123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675 |
- /* SPDX-License-Identifier: GPL-2.0-only */
- /*
- * AMD Secure Encrypted Virtualization (SEV) driver interface
- *
- * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
- *
- * Author: Brijesh Singh <[email protected]>
- *
- * SEV API spec is available at https://developer.amd.com/sev
- */
- #ifndef __PSP_SEV_H__
- #define __PSP_SEV_H__
- #include <uapi/linux/psp-sev.h>
- #ifdef CONFIG_X86
- #include <linux/mem_encrypt.h>
- #define __psp_pa(x) __sme_pa(x)
- #else
- #define __psp_pa(x) __pa(x)
- #endif
- #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
- /**
- * SEV platform state
- */
- enum sev_state {
- SEV_STATE_UNINIT = 0x0,
- SEV_STATE_INIT = 0x1,
- SEV_STATE_WORKING = 0x2,
- SEV_STATE_MAX
- };
- /**
- * SEV platform and guest management commands
- */
- enum sev_cmd {
- /* platform commands */
- SEV_CMD_INIT = 0x001,
- SEV_CMD_SHUTDOWN = 0x002,
- SEV_CMD_FACTORY_RESET = 0x003,
- SEV_CMD_PLATFORM_STATUS = 0x004,
- SEV_CMD_PEK_GEN = 0x005,
- SEV_CMD_PEK_CSR = 0x006,
- SEV_CMD_PEK_CERT_IMPORT = 0x007,
- SEV_CMD_PDH_CERT_EXPORT = 0x008,
- SEV_CMD_PDH_GEN = 0x009,
- SEV_CMD_DF_FLUSH = 0x00A,
- SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
- SEV_CMD_GET_ID = 0x00C,
- SEV_CMD_INIT_EX = 0x00D,
- /* Guest commands */
- SEV_CMD_DECOMMISSION = 0x020,
- SEV_CMD_ACTIVATE = 0x021,
- SEV_CMD_DEACTIVATE = 0x022,
- SEV_CMD_GUEST_STATUS = 0x023,
- /* Guest launch commands */
- SEV_CMD_LAUNCH_START = 0x030,
- SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
- SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
- SEV_CMD_LAUNCH_MEASURE = 0x033,
- SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
- SEV_CMD_LAUNCH_FINISH = 0x035,
- SEV_CMD_ATTESTATION_REPORT = 0x036,
- /* Guest migration commands (outgoing) */
- SEV_CMD_SEND_START = 0x040,
- SEV_CMD_SEND_UPDATE_DATA = 0x041,
- SEV_CMD_SEND_UPDATE_VMSA = 0x042,
- SEV_CMD_SEND_FINISH = 0x043,
- SEV_CMD_SEND_CANCEL = 0x044,
- /* Guest migration commands (incoming) */
- SEV_CMD_RECEIVE_START = 0x050,
- SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
- SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
- SEV_CMD_RECEIVE_FINISH = 0x053,
- /* Guest debug commands */
- SEV_CMD_DBG_DECRYPT = 0x060,
- SEV_CMD_DBG_ENCRYPT = 0x061,
- SEV_CMD_MAX,
- };
- /**
- * struct sev_data_init - INIT command parameters
- *
- * @flags: processing flags
- * @tmr_address: system physical address used for SEV-ES
- * @tmr_len: len of tmr_address
- */
- struct sev_data_init {
- u32 flags; /* In */
- u32 reserved; /* In */
- u64 tmr_address; /* In */
- u32 tmr_len; /* In */
- } __packed;
- /**
- * struct sev_data_init_ex - INIT_EX command parameters
- *
- * @length: len of the command buffer read by the PSP
- * @flags: processing flags
- * @tmr_address: system physical address used for SEV-ES
- * @tmr_len: len of tmr_address
- * @nv_address: system physical address used for PSP NV storage
- * @nv_len: len of nv_address
- */
- struct sev_data_init_ex {
- u32 length; /* In */
- u32 flags; /* In */
- u64 tmr_address; /* In */
- u32 tmr_len; /* In */
- u32 reserved; /* In */
- u64 nv_address; /* In/Out */
- u32 nv_len; /* In */
- } __packed;
- #define SEV_INIT_FLAGS_SEV_ES 0x01
- /**
- * struct sev_data_pek_csr - PEK_CSR command parameters
- *
- * @address: PEK certificate chain
- * @len: len of certificate
- */
- struct sev_data_pek_csr {
- u64 address; /* In */
- u32 len; /* In/Out */
- } __packed;
- /**
- * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
