| Date | Wed, 10 Apr 2024 17:20:56 -0500 | Subject | Re: [PATCH v12 27/29] crypto: ccp: Add the SNP_VLEK_LOAD command | From | Tom Lendacky <> |
| |
On 3/29/24 17:58, Michael Roth wrote: > When requesting an attestation report a guest is able to specify whether > it wants SNP firmware to sign the report using either a Versioned Chip > Endorsement Key (VCEK), which is derived from chip-unique secrets, or a > Versioned Loaded Endorsement Key (VLEK) which is obtained from an AMD > Key Derivation Service (KDS) and derived from seeds allocated to > enrolled cloud service providers (CSPs). > > For VLEK keys, an SNP_VLEK_LOAD SNP firmware command is used to load > them into the system after obtaining them from the KDS. Add a > corresponding userspace interface so to allow the loading of VLEK keys > into the system. > > See SEV-SNP Firmware ABI 1.54, SNP_VLEK_LOAD for more details. > > Signed-off-by: Michael Roth <michael.roth@amd.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
|