psp-sev.h 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627
  1. /* SPDX-License-Identifier: GPL-2.0-only */
  2. /*
  3. * AMD Secure Encrypted Virtualization (SEV) driver interface
  4. *
  5. * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
  6. *
  7. * Author: Brijesh Singh <brijesh.singh@amd.com>
  8. *
  9. * SEV API spec is available at https://developer.amd.com/sev
  10. */
  11. #ifndef __PSP_SEV_H__
  12. #define __PSP_SEV_H__
  13. #include <uapi/linux/psp-sev.h>
  14. #ifdef CONFIG_X86
  15. #include <linux/mem_encrypt.h>
  16. #define __psp_pa(x) __sme_pa(x)
  17. #else
  18. #define __psp_pa(x) __pa(x)
  19. #endif
  20. #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
  21. /**
  22. * SEV platform state
  23. */
  24. enum sev_state {
  25. SEV_STATE_UNINIT = 0x0,
  26. SEV_STATE_INIT = 0x1,
  27. SEV_STATE_WORKING = 0x2,
  28. SEV_STATE_MAX
  29. };
  30. /**
  31. * SEV platform and guest management commands
  32. */
  33. enum sev_cmd {
  34. /* platform commands */
  35. SEV_CMD_INIT = 0x001,
  36. SEV_CMD_SHUTDOWN = 0x002,
  37. SEV_CMD_FACTORY_RESET = 0x003,
  38. SEV_CMD_PLATFORM_STATUS = 0x004,
  39. SEV_CMD_PEK_GEN = 0x005,
  40. SEV_CMD_PEK_CSR = 0x006,
  41. SEV_CMD_PEK_CERT_IMPORT = 0x007,
  42. SEV_CMD_PDH_CERT_EXPORT = 0x008,
  43. SEV_CMD_PDH_GEN = 0x009,
  44. SEV_CMD_DF_FLUSH = 0x00A,
  45. SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
  46. SEV_CMD_GET_ID = 0x00C,
  47. /* Guest commands */
  48. SEV_CMD_DECOMMISSION = 0x020,
  49. SEV_CMD_ACTIVATE = 0x021,
  50. SEV_CMD_DEACTIVATE = 0x022,
  51. SEV_CMD_GUEST_STATUS = 0x023,
  52. /* Guest launch commands */
  53. SEV_CMD_LAUNCH_START = 0x030,
  54. SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
  55. SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
  56. SEV_CMD_LAUNCH_MEASURE = 0x033,
  57. SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
  58. SEV_CMD_LAUNCH_FINISH = 0x035,
  59. /* Guest migration commands (outgoing) */
  60. SEV_CMD_SEND_START = 0x040,
  61. SEV_CMD_SEND_UPDATE_DATA = 0x041,
  62. SEV_CMD_SEND_UPDATE_VMSA = 0x042,
  63. SEV_CMD_SEND_FINISH = 0x043,
  64. /* Guest migration commands (incoming) */
  65. SEV_CMD_RECEIVE_START = 0x050,
  66. SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
  67. SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
  68. SEV_CMD_RECEIVE_FINISH = 0x053,
  69. /* Guest debug commands */
  70. SEV_CMD_DBG_DECRYPT = 0x060,
  71. SEV_CMD_DBG_ENCRYPT = 0x061,
  72. SEV_CMD_MAX,
  73. };
  74. /**
  75. * struct sev_data_init - INIT command parameters
  76. *
  77. * @flags: processing flags
  78. * @tmr_address: system physical address used for SEV-ES
  79. * @tmr_len: len of tmr_address
  80. */
  81. struct sev_data_init {
  82. u32 flags; /* In */
  83. u32 reserved; /* In */
  84. u64 tmr_address; /* In */
  85. u32 tmr_len; /* In */
  86. } __packed;
  87. #define SEV_INIT_FLAGS_SEV_ES 0x01
  88. /**
  89. * struct sev_data_pek_csr - PEK_CSR command parameters
  90. *
  91. * @address: PEK certificate chain
  92. * @len: len of certificate
  93. */
  94. struct sev_data_pek_csr {
  95. u64 address; /* In */
  96. u32 len; /* In/Out */
  97. } __packed;
  98. /**
  99. * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
  100. *
  101. * @pek_address: PEK certificate chain
  102. * @pek_len: len of PEK certificate
  103. * @oca_address: OCA certificate chain
  104. * @oca_len: len of OCA certificate
  105. */
  106. struct sev_data_pek_cert_import {
  107. u64 pek_cert_address; /* In */
  108. u32 pek_cert_len; /* In */
  109. u32 reserved; /* In */
  110. u64 oca_cert_address; /* In */
  111. u32 oca_cert_len; /* In */
  112. } __packed;
  113. /**
  114. * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
  115. *
  116. * @address: physical address of firmware image
  117. * @len: len of the firmware image
  118. */
  119. struct sev_data_download_firmware {
  120. u64 address; /* In */
  121. u32 len; /* In */
  122. } __packed;
  123. /**
  124. * struct sev_data_get_id - GET_ID command parameters
  125. *