- *
- * @pek_address: PEK certificate chain
- * @pek_len: len of PEK certificate
- * @oca_address: OCA certificate chain
- * @oca_len: len of OCA certificate
- */
- struct sev_data_pek_cert_import {
- u64 pek_cert_address; /* In */
- u32 pek_cert_len; /* In */
- u32 reserved; /* In */
- u64 oca_cert_address; /* In */
- u32 oca_cert_len; /* In */
- } __packed;
- /**
- * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
- *
- * @address: physical address of firmware image
- * @len: len of the firmware image
- */
- struct sev_data_download_firmware {
- u64 address; /* In */
- u32 len; /* In */
- } __packed;
- /**
- * struct sev_data_get_id - GET_ID command parameters
- *
- * @address: physical address of region to place unique CPU ID(s)
- * @len: len of the region
- */
- struct sev_data_get_id {
- u64 address; /* In */
- u32 len; /* In/Out */
- } __packed;
- /**
- * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
- *
- * @pdh_address: PDH certificate address
- * @pdh_len: len of PDH certificate
- * @cert_chain_address: PDH certificate chain
- * @cert_chain_len: len of PDH certificate chain
- */
- struct sev_data_pdh_cert_export {
- u64 pdh_cert_address; /* In */
- u32 pdh_cert_len; /* In/Out */
- u32 reserved; /* In */
- u64 cert_chain_address; /* In */
- u32 cert_chain_len; /* In/Out */
- } __packed;
- /**
- * struct sev_data_decommission - DECOMMISSION command parameters
- *
- * @handle: handle of the VM to decommission
- */
- struct sev_data_decommission {
- u32 handle; /* In */
- } __packed;
- /**
- * struct sev_data_activate - ACTIVATE command parameters
- *
- * @handle: handle of the VM to activate
- * @asid: asid assigned to the VM
- */
- struct sev_data_activate {
- u32 handle; /* In */
- u32 asid; /* In */
- } __packed;
- /**
- * struct sev_data_deactivate - DEACTIVATE command parameters
- *
- * @handle: handle of the VM to deactivate
- */
- struct sev_data_deactivate {
- u32 handle; /* In */
- } __packed;
- /**
- * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
- *
- * @handle: handle of the VM to retrieve status
- * @policy: policy information for the VM
- * @asid: current ASID of the VM
- * @state: current state of the VM
- */
- struct sev_data_guest_status {
- u32 handle; /* In */
- u32 policy; /* Out */
- u32 asid; /* Out */
- u8 state; /* Out */
- } __packed;
- /**
- * struct sev_data_launch_start - LAUNCH_START command parameters
- *
- * @handle: handle assigned to the VM
- * @policy: guest launch policy
- * @dh_cert_address: physical address of DH certificate blob
- * @dh_cert_len: len of DH certificate blob
- * @session_address: physical address of session parameters
- * @session_len: len of session parameters
- */
- struct sev_data_launch_start {
- u32 handle; /* In/Out */
- u32 policy; /* In */
- u64 dh_cert_address; /* In */
- u32 dh_cert_len; /* In */
- u32 reserved; /* In */
- u64 session_address; /* In */
- u32 session_len; /* In */
- } __packed;
- /**
- * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
- *
- * @handle: handle of the VM to update
- * @len: len of memory to be encrypted
- * @address: physical address of memory region to encrypt
- */
- struct sev_data_launch_update_data {
- u32 handle; /* In */
- u32 reserved;
- u64 address; /* In */
- u32 len; /* In */
- } __packed;
- /**
- * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
- *
- * @handle: handle of the VM
- * @address: physical address of memory region to encrypt
- * @len: len of memory region to encrypt
- */
- struct sev_data_launch_update_vmsa {
