Received-SPF: pass (google.com: domain of linux-crypto+bounces-3445-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <621e4304-d089-282e-0e67-2a4fe75fa3d9@amd.com>
Date: Wed, 10 Apr 2024 17:20:56 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.15.1
Subject: Re: [PATCH v12 27/29] crypto: ccp: Add the SNP_VLEK_LOAD command
Content-Language: en-US
To: Michael Roth <michael.roth@amd.com>, kvm@vger.kernel.org
Cc: linux-coco@lists.linux.dev, linux-mm@kvack.org,
 linux-crypto@vger.kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org,
 tglx@linutronix.de, mingo@redhat.com, jroedel@suse.de, hpa@zytor.com,
 ardb@kernel.org, pbonzini@redhat.com, seanjc@google.com,
 vkuznets@redhat.com, jmattson@google.com, luto@kernel.org,
 dave.hansen@linux.intel.com, slp@redhat.com, pgonda@google.com,
 peterz@infradead.org, srinivas.pandruvada@linux.intel.com,
 rientjes@google.com, dovmurik@linux.ibm.com, tobin@ibm.com, bp@alien8.de,
 vbabka@suse.cz, kirill@shutemov.name, ak@linux.intel.com,
 tony.luck@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com,
 alpergun@google.com, jarkko@kernel.org, ashish.kalra@amd.com,
 nikunj.dadhania@amd.com, pankaj.gupta@amd.com, liam.merwick@oracle.com
References: <20240329225835.400662-1-michael.roth@amd.com>
 <20240329225835.400662-28-michael.roth@amd.com>
From: Tom Lendacky <thomas.lendacky@amd.com>
In-Reply-To: <20240329225835.400662-28-michael.roth@amd.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?QmpRNnM1YjdURUJIVExQcTN1cGEzRzE4ZFB0dk0xaHlSRUgzM2FNdE5MWjA2?=
 =?utf-8?B?Tlp6UVpFRHpxRnd1K2xOd0NkUnpPT0FMVVp4SnVoak5uMEpYK3dqU0lQNTNq?=
 =?utf-8?B?aEVkWjZBRTBzM1Nobyttb2tGQ2wvVmllRU5HdlJhbC8rWmJVSUNuNjJxVGpV?=
 =?utf-8?B?ajl0Wm0rSXF5OTFFNDBwUWZncjZaVGNhMUVBd0F4N3prOUtpc3lBdHIrMnRx?=
 =?utf-8?B?WlpWYWlqVXRadzJKb2ZDUHlZYUJMNVc1VEdFWWNUQ0NqNjNldlZKcEYzb282?=
 =?utf-8?B?eHc2RTBQcGZiZ25wWitTTUJhTzViY3F0ZU1qWXNKVVcyREFZZ1JLS2k4QkdV?=
 =?utf-8?B?MXNYYlFoamY5WEhwRWFzRzU2U0FsOGNON2k0K2tHcThyQzFvT3FjOWJ6VUhU?=
 =?utf-8?B?REoyV3pVdFdHVGp2MDlmR1dlZUlqMFhXME5TV0dEMXVZUk4zWEpsdHQ0RFd1?=
 =?utf-8?B?RnFHMUpEbkZpVnErWnZXSEluMnFLRTRMaFFzRk1SK29INVBoR280WEtPbTBl?=
 =?utf-8?B?TjNtNW9naFE2MS9XRUwvUHFuSWM5UEdGSW9HL0Nid0U1aTlwL2tRQVRVcDFI?=
 =?utf-8?B?U3ArY01YUVFPQUVSSGFHeDJSb2xCTmwrQWloQWhOclFFQjNYd09oeFlPdk5l?=
 =?utf-8?B?eTY4TjliL0NpNmxqNTU0Y1k2ekhrK3c1UFFpQ0QrcUw4NHZCQlNFVDFXVDlh?=
 =?utf-8?B?Y0ZJSGp6aHc2R2lnWTJCUnk0bHh4U20zZXZFNDg3R0NwY1BTemVGeXFPblhH?=
 =?utf-8?B?OHRCNnNtd2FiSXRnYnJsVHhodXJsVzdkczcvRVVySzZNditrdDE3WnJ4b1pE?=
 =?utf-8?B?ZFJXN3hQcUZqZE9ub3lqQmtRYTRuVnVQVXd1SG1qTXJUVFBnOFY2cEQ1bXdr?=
 =?utf-8?B?Y1Yway9sckwzcTVYOU5CR0wvTE9JcXhHa0ZsS1BsVlJCM3RJVDRVQzAxMzFz?=
 =?utf-8?B?NGNIWVNMWkh2b2k5MFdzODFCS3hESHlNSEZwSkVzR1UvTlhtWGtnYWEzQ3Rz?=
