Loading...
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * AMD Secure Encrypted Virtualization (SEV) driver interface
4 *
5 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
6 *
7 * Author: Brijesh Singh <brijesh.singh@amd.com>
8 *
9 * SEV API spec is available at https://developer.amd.com/sev
10 */
11
12#ifndef __PSP_SEV_H__
13#define __PSP_SEV_H__
14
15#include <uapi/linux/psp-sev.h>
16
17#ifdef CONFIG_X86
18#include <linux/mem_encrypt.h>
19
20#define __psp_pa(x) __sme_pa(x)
21#else
22#define __psp_pa(x) __pa(x)
23#endif
24
25#define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
26
27/**
28 * SEV platform state
29 */
30enum sev_state {
31 SEV_STATE_UNINIT = 0x0,
32 SEV_STATE_INIT = 0x1,
33 SEV_STATE_WORKING = 0x2,
34
35 SEV_STATE_MAX
36};
37
38/**
39 * SEV platform and guest management commands
40 */
41enum sev_cmd {
42 /* platform commands */
43 SEV_CMD_INIT = 0x001,
44 SEV_CMD_SHUTDOWN = 0x002,
45 SEV_CMD_FACTORY_RESET = 0x003,
46 SEV_CMD_PLATFORM_STATUS = 0x004,
47 SEV_CMD_PEK_GEN = 0x005,
48 SEV_CMD_PEK_CSR = 0x006,
49 SEV_CMD_PEK_CERT_IMPORT = 0x007,
50 SEV_CMD_PDH_CERT_EXPORT = 0x008,
51 SEV_CMD_PDH_GEN = 0x009,
52 SEV_CMD_DF_FLUSH = 0x00A,
53 SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
54 SEV_CMD_GET_ID = 0x00C,
55
56 /* Guest commands */
57 SEV_CMD_DECOMMISSION = 0x020,
58 SEV_CMD_ACTIVATE = 0x021,
59 SEV_CMD_DEACTIVATE = 0x022,
60 SEV_CMD_GUEST_STATUS = 0x023,
61
62 /* Guest launch commands */
63 SEV_CMD_LAUNCH_START = 0x030,
64 SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
65 SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
66 SEV_CMD_LAUNCH_MEASURE = 0x033,
67 SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
68 SEV_CMD_LAUNCH_FINISH = 0x035,
69
70 /* Guest migration commands (outgoing) */
71 SEV_CMD_SEND_START = 0x040,
72 SEV_CMD_SEND_UPDATE_DATA = 0x041,
73 SEV_CMD_SEND_UPDATE_VMSA = 0x042,
74 SEV_CMD_SEND_FINISH = 0x043,
75
76 /* Guest migration commands (incoming) */
77 SEV_CMD_RECEIVE_START = 0x050,
78 SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
79 SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
80 SEV_CMD_RECEIVE_FINISH = 0x053,
81
82 /* Guest debug commands */
83 SEV_CMD_DBG_DECRYPT = 0x060,
84 SEV_CMD_DBG_ENCRYPT = 0x061,
85
86 SEV_CMD_MAX,
87};
88
89/**
90 * struct sev_data_init - INIT command parameters
91 *
92 * @flags: processing flags
93 * @tmr_address: system physical address used for SEV-ES
94 * @tmr_len: len of tmr_address
95 */
96struct sev_data_init {
97 u32 flags; /* In */
98 u32 reserved; /* In */
99 u64 tmr_address; /* In */
100 u32 tmr_len; /* In */
101} __packed;
102
103#define SEV_INIT_FLAGS_SEV_ES 0x01
104
105/**
106 * struct sev_data_pek_csr - PEK_CSR command parameters
107 *
108 * @address: PEK certificate chain
109 * @len: len of certificate
110 */
111struct sev_data_pek_csr {
112 u64 address; /* In */
113 u32 len; /* In/Out */
114} __packed;
115
116/**
117 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
118 *
119 * @pek_address: PEK certificate chain
120 * @pek_len: len of PEK certificate
121 * @oca_address: OCA certificate chain
122 * @oca_len: len of OCA certificate
123 */
124struct sev_data_pek_cert_import {
125 u64 pek_cert_address; /* In */
126 u32 pek_cert_len; /* In */
127 u32 reserved; /* In */
128 u64 oca_cert_address; /* In */
129 u32 oca_cert_len; /* In */
130} __packed;
131
132/**
133 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
134 *
135 * @address: physical address of firmware image
136 * @len: len of the firmware image
137 */
138struct sev_data_download_firmware {
139 u64 address; /* In */
140 u32 len; /* In */
141} __packed;
142
143/**
144 * struct sev_data_get_id - GET_ID command parameters
145 *
