuswamy@linux.intel.com, alpergun@google.com, dgilbert@redhat.com, jarkko@kernel.org, ashish.kalra@amd.com, harald@profian.com, Brijesh Singh , Dov Murik References: <20221214194056.161492-1-michael.roth@amd.com> <20221214194056.161492-32-michael.roth@amd.com> From: Dov Murik In-Reply-To: <20221214194056.161492-32-michael.roth@amd.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Proofpoint-GUID: FI5em3frKKibChidKNc0sr30HSyxeZBK X-Proofpoint-ORIG-GUID: w6COoNNAPvn6WeEFWdLfRUXz5bx9bRjg X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.923,Hydra:6.0.562,FMLib:17.11.122.1 definitions=2023-01-18_05,2023-01-18_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 priorityscore=1501 malwarescore=0 impostorscore=0 spamscore=0 phishscore=0 mlxscore=0 lowpriorityscore=0 mlxlogscore=999 bulkscore=0 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2301190056 X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: E09A8A0004 X-Stat-Signature: sd1swkmxdn6718qws51fkb9ft66xsa1z X-HE-Tag: 1674113041-609850 X-HE-Meta: U2FsdGVkX18yHvB3CQ3HmAyq/J1wXdAcY99LdZbxy8zEpm9AadohpvuaIusgs19g4AR30qx64t9H40Gz1E33ScOI0IQWZ8mB4gJJIhsfrA+as5u9557CsX4BlGthY2nVJz56dmUqCIwd8DDwIlslMKFZ9n37FHsPHhfD0CetkPeOWaB9qrd2fG5VKZZCFRSQILyhd1Yro7ZGQspIPgGInPzLxnRU1ziwpwbCvfaxVoo3stoOHY782JQTH/AvfuhvcszXZvPdVWoLJeVuxsudoGom8O11iK2Aff14EMDfvPE4xkqRDN98AIfTn7IwRATPzd1UAHxdKDo3KCjR/ZhQrM/bliATbSRY25F/sGtj2HmsqXuxZdpcKMNlzY/ivsFhFCOQZptk5LKkA6B/B7OYmOf/1XSr3FILN+hqoQsILoMV7/kukN1SYMnp+2SYM7p4QSVZnTumPGsmKAwvkL60MrH7oedbBuYhiWrPJd8lBB5decynmM0dZ1nf1EF5VgstAH2i9N7Og39pb8XFdesRp2XtG3vHKIfHlANi1sbfW3W/LIpSQsfRpQLg9b/OBMmZHVvh/QPVer90Pc9gq6NTG5zS+GGtu3W4ezoLBQn88Yhw4Lh65LHW7HWkDiqcgmuALIVGTmFzg/AnrIxvL6HNIjkAZjPT3D0lQL7bBiVG8d6ifHu2wDPlru2tQiZrId4kyX5mxgg1HFm2yOcmdB44NOSoVE2GswowtZsADCQvux788zoF1+TjsjQU0XrY6xsWJYOM6JLScfvObcnOosIbQaTIHklNkfUVSkIE8EvwfDllMDaLZ8sdlLKOsLoDmK506KTH1cD1f0a405VF7VI4ueFnffzWDKUpQ0yyfoNq0nuAYuzB4JngCg43Osf1tU+AFhb7hAegFRA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi Mike, On 14/12/2022 21:40, Michael Roth wrote: > From: Brijesh Singh > > The SEV-SNP firmware provides the SNP_CONFIG command used to set the > system-wide configuration value for SNP guests. The information includes > the TCB version string to be reported in guest attestation reports. > > Version 2 of the GHCB specification adds an NAE (SNP extended guest > request) that a guest can use to query the reports that include additional > certificates. > > In both cases, userspace provided additional data is included in the > attestation reports. The userspace will use the SNP_SET_EXT_CONFIG > command to give the certificate blob and the reported TCB version string > at once. Note that the specification defines certificate blob with a > specific GUID format; the userspace is responsible for building the > proper certificate blob. The ioctl treats it an opaque blob. > > While it is not defined in the spec, but let's add SNP_GET_EXT_CONFIG > command that can be used to obtain the data programmed through the > SNP_SET_EXT_CONFIG. > > Signed-off-by: Brijesh Singh > Signed-off-by: Ashish Kalra > Signed-off-by: Michael Roth > --- > Documentation/virt/coco/sev-guest.rst | 27 ++++++ > drivers/crypto/ccp/sev-dev.c | 123 ++++++++++++++++++++++++++ > drivers/crypto/ccp/sev-dev.h | 4 + > include/uapi/linux/psp-sev.h | 17 ++++ > 4 files changed, 171 insertions(+) > > diff --git a/Documentation/virt/coco/sev-guest.rst b/Documentation/virt/coco/sev-guest.rst > index 11ea67c944df..fad1e5639dac 100644 > --- a/Documentation/virt/coco/sev-guest.rst > +++ b/Documentation/virt/coco/sev-guest.rst > @@ -145,6 +145,33 @@ The SNP_PLATFORM_STATUS command is used to query the SNP platform status. The > status includes API major, minor version and more. See the SEV-SNP > specification for further details. > > +2.5 SNP_SET_EXT_CONFIG > +---------------------- > +:Technology: sev-snp > +:Type: hypervisor ioctl cmd > +:Parameters (in): struct sev_data_snp_ext_config > +:Returns (out): 0 on success, -negative on error > + > +The SNP_SET_EXT_CONFIG is used to set the system-wide configuration such as > +reported TCB version in the attestation report. The command is similar to > +SNP_CONFIG command defined in the SEV-SNP spec. The main difference is the > +command also accepts an additional certificate blob defined in the GHCB > +specification. > + > +If the certs_address is zero, then the previous certificate blob will deleted. > +For more information on the certificate blob layout, see the GHCB spec > +(extended guest request message). > + > +2.6 SNP_GET_EXT_CONFIG > +---------------------- > +:Technology: sev-snp > +:Type: hypervisor ioctl cmd > +:Parameters (in): struct sev_data_snp_ext_config > +:Returns (out): 0 on success, -negative on error > + > +The SNP_SET_EXT_CONFIG is used to query the system-wide configuration set ^^^^^^^^^^^^^^^^^^ This should be SNP_GET_EXT_CONFIG. -Dov > +through the SNP_SET_EXT_CONFIG. > + > 3. SEV-SNP CPUID Enforcement > ============================ >