Received-SPF: pass (google.com: domain of linux-kernel+bounces-84775-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Wed, 28 Feb 2024 16:34:33 +0700
From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Paolo Bonzini <pbonzini@redhat.com>, linux-kernel@vger.kernel.org,
	kvm@vger.kernel.org
Cc: seanjc@google.com, michael.roth@amd.com, aik@amd.com
Subject: Re: [PATCH v3 05/15] Documentation: kvm/sev: separate description of
 firmware
Message-ID: <Zd7-KWFGOXGs_iOu@archie.me>
References: <20240226190344.787149-1-pbonzini@redhat.com>
 <20240226190344.787149-6-pbonzini@redhat.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="eUPRBjCtZiK17fws"
Content-Disposition: inline
In-Reply-To: <20240226190344.787149-6-pbonzini@redhat.com>


--eUPRBjCtZiK17fws
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Feb 26, 2024 at 02:03:34PM -0500, Paolo Bonzini wrote:
> +``KVM_MEMORY_ENCRYPT_OP`` API
> +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D

Nit: I think to be consistent, with command names in section headings below,
the API name heading above should not be inlined.

> =20
>  The main ioctl to access SEV is KVM_MEMORY_ENCRYPT_OP.  If the argument
>  to KVM_MEMORY_ENCRYPT_OP is NULL, the ioctl returns 0 if SEV is enabled
> @@ -87,10 +81,6 @@ guests, such as launching, running, snapshotting, migr=
ating and decommissioning.
>  The KVM_SEV_INIT command is used by the hypervisor to initialize the SEV=
 platform
>  context. In a typical workflow, this command should be the first command=
 issued.
> =20
> -The firmware can be initialized either by using its own non-volatile sto=
rage or
> -the OS can manage the NV storage for the firmware using the module param=
eter
> -``init_ex_path``. If the file specified by ``init_ex_path`` does not exi=
st or
> -is invalid, the OS will create or override the file with output from PSP.
> =20
>  Returns: 0 on success, -negative on error
> =20
> @@ -434,6 +424,21 @@ issued by the hypervisor to make the guest ready for=
 execution.
> =20
>  Returns: 0 on success, -negative on error
> =20
> +Firmware Management
> +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> +
> +The SEV guest key management is handled by a separate processor called t=
he AMD
> +Secure Processor (AMD-SP). Firmware running inside the AMD-SP provides a=
 secure
> +key management interface to perform common hypervisor activities such as
> +encrypting bootstrap code, snapshot, migrating and debugging the guest. =
For more
> +information, see the SEV Key Management spec [api-spec]_
> +
> +The AMD-SP firmware can be initialized either by using its own non-volat=
ile
> +storage or the OS can manage the NV storage for the firmware using
> +parameter ``init_ex_path`` of the ``ccp`` module. If the file specified
> +by ``init_ex_path`` does not exist or is invalid, the OS will create or
> +override the file with PSP non-volatile storage.
> +

This one LGTM.

Other than the nit,

Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>

--=20
An old man doll... just what I always wanted! - Clara

--eUPRBjCtZiK17fws
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCZd7+IAAKCRD2uYlJVVFO
o162AQCcn8Ku0qmJzR0aVZhAlymyxJjRteYpeKWfN7U4NfghawEAkNBc12XmmmJP
8LB8u3zNlnOBbkVipGKxB+YnRI5WQQ8=
=Hybi
-----END PGP SIGNATURE-----

--eUPRBjCtZiK17fws--