146 * @address: physical address of region to place unique CPU ID(s)
147 * @len: len of the region
148 */
149struct sev_data_get_id {
150 u64 address; /* In */
151 u32 len; /* In/Out */
152} __packed;
153/**
154 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
155 *
156 * @pdh_address: PDH certificate address
157 * @pdh_len: len of PDH certificate
158 * @cert_chain_address: PDH certificate chain
159 * @cert_chain_len: len of PDH certificate chain
160 */
161struct sev_data_pdh_cert_export {
162 u64 pdh_cert_address; /* In */
163 u32 pdh_cert_len; /* In/Out */
164 u32 reserved; /* In */
165 u64 cert_chain_address; /* In */
166 u32 cert_chain_len; /* In/Out */
167} __packed;
168
169/**
170 * struct sev_data_decommission - DECOMMISSION command parameters
171 *
172 * @handle: handle of the VM to decommission
173 */
174struct sev_data_decommission {
175 u32 handle; /* In */
176} __packed;
177
178/**
179 * struct sev_data_activate - ACTIVATE command parameters
180 *
181 * @handle: handle of the VM to activate
182 * @asid: asid assigned to the VM
183 */
184struct sev_data_activate {
185 u32 handle; /* In */
186 u32 asid; /* In */
187} __packed;
188
189/**
190 * struct sev_data_deactivate - DEACTIVATE command parameters
191 *
192 * @handle: handle of the VM to deactivate
193 */
194struct sev_data_deactivate {
195 u32 handle; /* In */
196} __packed;
197
198/**
199 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
200 *
201 * @handle: handle of the VM to retrieve status
202 * @policy: policy information for the VM
203 * @asid: current ASID of the VM
204 * @state: current state of the VM
205 */
206struct sev_data_guest_status {
207 u32 handle; /* In */
208 u32 policy; /* Out */
209 u32 asid; /* Out */
210 u8 state; /* Out */
211} __packed;
212
213/**
214 * struct sev_data_launch_start - LAUNCH_START command parameters
215 *
216 * @handle: handle assigned to the VM
217 * @policy: guest launch policy
218 * @dh_cert_address: physical address of DH certificate blob
219 * @dh_cert_len: len of DH certificate blob
220 * @session_address: physical address of session parameters
221 * @session_len: len of session parameters
222 */
223struct sev_data_launch_start {
224 u32 handle; /* In/Out */
225 u32 policy; /* In */
226 u64 dh_cert_address; /* In */
227 u32 dh_cert_len; /* In */
228 u32 reserved; /* In */
229 u64 session_address; /* In */
230 u32 session_len; /* In */
231} __packed;
232
233/**
234 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
235 *
236 * @handle: handle of the VM to update
237 * @len: len of memory to be encrypted
238 * @address: physical address of memory region to encrypt
239 */
240struct sev_data_launch_update_data {
241 u32 handle; /* In */
242 u32 reserved;
243 u64 address; /* In */
244 u32 len; /* In */
245} __packed;
246
247/**
248 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
249 *
250 * @handle: handle of the VM
251 * @address: physical address of memory region to encrypt
252 * @len: len of memory region to encrypt
253 */
254struct sev_data_launch_update_vmsa {
255 u32 handle; /* In */
256 u32 reserved;
257 u64 address; /* In */
258 u32 len; /* In */
259} __packed;
260
261/**
262 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
263 *
264 * @handle: handle of the VM to process
265 * @address: physical address containing the measurement blob
266 * @len: len of measurement blob
267 */
268struct sev_data_launch_measure {
269 u32 handle; /* In */
270 u32 reserved;
271 u64 address; /* In */
272 u32 len; /* In/Out */
273} __packed;
274
275/**
276 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
277 *
278 * @handle: handle of the VM to process
279 * @hdr_address: physical address containing the packet header
280 * @hdr_len: len of packet header