  126. * @address: physical address of region to place unique CPU ID(s)
  127. * @len: len of the region
  128. */
  129. struct sev_data_get_id {
  130. u64 address; /* In */
  131. u32 len; /* In/Out */
  132. } __packed;
  133. /**
  134. * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
  135. *
  136. * @pdh_address: PDH certificate address
  137. * @pdh_len: len of PDH certificate
  138. * @cert_chain_address: PDH certificate chain
  139. * @cert_chain_len: len of PDH certificate chain
  140. */
  141. struct sev_data_pdh_cert_export {
  142. u64 pdh_cert_address; /* In */
  143. u32 pdh_cert_len; /* In/Out */
  144. u32 reserved; /* In */
  145. u64 cert_chain_address; /* In */
  146. u32 cert_chain_len; /* In/Out */
  147. } __packed;
  148. /**
  149. * struct sev_data_decommission - DECOMMISSION command parameters
  150. *
  151. * @handle: handle of the VM to decommission
  152. */
  153. struct sev_data_decommission {
  154. u32 handle; /* In */
  155. } __packed;
  156. /**
  157. * struct sev_data_activate - ACTIVATE command parameters
  158. *
  159. * @handle: handle of the VM to activate
  160. * @asid: asid assigned to the VM
  161. */
  162. struct sev_data_activate {
  163. u32 handle; /* In */
  164. u32 asid; /* In */
  165. } __packed;
  166. /**
  167. * struct sev_data_deactivate - DEACTIVATE command parameters
  168. *
  169. * @handle: handle of the VM to deactivate
  170. */
  171. struct sev_data_deactivate {
  172. u32 handle; /* In */
  173. } __packed;
  174. /**
  175. * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
  176. *
  177. * @handle: handle of the VM to retrieve status
  178. * @policy: policy information for the VM
  179. * @asid: current ASID of the VM
  180. * @state: current state of the VM
  181. */
  182. struct sev_data_guest_status {
  183. u32 handle; /* In */
  184. u32 policy; /* Out */
  185. u32 asid; /* Out */
  186. u8 state; /* Out */
  187. } __packed;
  188. /**
  189. * struct sev_data_launch_start - LAUNCH_START command parameters
  190. *
  191. * @handle: handle assigned to the VM
  192. * @policy: guest launch policy
  193. * @dh_cert_address: physical address of DH certificate blob
  194. * @dh_cert_len: len of DH certificate blob
  195. * @session_address: physical address of session parameters
  196. * @session_len: len of session parameters
  197. */
  198. struct sev_data_launch_start {
  199. u32 handle; /* In/Out */
  200. u32 policy; /* In */
  201. u64 dh_cert_address; /* In */
  202. u32 dh_cert_len; /* In */
  203. u32 reserved; /* In */
  204. u64 session_address; /* In */
  205. u32 session_len; /* In */
  206. } __packed;
  207. /**
  208. * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
  209. *
  210. * @handle: handle of the VM to update
  211. * @len: len of memory to be encrypted
  212. * @address: physical address of memory region to encrypt
  213. */
  214. struct sev_data_launch_update_data {
  215. u32 handle; /* In */
  216. u32 reserved;
  217. u64 address; /* In */
  218. u32 len; /* In */
  219. } __packed;
  220. /**
  221. * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
  222. *
  223. * @handle: handle of the VM
  224. * @address: physical address of memory region to encrypt
  225. * @len: len of memory region to encrypt
  226. */
  227. struct sev_data_launch_update_vmsa {
  228. u32 handle; /* In */
  229. u32 reserved;
  230. u64 address; /* In */
  231. u32 len; /* In */
  232. } __packed;
  233. /**
  234. * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
  235. *
  236. * @handle: handle of the VM to process
  237. * @address: physical address containing the measurement blob
  238. * @len: len of measurement blob
  239. */
  240. struct sev_data_launch_measure {
  241. u32 handle; /* In */
  242. u32 reserved;
  243. u64 address; /* In */
  244. u32 len; /* In/Out */
  245. } __packed;
  246. /**
  247. * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
  248. *
  249. * @handle: handle of the VM to process
  250. * @hdr_address: physical address containing the packet header