- u32 handle; /* In */
- u32 reserved;
- u64 address; /* In */
- u32 len; /* In */
- } __packed;
- /**
- * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
- *
- * @handle: handle of the VM to process
- * @address: physical address containing the measurement blob
- * @len: len of measurement blob
- */
- struct sev_data_launch_measure {
- u32 handle; /* In */
- u32 reserved;
- u64 address; /* In */
- u32 len; /* In/Out */
- } __packed;
- /**
- * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
- *
- * @handle: handle of the VM to process
- * @hdr_address: physical address containing the packet header
- * @hdr_len: len of packet header
- * @guest_address: system physical address of guest memory region
- * @guest_len: len of guest_paddr
- * @trans_address: physical address of transport memory buffer
- * @trans_len: len of transport memory buffer
- */
- struct sev_data_launch_secret {
- u32 handle; /* In */
- u32 reserved1;
- u64 hdr_address; /* In */
- u32 hdr_len; /* In */
- u32 reserved2;
- u64 guest_address; /* In */
- u32 guest_len; /* In */
- u32 reserved3;
- u64 trans_address; /* In */
- u32 trans_len; /* In */
- } __packed;
- /**
- * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
- *
- * @handle: handle of the VM to process
- */
- struct sev_data_launch_finish {
- u32 handle; /* In */
- } __packed;
- /**
- * struct sev_data_send_start - SEND_START command parameters
- *
- * @handle: handle of the VM to process
- * @policy: policy information for the VM
- * @pdh_cert_address: physical address containing PDH certificate
- * @pdh_cert_len: len of PDH certificate
- * @plat_certs_address: physical address containing platform certificate
- * @plat_certs_len: len of platform certificate
- * @amd_certs_address: physical address containing AMD certificate
- * @amd_certs_len: len of AMD certificate
- * @session_address: physical address containing Session data
- * @session_len: len of session data
- */
- struct sev_data_send_start {
- u32 handle; /* In */
- u32 policy; /* Out */
- u64 pdh_cert_address; /* In */
- u32 pdh_cert_len; /* In */
- u32 reserved1;
- u64 plat_certs_address; /* In */
- u32 plat_certs_len; /* In */
- u32 reserved2;
- u64 amd_certs_address; /* In */
- u32 amd_certs_len; /* In */
- u32 reserved3;
- u64 session_address; /* In */
- u32 session_len; /* In/Out */
- } __packed;
- /**
- * struct sev_data_send_update - SEND_UPDATE_DATA command
- *
- * @handle: handle of the VM to process
- * @hdr_address: physical address containing packet header
- * @hdr_len: len of packet header
- * @guest_address: physical address of guest memory region to send
- * @guest_len: len of guest memory region to send
- * @trans_address: physical address of host memory region
- * @trans_len: len of host memory region
- */
- struct sev_data_send_update_data {
- u32 handle; /* In */
- u32 reserved1;
- u64 hdr_address; /* In */
- u32 hdr_len; /* In/Out */
- u32 reserved2;
- u64 guest_address; /* In */
- u32 guest_len; /* In */
- u32 reserved3;
- u64 trans_address; /* In */
- u32 trans_len; /* In */
- } __packed;
- /**
- * struct sev_data_send_update - SEND_UPDATE_VMSA command
- *
- * @handle: handle of the VM to process
- * @hdr_address: physical address containing packet header
- * @hdr_len: len of packet header
- * @guest_address: physical address of guest memory region to send
- * @guest_len: len of guest memory region to send
- * @trans_address: physical address of host memory region
- * @trans_len: len of host memory region
- */
- struct sev_data_send_update_vmsa {
- u32 handle; /* In */