281 * @guest_address: system physical address of guest memory region
282 * @guest_len: len of guest_paddr
283 * @trans_address: physical address of transport memory buffer
284 * @trans_len: len of transport memory buffer
285 */
286struct sev_data_launch_secret {
287 u32 handle; /* In */
288 u32 reserved1;
289 u64 hdr_address; /* In */
290 u32 hdr_len; /* In */
291 u32 reserved2;
292 u64 guest_address; /* In */
293 u32 guest_len; /* In */
294 u32 reserved3;
295 u64 trans_address; /* In */
296 u32 trans_len; /* In */
297} __packed;
298
299/**
300 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
301 *
302 * @handle: handle of the VM to process
303 */
304struct sev_data_launch_finish {
305 u32 handle; /* In */
306} __packed;
307
308/**
309 * struct sev_data_send_start - SEND_START command parameters
310 *
311 * @handle: handle of the VM to process
312 * @policy: policy information for the VM
313 * @pdh_cert_address: physical address containing PDH certificate
314 * @pdh_cert_len: len of PDH certificate
315 * @plat_certs_address: physical address containing platform certificate
316 * @plat_certs_len: len of platform certificate
317 * @amd_certs_address: physical address containing AMD certificate
318 * @amd_certs_len: len of AMD certificate
319 * @session_address: physical address containing Session data
320 * @session_len: len of session data
321 */
322struct sev_data_send_start {
323 u32 handle; /* In */
324 u32 policy; /* Out */
325 u64 pdh_cert_address; /* In */
326 u32 pdh_cert_len; /* In */
327 u32 reserved1;
328 u64 plat_cert_address; /* In */
329 u32 plat_cert_len; /* In */
330 u32 reserved2;
331 u64 amd_cert_address; /* In */
332 u32 amd_cert_len; /* In */
333 u32 reserved3;
334 u64 session_address; /* In */
335 u32 session_len; /* In/Out */
336} __packed;
337
338/**
339 * struct sev_data_send_update - SEND_UPDATE_DATA command
340 *
341 * @handle: handle of the VM to process
342 * @hdr_address: physical address containing packet header
343 * @hdr_len: len of packet header
344 * @guest_address: physical address of guest memory region to send
345 * @guest_len: len of guest memory region to send
346 * @trans_address: physical address of host memory region
347 * @trans_len: len of host memory region
348 */
349struct sev_data_send_update_data {
350 u32 handle; /* In */
351 u32 reserved1;
352 u64 hdr_address; /* In */
353 u32 hdr_len; /* In/Out */
354 u32 reserved2;
355 u64 guest_address; /* In */
356 u32 guest_len; /* In */
357 u32 reserved3;
358 u64 trans_address; /* In */
359 u32 trans_len; /* In */
360} __packed;
361
362/**
363 * struct sev_data_send_update - SEND_UPDATE_VMSA command
364 *
365 * @handle: handle of the VM to process
366 * @hdr_address: physical address containing packet header
367 * @hdr_len: len of packet header
368 * @guest_address: physical address of guest memory region to send
369 * @guest_len: len of guest memory region to send
370 * @trans_address: physical address of host memory region
371 * @trans_len: len of host memory region
372 */
373struct sev_data_send_update_vmsa {
374 u32 handle; /* In */
375 u64 hdr_address; /* In */
376 u32 hdr_len; /* In/Out */
377 u32 reserved2;
378 u64 guest_address; /* In */
379 u32 guest_len; /* In */
380 u32 reserved3;
381 u64 trans_address; /* In */
382 u32 trans_len; /* In */
383} __packed;
384
385/**
386 * struct sev_data_send_finish - SEND_FINISH command parameters
387 *
388 * @handle: handle of the VM to process
389 */
390struct sev_data_send_finish {
391 u32 handle; /* In */
392} __packed;
393
394/**
395 * struct sev_data_receive_start - RECEIVE_START command parameters
396 *
397 * @handle: handle of the VM to perform receive operation
398 * @pdh_cert_address: system physical address containing PDH certificate blob