  251. * @hdr_len: len of packet header
  252. * @guest_address: system physical address of guest memory region
  253. * @guest_len: len of guest_paddr
  254. * @trans_address: physical address of transport memory buffer
  255. * @trans_len: len of transport memory buffer
  256. */
  257. struct sev_data_launch_secret {
  258. u32 handle; /* In */
  259. u32 reserved1;
  260. u64 hdr_address; /* In */
  261. u32 hdr_len; /* In */
  262. u32 reserved2;
  263. u64 guest_address; /* In */
  264. u32 guest_len; /* In */
  265. u32 reserved3;
  266. u64 trans_address; /* In */
  267. u32 trans_len; /* In */
  268. } __packed;
  269. /**
  270. * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
  271. *
  272. * @handle: handle of the VM to process
  273. */
  274. struct sev_data_launch_finish {
  275. u32 handle; /* In */
  276. } __packed;
  277. /**
  278. * struct sev_data_send_start - SEND_START command parameters
  279. *
  280. * @handle: handle of the VM to process
  281. * @policy: policy information for the VM
  282. * @pdh_cert_address: physical address containing PDH certificate
  283. * @pdh_cert_len: len of PDH certificate
  284. * @plat_certs_address: physical address containing platform certificate
  285. * @plat_certs_len: len of platform certificate
  286. * @amd_certs_address: physical address containing AMD certificate
  287. * @amd_certs_len: len of AMD certificate
  288. * @session_address: physical address containing Session data
  289. * @session_len: len of session data
  290. */
  291. struct sev_data_send_start {
  292. u32 handle; /* In */
  293. u32 policy; /* Out */
  294. u64 pdh_cert_address; /* In */
  295. u32 pdh_cert_len; /* In */
  296. u32 reserved1;
  297. u64 plat_cert_address; /* In */
  298. u32 plat_cert_len; /* In */
  299. u32 reserved2;
  300. u64 amd_cert_address; /* In */
  301. u32 amd_cert_len; /* In */
  302. u32 reserved3;
  303. u64 session_address; /* In */
  304. u32 session_len; /* In/Out */
  305. } __packed;
  306. /**
  307. * struct sev_data_send_update - SEND_UPDATE_DATA command
  308. *
  309. * @handle: handle of the VM to process
  310. * @hdr_address: physical address containing packet header
  311. * @hdr_len: len of packet header
  312. * @guest_address: physical address of guest memory region to send
  313. * @guest_len: len of guest memory region to send
  314. * @trans_address: physical address of host memory region
  315. * @trans_len: len of host memory region
  316. */
  317. struct sev_data_send_update_data {
  318. u32 handle; /* In */
  319. u32 reserved1;
  320. u64 hdr_address; /* In */
  321. u32 hdr_len; /* In/Out */
  322. u32 reserved2;
  323. u64 guest_address; /* In */
  324. u32 guest_len; /* In */
  325. u32 reserved3;
  326. u64 trans_address; /* In */
  327. u32 trans_len; /* In */
  328. } __packed;
  329. /**
  330. * struct sev_data_send_update - SEND_UPDATE_VMSA command
  331. *
  332. * @handle: handle of the VM to process
  333. * @hdr_address: physical address containing packet header
  334. * @hdr_len: len of packet header
  335. * @guest_address: physical address of guest memory region to send
  336. * @guest_len: len of guest memory region to send
  337. * @trans_address: physical address of host memory region
  338. * @trans_len: len of host memory region
  339. */
  340. struct sev_data_send_update_vmsa {
  341. u32 handle; /* In */
  342. u64 hdr_address; /* In */
  343. u32 hdr_len; /* In/Out */
  344. u32 reserved2;
  345. u64 guest_address; /* In */
  346. u32 guest_len; /* In */
  347. u32 reserved3;
  348. u64 trans_address; /* In */
  349. u32 trans_len; /* In */
  350. } __packed;
  351. /**
  352. * struct sev_data_send_finish - SEND_FINISH command parameters
  353. *
  354. * @handle: handle of the VM to process
  355. */
  356. struct sev_data_send_finish {
  357. u32 handle; /* In */
  358. } __packed;
  359. /**
  360. * struct sev_data_receive_start - RECEIVE_START command parameters
  361. *
  362. * @handle: handle of the VM to perform receive operation
  363. * @pdh_cert_address: system physical address containing PDH certificate blob
