[v5] Add SEV-SNP CipherTextHiding feature support

[PATCH v5 2/7] crypto: ccp - Cache SEV platform status and platform state

Posted by Ashish Kalra 7 months, 1 week ago

From: Ashish Kalra <ashish.kalra@amd.com>

Cache the SEV platform status into sev_device structure and use this
cached SEV platform status for api_major/minor/build.

The platform state is unique between SEV and SNP and hence needs to be
tracked independently.

Remove the state field from sev_device structure and instead track SEV
state from the cached SEV platform status.

Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
---
 drivers/crypto/ccp/sev-dev.c | 22 ++++++++++++----------
 drivers/crypto/ccp/sev-dev.h |  3 ++-
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 17edc6bf5622..5a2e1651d171 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -1286,7 +1286,7 @@ static int __sev_platform_init_locked(int *error)
 
 	sev = psp_master->sev_data;
 
-	if (sev->state == SEV_STATE_INIT)
+	if (sev->sev_plat_status.state == SEV_STATE_INIT)
 		return 0;
 
 	__sev_platform_init_handle_tmr(sev);
@@ -1318,7 +1318,7 @@ static int __sev_platform_init_locked(int *error)
 		return rc;
 	}
 
-	sev->state = SEV_STATE_INIT;
+	sev->sev_plat_status.state = SEV_STATE_INIT;
 
 	/* Prepare for first SEV guest launch after INIT */
 	wbinvd_on_all_cpus();
@@ -1347,7 +1347,7 @@ static int _sev_platform_init_locked(struct sev_platform_init_args *args)
 
 	sev = psp_master->sev_data;
 
-	if (sev->state == SEV_STATE_INIT)
+	if (sev->sev_plat_status.state == SEV_STATE_INIT)
 		return 0;
 
 	rc = __sev_snp_init_locked(&args->error);
@@ -1384,7 +1384,7 @@ static int __sev_platform_shutdown_locked(int *error)
 
 	sev = psp->sev_data;
 
-	if (sev->state == SEV_STATE_UNINIT)
+	if (sev->sev_plat_status.state == SEV_STATE_UNINIT)
 		return 0;
 
 	ret = __sev_do_cmd_locked(SEV_CMD_SHUTDOWN, NULL, error);
@@ -1394,7 +1394,7 @@ static int __sev_platform_shutdown_locked(int *error)
 		return ret;
 	}
 
-	sev->state = SEV_STATE_UNINIT;
+	sev->sev_plat_status.state = SEV_STATE_UNINIT;
 	dev_dbg(sev->dev, "SEV firmware shutdown\n");
 
 	return ret;
@@ -1502,7 +1502,7 @@ static int sev_ioctl_do_pek_pdh_gen(int cmd, struct sev_issue_cmd *argp, bool wr
 	if (!writable)
 		return -EPERM;
 
-	if (sev->state == SEV_STATE_UNINIT) {
+	if (sev->sev_plat_status.state == SEV_STATE_UNINIT) {
 		rc = sev_move_to_init_state(argp, &shutdown_required);
 		if (rc)
 			return rc;
@@ -1551,7 +1551,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)
 	data.len = input.length;
 
 cmd:
-	if (sev->state == SEV_STATE_UNINIT) {
+	if (sev->sev_plat_status.state == SEV_STATE_UNINIT) {
 		ret = sev_move_to_init_state(argp, &shutdown_required);
 		if (ret)
 			goto e_free_blob;
@@ -1606,10 +1606,12 @@ static int sev_get_api_version(void)
 		return 1;
 	}
 
+	/* Cache SEV platform status */
+	sev->sev_plat_status = status;
+
 	sev->api_major = status.api_major;
 	sev->api_minor = status.api_minor;
 	sev->build = status.build;
-	sev->state = status.state;
 
 	return 0;
 }
@@ -1837,7 +1839,7 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable)
 	data.oca_cert_len = input.oca_cert_len;
 