399 * @pdh_cert_len: len of PDH certificate blob
400 * @session_address: system physical address containing session blob
401 * @session_len: len of session blob
402 */
403struct sev_data_receive_start {
404 u32 handle; /* In/Out */
405 u32 policy; /* In */
406 u64 pdh_cert_address; /* In */
407 u32 pdh_cert_len; /* In */
408 u32 reserved1;
409 u64 session_address; /* In */
410 u32 session_len; /* In */
411} __packed;
412
413/**
414 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
415 *
416 * @handle: handle of the VM to update
417 * @hdr_address: physical address containing packet header blob
418 * @hdr_len: len of packet header
419 * @guest_address: system physical address of guest memory region
420 * @guest_len: len of guest memory region
421 * @trans_address: system physical address of transport buffer
422 * @trans_len: len of transport buffer
423 */
424struct sev_data_receive_update_data {
425 u32 handle; /* In */
426 u32 reserved1;
427 u64 hdr_address; /* In */
428 u32 hdr_len; /* In */
429 u32 reserved2;
430 u64 guest_address; /* In */
431 u32 guest_len; /* In */
432 u32 reserved3;
433 u64 trans_address; /* In */
434 u32 trans_len; /* In */
435} __packed;
436
437/**
438 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
439 *
440 * @handle: handle of the VM to update
441 * @hdr_address: physical address containing packet header blob
442 * @hdr_len: len of packet header
443 * @guest_address: system physical address of guest memory region
444 * @guest_len: len of guest memory region
445 * @trans_address: system physical address of transport buffer
446 * @trans_len: len of transport buffer
447 */
448struct sev_data_receive_update_vmsa {
449 u32 handle; /* In */
450 u32 reserved1;
451 u64 hdr_address; /* In */
452 u32 hdr_len; /* In */
453 u32 reserved2;
454 u64 guest_address; /* In */
455 u32 guest_len; /* In */
456 u32 reserved3;
457 u64 trans_address; /* In */
458 u32 trans_len; /* In */
459} __packed;
460
461/**
462 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
463 *
464 * @handle: handle of the VM to finish
465 */
466struct sev_data_receive_finish {
467 u32 handle; /* In */
468} __packed;
469
470/**
471 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
472 *
473 * @handle: handle of the VM to perform debug operation
474 * @src_addr: source address of data to operate on
475 * @dst_addr: destination address of data to operate on
476 * @len: len of data to operate on
477 */
478struct sev_data_dbg {
479 u32 handle; /* In */
480 u32 reserved;
481 u64 src_addr; /* In */
482 u64 dst_addr; /* In */
483 u32 len; /* In */
484} __packed;
485
486#ifdef CONFIG_CRYPTO_DEV_SP_PSP
487
488/**
489 * sev_platform_init - perform SEV INIT command
490 *
491 * @error: SEV command return code
492 *
493 * Returns:
494 * 0 if the SEV successfully processed the command
495 * -%ENODEV if the SEV device is not available
496 * -%ENOTSUPP if the SEV does not support SEV
497 * -%ETIMEDOUT if the SEV command timed out
498 * -%EIO if the SEV returned a non-zero return code
499 */
500int sev_platform_init(int *error);
501
502/**
503 * sev_platform_status - perform SEV PLATFORM_STATUS command
504 *
505 * @status: sev_user_data_status structure to be processed
506 * @error: SEV command return code
507 *
508 * Returns:
509 * 0 if the SEV successfully processed the command
510 * -%ENODEV if the SEV device is not available
511 * -%ENOTSUPP if the SEV does not support SEV
512 * -%ETIMEDOUT if the SEV command timed out
513 * -%EIO if the SEV returned a non-zero return code
514 */
515int sev_platform_status(struct sev_user_data_status *status, int *error);
516
517/**
518 * sev_issue_cmd_external_user - issue SEV command by other driver with a file
519 * handle.