  364. * @pdh_cert_len: len of PDH certificate blob
  365. * @session_address: system physical address containing session blob
  366. * @session_len: len of session blob
  367. */
  368. struct sev_data_receive_start {
  369. u32 handle; /* In/Out */
  370. u32 policy; /* In */
  371. u64 pdh_cert_address; /* In */
  372. u32 pdh_cert_len; /* In */
  373. u32 reserved1;
  374. u64 session_address; /* In */
  375. u32 session_len; /* In */
  376. } __packed;
  377. /**
  378. * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
  379. *
  380. * @handle: handle of the VM to update
  381. * @hdr_address: physical address containing packet header blob
  382. * @hdr_len: len of packet header
  383. * @guest_address: system physical address of guest memory region
  384. * @guest_len: len of guest memory region
  385. * @trans_address: system physical address of transport buffer
  386. * @trans_len: len of transport buffer
  387. */
  388. struct sev_data_receive_update_data {
  389. u32 handle; /* In */
  390. u32 reserved1;
  391. u64 hdr_address; /* In */
  392. u32 hdr_len; /* In */
  393. u32 reserved2;
  394. u64 guest_address; /* In */
  395. u32 guest_len; /* In */
  396. u32 reserved3;
  397. u64 trans_address; /* In */
  398. u32 trans_len; /* In */
  399. } __packed;
  400. /**
  401. * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
  402. *
  403. * @handle: handle of the VM to update
  404. * @hdr_address: physical address containing packet header blob
  405. * @hdr_len: len of packet header
  406. * @guest_address: system physical address of guest memory region
  407. * @guest_len: len of guest memory region
  408. * @trans_address: system physical address of transport buffer
  409. * @trans_len: len of transport buffer
  410. */
  411. struct sev_data_receive_update_vmsa {
  412. u32 handle; /* In */
  413. u32 reserved1;
  414. u64 hdr_address; /* In */
  415. u32 hdr_len; /* In */
  416. u32 reserved2;
  417. u64 guest_address; /* In */
  418. u32 guest_len; /* In */
  419. u32 reserved3;
  420. u64 trans_address; /* In */
  421. u32 trans_len; /* In */
  422. } __packed;
  423. /**
  424. * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
  425. *
  426. * @handle: handle of the VM to finish
  427. */
  428. struct sev_data_receive_finish {
  429. u32 handle; /* In */
  430. } __packed;
  431. /**
  432. * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
  433. *
  434. * @handle: handle of the VM to perform debug operation
  435. * @src_addr: source address of data to operate on
  436. * @dst_addr: destination address of data to operate on
  437. * @len: len of data to operate on
  438. */
  439. struct sev_data_dbg {
  440. u32 handle; /* In */
  441. u32 reserved;
  442. u64 src_addr; /* In */
  443. u64 dst_addr; /* In */
  444. u32 len; /* In */
  445. } __packed;
  446. #ifdef CONFIG_CRYPTO_DEV_SP_PSP
  447. /**
  448. * sev_platform_init - perform SEV INIT command
  449. *
  450. * @error: SEV command return code
  451. *
  452. * Returns:
  453. * 0 if the SEV successfully processed the command
  454. * -%ENODEV if the SEV device is not available
  455. * -%ENOTSUPP if the SEV does not support SEV
  456. * -%ETIMEDOUT if the SEV command timed out
  457. * -%EIO if the SEV returned a non-zero return code
  458. */
  459. int sev_platform_init(int *error);
  460. /**
  461. * sev_platform_status - perform SEV PLATFORM_STATUS command
  462. *
  463. * @status: sev_user_data_status structure to be processed
  464. * @error: SEV command return code
  465. *
  466. * Returns:
  467. * 0 if the SEV successfully processed the command
  468. * -%ENODEV if the SEV device is not available
  469. * -%ENOTSUPP if the SEV does not support SEV
  470. * -%ETIMEDOUT if the SEV command timed out
  471. * -%EIO if the SEV returned a non-zero return code
  472. */
  473. int sev_platform_status(struct sev_user_data_status *status, int *error);
  474. /**
  475. * sev_issue_cmd_external_user - issue SEV command by other driver with a file
  476. * handle.