- u64 hdr_address; /* In */
- u32 hdr_len; /* In/Out */
- u32 reserved2;
- u64 guest_address; /* In */
- u32 guest_len; /* In */
- u32 reserved3;
- u64 trans_address; /* In */
- u32 trans_len; /* In */
- } __packed;
- /**
- * struct sev_data_send_finish - SEND_FINISH command parameters
- *
- * @handle: handle of the VM to process
- */
- struct sev_data_send_finish {
- u32 handle; /* In */
- } __packed;
- /**
- * struct sev_data_send_cancel - SEND_CANCEL command parameters
- *
- * @handle: handle of the VM to process
- */
- struct sev_data_send_cancel {
- u32 handle; /* In */
- } __packed;
- /**
- * struct sev_data_receive_start - RECEIVE_START command parameters
- *
- * @handle: handle of the VM to perform receive operation
- * @pdh_cert_address: system physical address containing PDH certificate blob
- * @pdh_cert_len: len of PDH certificate blob
- * @session_address: system physical address containing session blob
- * @session_len: len of session blob
- */
- struct sev_data_receive_start {
- u32 handle; /* In/Out */
- u32 policy; /* In */
- u64 pdh_cert_address; /* In */
- u32 pdh_cert_len; /* In */
- u32 reserved1;
- u64 session_address; /* In */
- u32 session_len; /* In */
- } __packed;
- /**
- * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
- *
- * @handle: handle of the VM to update
- * @hdr_address: physical address containing packet header blob
- * @hdr_len: len of packet header
- * @guest_address: system physical address of guest memory region
- * @guest_len: len of guest memory region
- * @trans_address: system physical address of transport buffer
- * @trans_len: len of transport buffer
- */
- struct sev_data_receive_update_data {
- u32 handle; /* In */
- u32 reserved1;
- u64 hdr_address; /* In */
- u32 hdr_len; /* In */
- u32 reserved2;
- u64 guest_address; /* In */
- u32 guest_len; /* In */
- u32 reserved3;
- u64 trans_address; /* In */
- u32 trans_len; /* In */
- } __packed;
- /**
- * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
- *
- * @handle: handle of the VM to update
- * @hdr_address: physical address containing packet header blob
- * @hdr_len: len of packet header
- * @guest_address: system physical address of guest memory region
- * @guest_len: len of guest memory region
- * @trans_address: system physical address of transport buffer
- * @trans_len: len of transport buffer
- */
- struct sev_data_receive_update_vmsa {
- u32 handle; /* In */
- u32 reserved1;
- u64 hdr_address; /* In */
- u32 hdr_len; /* In */
- u32 reserved2;
- u64 guest_address; /* In */
- u32 guest_len; /* In */
- u32 reserved3;
- u64 trans_address; /* In */
- u32 trans_len; /* In */
- } __packed;
- /**
- * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
- *
- * @handle: handle of the VM to finish
- */
- struct sev_data_receive_finish {
- u32 handle; /* In */
- } __packed;
- /**
- * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
- *
- * @handle: handle of the VM to perform debug operation
- * @src_addr: source address of data to operate on
- * @dst_addr: destination address of data to operate on
- * @len: len of data to operate on
- */
- struct sev_data_dbg {
- u32 handle; /* In */
- u32 reserved;
- u64 src_addr; /* In */
- u64 dst_addr; /* In */
- u32 len; /* In */
- } __packed;
- /**
- * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters
- *
- * @handle: handle of the VM
- * @mnonce: a random nonce that will be included in the report.
- * @address: physical address where the report will be copied.
- * @len: length of the physical buffer.
