SEV Command Privilege Separation

I've been working on wrapping various SEV kernel APIs for userspace consumption. There does not appear to be any privilege separation for these commands: you can run them all or none of them. This is less than ideal because it means that a compromise of the code which launches VMs could make perman

Re: [PATCH] crypto: ccp: introduce SEV_GET_ID2 command

I'm a little concerned that this immediately disables SEV_GET_ID. IMHO, we should continue to support both for a period of time. One justification for immediate disablement would be that if keeping it around is likely to enabled incorrect or insecure userspace behavior with a firmware change. Given