 =?utf-8?B?TmlzUVltbnljV3JEN01tblVkWGlheVo5ZktITHE0TFU5czd1R2Q3QXNpeHp1?=
 =?utf-8?B?L25vMk9DRTlNUU56RUxlUFVaUkoyMDFQZm5rL2pQYmd3OUwrSDdTZ1lJL1hD?=
 =?utf-8?B?UU1SWUdyWlc4VnBkMDVLcmNZeWppWG1GaXY5WVZIMFdzWFZwTWRHMjRHYUFn?=
 =?utf-8?B?YzcvK2hKNUdNa1dYL0tsbE8rMUh3SkVuMUkrWFJJOWsrRFJJb2FpVFdWWWNp?=
 =?utf-8?B?TDJWWmdsVVNoWnAwNThJRlQwd3FRczVnMXYrU0Jja1JPSTZ1V0k1S24vUFA4?=
 =?utf-8?B?dXdOOUlzQnE2RmFQVlEvaFBsMzViWTNNYWhJZDNwa0QrRmVwRWw0Q2JDVGp3?=
 =?utf-8?B?ajZWSEJKY2tBaU5oMENGNTFwcThTSzdVZEdlN21mZjJzcmRKcVduYk1HcHIw?=
 =?utf-8?B?SGRtTlFoSXVrU052Zjc3Qm1FaTJUZjRWRmJlQUF5bXNpR0hDK0VZUTBuK1Vi?=
 =?utf-8?B?V0ZRcGJxblhvaWUvaTBNRnVlYWk5K3FmNlR3RkV3RzJtcVFMOGJoS1VhNlVK?=
 =?utf-8?B?RVc5cXN0WGw2dHd4K1hrWFg4dlRYTHRPK09QelJLLzhOSmFqTTUyOWtkRmkr?=
 =?utf-8?B?YktJZHN0NEowbkx2TDZqcm96am5DOE16L0FIb2VYUEUycExYNUZueHVmQVAx?=
 =?utf-8?B?MGtRcy9XdXRNYjE4MDVEM2tXdXdUTU5wNmJvTm5mbnIwVTBRMmVnL0hnc0Q5?=
 =?utf-8?B?cnhRRGpnelFoUWJqYWRCNDQ0akVsSWpLeStFVDc2RHZmaUZLOXRqb1p1U0x3?=
 =?utf-8?B?QXdRTVN4MDcxMDVFY3JRSGZqQmtldlUvUGJRSUZJek05S2p4ek9qVmhKMDVx?=
 =?utf-8?B?T0ZkbTZGM0wrMkFUN25oRUlHUDlaN3pRSUZiWGoyR3ptMDJ4Qk8zbm9sQVkz?=
 =?utf-8?B?bC9ieG5ZZENxZXcyVEpsVnI2VzBoQnhEeEI0UThvWm9XWk9nbGVqVzQ5UXk0?=
 =?utf-8?B?YVozaWJaa2NnYUphTE90N0p3MUlxMTEzYlZRNzhpd1luZzQ2VXNNMWZKc3Z2?=
 =?utf-8?B?TVVvMjZ1MXkxV3FlcnZiT0RLczJJR0NveHdyZ2RYNFJtWFFKaE1IRElPMnZt?=
 =?utf-8?Q?u1mxvO/s/OazjZP/bK1c1Yc8z?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ed5cc8fc-6aaa-4750-e77f-08dc59ac800c
X-MS-Exchange-CrossTenant-AuthSource: BL1PR12MB5732.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Apr 2024 22:20:59.8990
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: FWwvEa+c69ehrxOq1M1e387XSRspBwICziOPGgWSG41dxSGlgL4yvtd9GuKWMZ1SYfE/ov+5pynJGw9Cq3j4Aw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB5934

On 3/29/24 17:58, Michael Roth wrote:
> When requesting an attestation report a guest is able to specify whether
> it wants SNP firmware to sign the report using either a Versioned Chip
> Endorsement Key (VCEK), which is derived from chip-unique secrets, or a
> Versioned Loaded Endorsement Key (VLEK) which is obtained from an AMD
> Key Derivation Service (KDS) and derived from seeds allocated to
> enrolled cloud service providers (CSPs).
> 
> For VLEK keys, an SNP_VLEK_LOAD SNP firmware command is used to load
> them into the system after obtaining them from the KDS. Add a
> corresponding userspace interface so to allow the loading of VLEK keys
> into the system.
> 
> See SEV-SNP Firmware ABI 1.54, SNP_VLEK_LOAD for more details.
> 
> Signed-off-by: Michael Roth <michael.roth@amd.com>

Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>