 	/* If platform is not in INIT state then transition it to INIT */
-	if (sev->state != SEV_STATE_INIT) {
+	if (sev->sev_plat_status.state != SEV_STATE_INIT) {
 		ret = sev_move_to_init_state(argp, &shutdown_required);
 		if (ret)
 			goto e_free_oca;
@@ -2008,7 +2010,7 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
 
 cmd:
 	/* If platform is not in INIT state then transition it to INIT. */
-	if (sev->state != SEV_STATE_INIT) {
+	if (sev->sev_plat_status.state != SEV_STATE_INIT) {
 		if (!writable) {
 			ret = -EPERM;
 			goto e_free_cert;
diff --git a/drivers/crypto/ccp/sev-dev.h b/drivers/crypto/ccp/sev-dev.h
index 3e4e5574e88a..24dd8ff8afaa 100644
--- a/drivers/crypto/ccp/sev-dev.h
+++ b/drivers/crypto/ccp/sev-dev.h
@@ -42,7 +42,6 @@ struct sev_device {
 
 	struct sev_vdata *vdata;
 
-	int state;
 	unsigned int int_rcvd;
 	wait_queue_head_t int_queue;
 	struct sev_misc_dev *misc;
@@ -57,6 +56,8 @@ struct sev_device {
 	bool cmd_buf_backup_active;
 
 	bool snp_initialized;
+
+	struct sev_user_data_status sev_plat_status;
 };
 
 int sev_dev_init(struct psp_device *psp);
-- 
2.34.1

Re: [PATCH v5 2/7] crypto: ccp - Cache SEV platform status and platform state

Posted by Tom Lendacky 7 months ago

On 7/1/25 15:15, Ashish Kalra wrote:
> From: Ashish Kalra <ashish.kalra@amd.com>
> 
> Cache the SEV platform status into sev_device structure and use this
> cached SEV platform status for api_major/minor/build.
> 
> The platform state is unique between SEV and SNP and hence needs to be
> tracked independently.
> 
> Remove the state field from sev_device structure and instead track SEV
> state from the cached SEV platform status.
> 
> Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>

Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>

> ---
>  drivers/crypto/ccp/sev-dev.c | 22 ++++++++++++----------
>  drivers/crypto/ccp/sev-dev.h |  3 ++-
>  2 files changed, 14 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> index 17edc6bf5622..5a2e1651d171 100644
> --- a/drivers/crypto/ccp/sev-dev.c
> +++ b/drivers/crypto/ccp/sev-dev.c
> @@ -1286,7 +1286,7 @@ static int __sev_platform_init_locked(int *error)
>  
>  	sev = psp_master->sev_data;
>  
> -	if (sev->state == SEV_STATE_INIT)
> +	if (sev->sev_plat_status.state == SEV_STATE_INIT)
>  		return 0;
>  
>  	__sev_platform_init_handle_tmr(sev);
> @@ -1318,7 +1318,7 @@ static int __sev_platform_init_locked(int *error)
>  		return rc;
>  	}
>  
> -	sev->state = SEV_STATE_INIT;
> +	sev->sev_plat_status.state = SEV_STATE_INIT;
>  
>  	/* Prepare for first SEV guest launch after INIT */
>  	wbinvd_on_all_cpus();
> @@ -1347,7 +1347,7 @@ static int _sev_platform_init_locked(struct sev_platform_init_args *args)
>  
>  	sev = psp_master->sev_data;
>  
> -	if (sev->state == SEV_STATE_INIT)
> +	if (sev->sev_plat_status.state == SEV_STATE_INIT)
>  		return 0;
>  
>  	rc = __sev_snp_init_locked(&args->error);
> @@ -1384,7 +1384,7 @@ static int __sev_platform_shutdown_locked(int *error)
>  
>  	sev = psp->sev_data;
>  
> -	if (sev->state == SEV_STATE_UNINIT)
> +	if (sev->sev_plat_status.state == SEV_STATE_UNINIT)
>  		return 0;
>  
>  	ret = __sev_do_cmd_locked(SEV_CMD_SHUTDOWN, NULL, error);
> @@ -1394,7 +1394,7 @@ static int __sev_platform_shutdown_locked(int *error)
>  		return ret;
>  	}
>  
> -	sev->state = SEV_STATE_UNINIT;
> +	sev->sev_plat_status.state = SEV_STATE_UNINIT;
>  	dev_dbg(sev->dev, "SEV firmware shutdown\n");
>  
>  	return ret;
> @@ -1502,7 +1502,7 @@ static int sev_ioctl_do_pek_pdh_gen(int cmd, struct sev_issue_cmd *argp, bool wr
>  	if (!writable)
>  		return -EPERM;
>  
> -	if (sev->state == SEV_STATE_UNINIT) {
> +	if (sev->sev_plat_status.state == SEV_STATE_UNINIT) {
>  		rc = sev_move_to_init_state(argp, &shutdown_required);
>  		if (rc)
>  			return rc;
> @@ -1551,7 +1551,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)
>  	data.len = input.length;
>  
>  cmd:
> -	if (sev->state == SEV_STATE_UNINIT) {
> +	if (sev->sev_plat_status.state == SEV_STATE_UNINIT) {
>  		ret = sev_move_to_init_state(argp, &shutdown_required);
>  		if (ret)
>  			goto e_free_blob;
> @@ -1606,10 +1606,12 @@ static int sev_get_api_version(void)
>  		return 1;
>  	}
>  
> +	/* Cache SEV platform status */
> +	sev->sev_plat_status = status;
> +
>  	sev->api_major = status.api_major;
>  	sev->api_minor = status.api_minor;
>  	sev->build = status.build;
> -	sev->state = status.state;
>  
>  	return 0;
>  }
> @@ -1837,7 +1839,7 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable)
>  	data.oca_cert_len = input.oca_cert_len;
>  
>  	/* If platform is not in INIT state then transition it to INIT */
> -	if (sev->state != SEV_STATE_INIT) {
> +	if (sev->sev_plat_status.state != SEV_STATE_INIT) {
>  		ret = sev_move_to_init_state(argp, &shutdown_required);
>  		if (ret)
>  			goto e_free_oca;
> @@ -2008,7 +2010,7 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
>  
>  cmd:
>  	/* If platform is not in INIT state then transition it to INIT. */
> -	if (sev->state != SEV_STATE_INIT) {
> +	if (sev->sev_plat_status.state != SEV_STATE_INIT) {
>  		if (!writable) {
>  			ret = -EPERM;
>  			goto e_free_cert;
> diff --git a/drivers/crypto/ccp/sev-dev.h b/drivers/crypto/ccp/sev-dev.h
> index 3e4e5574e88a..24dd8ff8afaa 100644
> --- a/drivers/crypto/ccp/sev-dev.h
> +++ b/drivers/crypto/ccp/sev-dev.h
> @@ -42,7 +42,6 @@ struct sev_device {
>  
>  	struct sev_vdata *vdata;
>  
> -	int state;
>  	unsigned int int_rcvd;
>  	wait_queue_head_t int_queue;
>  	struct sev_misc_dev *misc;
> @@ -57,6 +56,8 @@ struct sev_device {
>  	bool cmd_buf_backup_active;
>  
>  	bool snp_initialized;
> +
> +	struct sev_user_data_status sev_plat_status;
>  };
>  
>  int sev_dev_init(struct psp_device *psp);

[PATCH v5 1/7] crypto: ccp - New bit-field definitions for SNP_PLATFORM_STATUS command
[PATCH v5 2/7] crypto: ccp - Cache SEV platform status and platform state
[PATCH v5 3/7] crypto: ccp - Add support for SNP_FEATURE_INFO command
[PATCH v5 4/7] crypto: ccp - Introduce new API interface to indicate SEV-SNP Ciphertext hiding feature
[PATCH v5 5/7] crypto: ccp - Add support to enable CipherTextHiding on SNP_INIT_EX
[PATCH v5 6/7] KVM: SEV: Introduce new min,max sev_es and sev_snp asid variables
[PATCH v5 7/7] KVM: SEV: Add SEV-SNP CipherTextHiding support