520 *
521 * This function can be used by other drivers to issue a SEV command on
522 * behalf of userspace. The caller must pass a valid SEV file descriptor
523 * so that we know that it has access to SEV device.
524 *
525 * @filep - SEV device file pointer
526 * @cmd - command to issue
527 * @data - command buffer
528 * @error: SEV command return code
529 *
530 * Returns:
531 * 0 if the SEV successfully processed the command
532 * -%ENODEV if the SEV device is not available
533 * -%ENOTSUPP if the SEV does not support SEV
534 * -%ETIMEDOUT if the SEV command timed out
535 * -%EIO if the SEV returned a non-zero return code
536 * -%EINVAL if the SEV file descriptor is not valid
537 */
538int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
539 void *data, int *error);
540
541/**
542 * sev_guest_deactivate - perform SEV DEACTIVATE command
543 *
544 * @deactivate: sev_data_deactivate structure to be processed
545 * @sev_ret: sev command return code
546 *
547 * Returns:
548 * 0 if the sev successfully processed the command
549 * -%ENODEV if the sev device is not available
550 * -%ENOTSUPP if the sev does not support SEV
551 * -%ETIMEDOUT if the sev command timed out
552 * -%EIO if the sev returned a non-zero return code
553 */
554int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
555
556/**
557 * sev_guest_activate - perform SEV ACTIVATE command
558 *
559 * @activate: sev_data_activate structure to be processed
560 * @sev_ret: sev command return code
561 *
562 * Returns:
563 * 0 if the sev successfully processed the command
564 * -%ENODEV if the sev device is not available
565 * -%ENOTSUPP if the sev does not support SEV
566 * -%ETIMEDOUT if the sev command timed out
567 * -%EIO if the sev returned a non-zero return code
568 */
569int sev_guest_activate(struct sev_data_activate *data, int *error);
570
571/**
572 * sev_guest_df_flush - perform SEV DF_FLUSH command
573 *
574 * @sev_ret: sev command return code
575 *
576 * Returns:
577 * 0 if the sev successfully processed the command
578 * -%ENODEV if the sev device is not available
579 * -%ENOTSUPP if the sev does not support SEV
580 * -%ETIMEDOUT if the sev command timed out
581 * -%EIO if the sev returned a non-zero return code
582 */
583int sev_guest_df_flush(int *error);
584
585/**
586 * sev_guest_decommission - perform SEV DECOMMISSION command
587 *
588 * @decommission: sev_data_decommission structure to be processed
589 * @sev_ret: sev command return code
590 *
591 * Returns:
592 * 0 if the sev successfully processed the command
593 * -%ENODEV if the sev device is not available
594 * -%ENOTSUPP if the sev does not support SEV
595 * -%ETIMEDOUT if the sev command timed out
596 * -%EIO if the sev returned a non-zero return code
597 */
598int sev_guest_decommission(struct sev_data_decommission *data, int *error);
599
600void *psp_copy_user_blob(u64 uaddr, u32 len);
601
602#else /* !CONFIG_CRYPTO_DEV_SP_PSP */
603
604static inline int
605sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
606
607static inline int sev_platform_init(int *error) { return -ENODEV; }
608
609static inline int
610sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
611
612static inline int
613sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
614
615static inline int
616sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
617
618static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
619
620static inline int
621sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
622
623static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
624
625#endif /* CONFIG_CRYPTO_DEV_SP_PSP */
626
627#endif /* __PSP_SEV_H__ */
