crypto/ccp: export firmware supported vm types

In some configurations, the firmware does not support all VM types. The SEV
firmware has an entry in the TCB_VERSION structure referred to as the
Security Version Number in the SEV-SNP firmware specification and referred
to as the "SPL" in SEV firmware release notes. The SEV firmware release
notes say:

    On every SEV firmware release where a security mitigation has been
    added, the SNP SPL gets increased by 1. This is to let users know that
    it is important to update to this version.

The SEV firmware release that fixed CVE-2025-48514 by disabling SEV-ES
support on vulnerable platforms has this SVN increased to reflect the fix.
The SVN is platform-specific, as is the structure of TCB_VERSION.

Check CURRENT_TCB instead of REPORTED_TCB, since the firmware behaves with
the CURRENT_TCB SVN level and will reject SEV-ES VMs accordingly.

Parse the SVN, and mask off the SEV_ES supported VM type from the list of
supported types if it is above the per-platform threshold for the relevant
platforms.

Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Tested-by: Tycho Andersen (AMD) <tycho@kernel.org>
Link: https://patch.msgid.link/20260416232329.3408497-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 22bc4ef27a6332a411728211545bc32541c75244..7cd6cd6fdb1092b0ca26fd07d728605e2132360d 100644 (file)
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -2954,3 +2954,73 @@ void sev_pci_exit(void)
 
        sev_firmware_shutdown(sev);
 }
+
+static int get_v1_svn(struct sev_device *sev)
+{
+       struct sev_snp_tcb_version_genoa_milan *tcb;
+       struct sev_user_data_snp_status status;
+       int ret, error = 0;
+
+       mutex_lock(&sev_cmd_mutex);
+       ret = __sev_do_snp_platform_status(&status, &error);
+       mutex_unlock(&sev_cmd_mutex);
+       if (ret < 0)
+               return ret;
+
+       tcb = (struct sev_snp_tcb_version_genoa_milan *)&status
+                     .current_tcb_version;
+       return tcb->snp;
+}
+
+static int get_v2_svn(struct sev_device *sev)
+{
+       struct sev_user_data_snp_status status;
+       struct sev_snp_tcb_version_turin *tcb;
+       int ret, error = 0;
+
+       mutex_lock(&sev_cmd_mutex);
+       ret = __sev_do_snp_platform_status(&status, &error);
+       mutex_unlock(&sev_cmd_mutex);
+       if (ret < 0)
+               return ret;
+
+       tcb = (struct sev_snp_tcb_version_turin *)&status
+                     .current_tcb_version;
+       return tcb->snp;
+}
+
+static bool sev_firmware_allows_es(struct sev_device *sev)
+{
+       /* Documented in AMD-SB-3023 */
+       if (boot_cpu_has(X86_FEATURE_ZEN4) || boot_cpu_has(X86_FEATURE_ZEN3))
+               return get_v1_svn(sev) < 0x1b;
+       else if (boot_cpu_has(X86_FEATURE_ZEN5))
+               return get_v2_svn(sev) < 0x4;
+       else
+               return true;
+}
+
+int sev_firmware_supported_vm_types(void)
+{
+       int supported_vm_types = 0;
+       struct sev_device *sev;
+
+       if (!psp_master || !psp_master->sev_data)
+               return supported_vm_types;
+       sev = psp_master->sev_data;
+
+       supported_vm_types |= BIT(KVM_X86_SEV_VM);
+       supported_vm_types |= BIT(KVM_X86_SEV_ES_VM);
+
+       if (!sev->snp_initialized)
+               return supported_vm_types;
+
+       supported_vm_types |= BIT(KVM_X86_SNP_VM);
+
+       if (!sev_firmware_allows_es(sev))
+               supported_vm_types &= ~BIT(KVM_X86_SEV_ES_VM);
+
+       return supported_vm_types;
+
+}
+EXPORT_SYMBOL_FOR_MODULES(sev_firmware_supported_vm_types, "kvm-amd");

diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h
index d5099a2baca51888732c05200ba1fe2dc935e601..ce16bbc0b3083d44456186fbd8e477e4d8a9e1ed 100644 (file)
--- a/include/linux/psp-sev.h
+++ b/include/linux/psp-sev.h
@@ -902,6 +902,42 @@ struct snp_feature_info {
 /* Feature bits in EBX */
 #define SNP_SEV_TIO_SUPPORTED                  BIT(1)
 
+/**
+ * struct sev_snp_tcb_version_genoa_milan
+ *
+ * @boot_loader: SVN of PSP bootloader
+ * @tee: SVN of PSP operating system
+ * @reserved: reserved
+ * @snp: SVN of SNP firmware
+ * @microcode: Lowest current patch level of all cores
+ */
+struct sev_snp_tcb_version_genoa_milan {
+       u8 boot_loader;
+       u8 tee;
+       u8 reserved[4];
+       u8 snp;
+       u8 microcode;
+};
+
+/**
+ * struct sev_snp_tcb_version_turin
+ *
+ * @fmc: SVN of FMC firmware
+ * @boot_loader: SVN of PSP bootloader
+ * @tee: SVN of PSP operating system
+ * @snp: SVN of SNP firmware
+ * @reserved: reserved
+ * @microcode: Lowest current patch level of all cores
+ */
+struct sev_snp_tcb_version_turin {
+       u8 fmc;
+       u8 boot_loader;
+       u8 tee;
+       u8 snp;
+       u8 reserved[3];
+       u8 microcode;
+};
+
 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
 
 /**
@@ -1048,6 +1084,7 @@ void snp_free_firmware_page(void *addr);
 void sev_platform_shutdown(void);
 bool sev_is_snp_ciphertext_hiding_supported(void);
 u64 sev_get_snp_policy_bits(void);
+int sev_firmware_supported_vm_types(void);
 
 #else  /* !CONFIG_CRYPTO_DEV_SP_PSP */