- */
- struct sev_data_attestation_report {
- u32 handle; /* In */
- u32 reserved;
- u64 address; /* In */
- u8 mnonce[16]; /* In */
- u32 len; /* In/Out */
- } __packed;
- #ifdef CONFIG_CRYPTO_DEV_SP_PSP
- /**
- * sev_platform_init - perform SEV INIT command
- *
- * @error: SEV command return code
- *
- * Returns:
- * 0 if the SEV successfully processed the command
- * -%ENODEV if the SEV device is not available
- * -%ENOTSUPP if the SEV does not support SEV
- * -%ETIMEDOUT if the SEV command timed out
- * -%EIO if the SEV returned a non-zero return code
- */
- int sev_platform_init(int *error);
- /**
- * sev_platform_status - perform SEV PLATFORM_STATUS command
- *
- * @status: sev_user_data_status structure to be processed
- * @error: SEV command return code
- *
- * Returns:
- * 0 if the SEV successfully processed the command
- * -%ENODEV if the SEV device is not available
- * -%ENOTSUPP if the SEV does not support SEV
- * -%ETIMEDOUT if the SEV command timed out
- * -%EIO if the SEV returned a non-zero return code
- */
- int sev_platform_status(struct sev_user_data_status *status, int *error);
- /**
- * sev_issue_cmd_external_user - issue SEV command by other driver with a file
- * handle.
- *
- * This function can be used by other drivers to issue a SEV command on
- * behalf of userspace. The caller must pass a valid SEV file descriptor
- * so that we know that it has access to SEV device.
- *
- * @filep - SEV device file pointer
- * @cmd - command to issue
- * @data - command buffer
- * @error: SEV command return code
- *
- * Returns:
- * 0 if the SEV successfully processed the command
- * -%ENODEV if the SEV device is not available
- * -%ENOTSUPP if the SEV does not support SEV
- * -%ETIMEDOUT if the SEV command timed out
- * -%EIO if the SEV returned a non-zero return code
- * -%EINVAL if the SEV file descriptor is not valid
- */
- int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
- void *data, int *error);
- /**
- * sev_guest_deactivate - perform SEV DEACTIVATE command
- *
- * @deactivate: sev_data_deactivate structure to be processed
- * @sev_ret: sev command return code
- *
- * Returns:
- * 0 if the sev successfully processed the command
- * -%ENODEV if the sev device is not available
- * -%ENOTSUPP if the sev does not support SEV
- * -%ETIMEDOUT if the sev command timed out
- * -%EIO if the sev returned a non-zero return code
- */
- int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
- /**
- * sev_guest_activate - perform SEV ACTIVATE command
- *
- * @activate: sev_data_activate structure to be processed
- * @sev_ret: sev command return code
- *
- * Returns:
- * 0 if the sev successfully processed the command
- * -%ENODEV if the sev device is not available
- * -%ENOTSUPP if the sev does not support SEV
- * -%ETIMEDOUT if the sev command timed out
- * -%EIO if the sev returned a non-zero return code
- */
- int sev_guest_activate(struct sev_data_activate *data, int *error);
- /**
- * sev_guest_df_flush - perform SEV DF_FLUSH command
- *
- * @sev_ret: sev command return code
- *
- * Returns:
- * 0 if the sev successfully processed the command
- * -%ENODEV if the sev device is not available
- * -%ENOTSUPP if the sev does not support SEV
- * -%ETIMEDOUT if the sev command timed out
- * -%EIO if the sev returned a non-zero return code
- */
- int sev_guest_df_flush(int *error);
- /**
- * sev_guest_decommission - perform SEV DECOMMISSION command
- *
- * @decommission: sev_data_decommission structure to be processed
- * @sev_ret: sev command return code
- *
- * Returns:
- * 0 if the sev successfully processed the command
- * -%ENODEV if the sev device is not available
- * -%ENOTSUPP if the sev does not support SEV
- * -%ETIMEDOUT if the sev command timed out
- * -%EIO if the sev returned a non-zero return code
- */
- int sev_guest_decommission(struct sev_data_decommission *data, int *error);
- void *psp_copy_user_blob(u64 uaddr, u32 len);
- #else /* !CONFIG_CRYPTO_DEV_SP_PSP */
- static inline int
- sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
- static inline int sev_platform_init(int *error) { return -ENODEV; }
- static inline int
- sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
- static inline int
- sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
- static inline int
- sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
- static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
- static inline int
- sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
- static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
- #endif /* CONFIG_CRYPTO_DEV_SP_PSP */
- #endif /* __PSP_SEV_H__ */
|