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * AMD Secure Encrypted Virtualization (SEV) driver interface
4 *
5 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
6 *
7 * Author: Brijesh Singh <brijesh.singh@amd.com>
8 *
9 * SEV API spec is available at https://developer.amd.com/sev
10 */
11
12#ifndef __PSP_SEV_H__
13#define __PSP_SEV_H__
14
15#include <uapi/linux/psp-sev.h>
16
17#ifdef CONFIG_X86
18#include <linux/mem_encrypt.h>
19
20#define __psp_pa(x) __sme_pa(x)
21#else
22#define __psp_pa(x) __pa(x)
23#endif
24
25#define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
26
27/**
28 * SEV platform state
29 */
30enum sev_state {
31 SEV_STATE_UNINIT = 0x0,
32 SEV_STATE_INIT = 0x1,
33 SEV_STATE_WORKING = 0x2,
34
35 SEV_STATE_MAX
36};
37
38/**
39 * SEV platform and guest management commands
40 */
41enum sev_cmd {
42 /* platform commands */
43 SEV_CMD_INIT = 0x001,
44 SEV_CMD_SHUTDOWN = 0x002,
45 SEV_CMD_FACTORY_RESET = 0x003,
46 SEV_CMD_PLATFORM_STATUS = 0x004,
47 SEV_CMD_PEK_GEN = 0x005,
48 SEV_CMD_PEK_CSR = 0x006,
49 SEV_CMD_PEK_CERT_IMPORT = 0x007,
50 SEV_CMD_PDH_CERT_EXPORT = 0x008,
51 SEV_CMD_PDH_GEN = 0x009,
52 SEV_CMD_DF_FLUSH = 0x00A,
53 SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
54 SEV_CMD_GET_ID = 0x00C,
55
56 /* Guest commands */
57 SEV_CMD_DECOMMISSION = 0x020,
58 SEV_CMD_ACTIVATE = 0x021,
59 SEV_CMD_DEACTIVATE = 0x022,
60 SEV_CMD_GUEST_STATUS = 0x023,
61
62 /* Guest launch commands */
63 SEV_CMD_LAUNCH_START = 0x030,
64 SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
65 SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
66 SEV_CMD_LAUNCH_MEASURE = 0x033,
67 SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
68 SEV_CMD_LAUNCH_FINISH = 0x035,
69 SEV_CMD_ATTESTATION_REPORT = 0x036,
70
71 /* Guest migration commands (outgoing) */
72 SEV_CMD_SEND_START = 0x040,
73 SEV_CMD_SEND_UPDATE_DATA = 0x041,
74 SEV_CMD_SEND_UPDATE_VMSA = 0x042,
75 SEV_CMD_SEND_FINISH = 0x043,
76 SEV_CMD_SEND_CANCEL = 0x044,
77
78 /* Guest migration commands (incoming) */
79 SEV_CMD_RECEIVE_START = 0x050,
80 SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
81 SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
82 SEV_CMD_RECEIVE_FINISH = 0x053,
83
84 /* Guest debug commands */
85 SEV_CMD_DBG_DECRYPT = 0x060,
86 SEV_CMD_DBG_ENCRYPT = 0x061,
87
88 SEV_CMD_MAX,
89};
90
91/**
92 * struct sev_data_init - INIT command parameters
93 *
94 * @flags: processing flags
95 * @tmr_address: system physical address used for SEV-ES
96 * @tmr_len: len of tmr_address
97 */
98struct sev_data_init {
99 u32 flags; /* In */
100 u32 reserved; /* In */
101 u64 tmr_address; /* In */
102 u32 tmr_len; /* In */
103} __packed;
104
105#define SEV_INIT_FLAGS_SEV_ES 0x01
106
107/**
108 * struct sev_data_pek_csr - PEK_CSR command parameters
109 *
110 * @address: PEK certificate chain
111 * @len: len of certificate
112 */
113struct sev_data_pek_csr {
114 u64 address; /* In */
115 u32 len; /* In/Out */
116} __packed;
117
118/**
119 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
120 *
121 * @pek_address: PEK certificate chain
122 * @pek_len: len of PEK certificate
123 * @oca_address: OCA certificate chain
124 * @oca_len: len of OCA certificate
125 */
126struct sev_data_pek_cert_import {
127 u64 pek_cert_address; /* In */
128 u32 pek_cert_len; /* In */
129 u32 reserved; /* In */
130 u64 oca_cert_address; /* In */
131 u32 oca_cert_len; /* In */
132} __packed;
133
134/**
135 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
136 *
137 * @address: physical address of firmware image
138 * @len: len of the firmware image
139 */
140struct sev_data_download_firmware {
141 u64 address; /* In */
142 u32 len; /* In */
143} __packed;
144
145/**