  477. *
  478. * This function can be used by other drivers to issue a SEV command on
  479. * behalf of userspace. The caller must pass a valid SEV file descriptor
  480. * so that we know that it has access to SEV device.
  481. *
  482. * @filep - SEV device file pointer
  483. * @cmd - command to issue
  484. * @data - command buffer
  485. * @error: SEV command return code
  486. *
  487. * Returns:
  488. * 0 if the SEV successfully processed the command
  489. * -%ENODEV if the SEV device is not available
  490. * -%ENOTSUPP if the SEV does not support SEV
  491. * -%ETIMEDOUT if the SEV command timed out
  492. * -%EIO if the SEV returned a non-zero return code
  493. * -%EINVAL if the SEV file descriptor is not valid
  494. */
  495. int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
  496. void *data, int *error);
  497. /**
  498. * sev_guest_deactivate - perform SEV DEACTIVATE command
  499. *
  500. * @deactivate: sev_data_deactivate structure to be processed
  501. * @sev_ret: sev command return code
  502. *
  503. * Returns:
  504. * 0 if the sev successfully processed the command
  505. * -%ENODEV if the sev device is not available
  506. * -%ENOTSUPP if the sev does not support SEV
  507. * -%ETIMEDOUT if the sev command timed out
  508. * -%EIO if the sev returned a non-zero return code
  509. */
  510. int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
  511. /**
  512. * sev_guest_activate - perform SEV ACTIVATE command
  513. *
  514. * @activate: sev_data_activate structure to be processed
  515. * @sev_ret: sev command return code
  516. *
  517. * Returns:
  518. * 0 if the sev successfully processed the command
  519. * -%ENODEV if the sev device is not available
  520. * -%ENOTSUPP if the sev does not support SEV
  521. * -%ETIMEDOUT if the sev command timed out
  522. * -%EIO if the sev returned a non-zero return code
  523. */
  524. int sev_guest_activate(struct sev_data_activate *data, int *error);
  525. /**
  526. * sev_guest_df_flush - perform SEV DF_FLUSH command
  527. *
  528. * @sev_ret: sev command return code
  529. *
  530. * Returns:
  531. * 0 if the sev successfully processed the command
  532. * -%ENODEV if the sev device is not available
  533. * -%ENOTSUPP if the sev does not support SEV
  534. * -%ETIMEDOUT if the sev command timed out
  535. * -%EIO if the sev returned a non-zero return code
  536. */
  537. int sev_guest_df_flush(int *error);
  538. /**
  539. * sev_guest_decommission - perform SEV DECOMMISSION command
  540. *
  541. * @decommission: sev_data_decommission structure to be processed
  542. * @sev_ret: sev command return code
  543. *
  544. * Returns:
  545. * 0 if the sev successfully processed the command
  546. * -%ENODEV if the sev device is not available
  547. * -%ENOTSUPP if the sev does not support SEV
  548. * -%ETIMEDOUT if the sev command timed out
  549. * -%EIO if the sev returned a non-zero return code
  550. */
  551. int sev_guest_decommission(struct sev_data_decommission *data, int *error);
  552. void *psp_copy_user_blob(u64 uaddr, u32 len);
  553. #else /* !CONFIG_CRYPTO_DEV_SP_PSP */
  554. static inline int
  555. sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
  556. static inline int sev_platform_init(int *error) { return -ENODEV; }
  557. static inline int
  558. sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
  559. static inline int
  560. sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
  561. static inline int
  562. sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
  563. static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
  564. static inline int
  565. sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
  566. static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
  567. #endif /* CONFIG_CRYPTO_DEV_SP_PSP */
  568. #endif /* __PSP_SEV_H__ */