146 * struct sev_data_get_id - GET_ID command parameters
147 *
148 * @address: physical address of region to place unique CPU ID(s)
149 * @len: len of the region
150 */
151struct sev_data_get_id {
152 u64 address; /* In */
153 u32 len; /* In/Out */
154} __packed;
155/**
156 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
157 *
158 * @pdh_address: PDH certificate address
159 * @pdh_len: len of PDH certificate
160 * @cert_chain_address: PDH certificate chain
161 * @cert_chain_len: len of PDH certificate chain
162 */
163struct sev_data_pdh_cert_export {
164 u64 pdh_cert_address; /* In */
165 u32 pdh_cert_len; /* In/Out */
166 u32 reserved; /* In */
167 u64 cert_chain_address; /* In */
168 u32 cert_chain_len; /* In/Out */
169} __packed;
170
171/**
172 * struct sev_data_decommission - DECOMMISSION command parameters
173 *
174 * @handle: handle of the VM to decommission
175 */
176struct sev_data_decommission {
177 u32 handle; /* In */
178} __packed;
179
180/**
181 * struct sev_data_activate - ACTIVATE command parameters
182 *
183 * @handle: handle of the VM to activate
184 * @asid: asid assigned to the VM
185 */
186struct sev_data_activate {
187 u32 handle; /* In */
188 u32 asid; /* In */
189} __packed;
190
191/**
192 * struct sev_data_deactivate - DEACTIVATE command parameters
193 *
194 * @handle: handle of the VM to deactivate
195 */
196struct sev_data_deactivate {
197 u32 handle; /* In */
198} __packed;
199
200/**
201 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
202 *
203 * @handle: handle of the VM to retrieve status
204 * @policy: policy information for the VM
205 * @asid: current ASID of the VM
206 * @state: current state of the VM
207 */
208struct sev_data_guest_status {
209 u32 handle; /* In */
210 u32 policy; /* Out */
211 u32 asid; /* Out */
212 u8 state; /* Out */
213} __packed;
214
215/**
216 * struct sev_data_launch_start - LAUNCH_START command parameters
217 *
218 * @handle: handle assigned to the VM
219 * @policy: guest launch policy
220 * @dh_cert_address: physical address of DH certificate blob
221 * @dh_cert_len: len of DH certificate blob
222 * @session_address: physical address of session parameters
223 * @session_len: len of session parameters
224 */
225struct sev_data_launch_start {
226 u32 handle; /* In/Out */
227 u32 policy; /* In */
228 u64 dh_cert_address; /* In */
229 u32 dh_cert_len; /* In */
230 u32 reserved; /* In */
231 u64 session_address; /* In */
232 u32 session_len; /* In */
233} __packed;
234
235/**
236 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
237 *
238 * @handle: handle of the VM to update
239 * @len: len of memory to be encrypted
240 * @address: physical address of memory region to encrypt
241 */
242struct sev_data_launch_update_data {
243 u32 handle; /* In */
244 u32 reserved;
245 u64 address; /* In */
246 u32 len; /* In */
247} __packed;
248
249/**
250 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
251 *
252 * @handle: handle of the VM
253 * @address: physical address of memory region to encrypt
254 * @len: len of memory region to encrypt
255 */
256struct sev_data_launch_update_vmsa {
257 u32 handle; /* In */
258 u32 reserved;
259 u64 address; /* In */
260 u32 len; /* In */
261} __packed;
262
263/**
264 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
265 *
266 * @handle: handle of the VM to process
267 * @address: physical address containing the measurement blob
268 * @len: len of measurement blob
269 */
270struct sev_data_launch_measure {
271 u32 handle; /* In */
272 u32 reserved;
273 u64 address; /* In */
274 u32 len; /* In/Out */
275} __packed;
276
277/**
278 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
279 *
280 * @handle: handle of the VM to process
281 * @hdr_address: physical address containing the packet header
282 * @hdr_len: len of packet header
283 * @guest_address: system physical address of guest memory region
284 * @guest_len: len of guest_paddr
285 * @trans_address: physical address of transport memory buffer
286 * @trans_len: len of transport memory buffer
287 */
288struct sev_data_launch_secret {
289 u32 handle; /* In */
290 u32 reserved1;
291 u64 hdr_address; /* In */
292 u32 hdr_len; /* In */
293 u32 reserved2;
294 u64 guest_address; /* In */
295 u32 guest_len; /* In */
296 u32 reserved3;
297 u64 trans_address; /* In */
298 u32 trans_len; /* In */
299} __packed;
300
301/**
302 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
303 *
304 * @handle: handle of the VM to process
305 */
306struct sev_data_launch_finish {
307 u32 handle; /* In */
308} __packed;
309
310/**
311 * struct sev_data_send_start - SEND_START command parameters
312 *
313 * @handle: handle of the VM to process
314 * @policy: policy information for the VM
315 * @pdh_cert_address: physical address containing PDH certificate
316 * @pdh_cert_len: len of PDH certificate
317 * @plat_certs_address: physical address containing platform certificate
318 * @plat_certs_len: len of platform certificate
319 * @amd_certs_address: physical address containing AMD certificate
320 * @amd_certs_len: len of AMD certificate
321 * @session_address: physical address containing Session data
322 * @session_len: len of session data
323 */
324struct sev_data_send_start {
325 u32 handle; /* In */
326 u32 policy; /* Out */
327 u64 pdh_cert_address; /* In */
328 u32 pdh_cert_len; /* In */
329 u32 reserved1;
330 u64 plat_certs_address; /* In */
331 u32 plat_certs_len; /* In */
332 u32 reserved2;
333 u64 amd_certs_address; /* In */
334 u32 amd_certs_len; /* In */
335 u32 reserved3;
336 u64 session_address; /* In */
337 u32 session_len; /* In/Out */
338} __packed;
339
340/**
341 * struct sev_data_send_update - SEND_UPDATE_DATA command
342 *
343 * @handle: handle of the VM to process
344 * @hdr_address: physical address containing packet header
345 * @hdr_len: len of packet header
346 * @guest_address: physical address of guest memory region to send
347 * @guest_len: len of guest memory region to send
348 * @trans_address: physical address of host memory region
349 * @trans_len: len of host memory region
350 */
351struct sev_data_send_update_data {
352 u32 handle; /* In */
353 u32 reserved1;
354 u64 hdr_address; /* In */
355 u32 hdr_len; /* In/Out */
356 u32 reserved2;
357 u64 guest_address; /* In */
358 u32 guest_len; /* In */
359 u32 reserved3;
360 u64 trans_address; /* In */
361 u32 trans_len; /* In */
362} __packed;
363
364/**
365 * struct sev_data_send_update - SEND_UPDATE_VMSA command
366 *
367 * @handle: handle of the VM to process
368 * @hdr_address: physical address containing packet header
369 * @hdr_len: len of packet header
370 * @guest_address: physical address of guest memory region to send
371 * @guest_len: len of guest memory region to send
372 * @trans_address: physical address of host memory region
373 * @trans_len: len of host memory region
374 */
375struct sev_data_send_update_vmsa {
376 u32 handle; /* In */
377 u64 hdr_address; /* In */
378 u32 hdr_len; /* In/Out */
379 u32 reserved2;
380 u64 guest_address; /* In */
381 u32 guest_len; /* In */
382 u32 reserved3;
383 u64 trans_address; /* In */
384 u32 trans_len; /* In */
385} __packed;
386
387/**
388 * struct sev_data_send_finish - SEND_FINISH command parameters
389 *
390 * @handle: handle of the VM to process
391 */
392struct sev_data_send_finish {
393 u32 handle; /* In */
394} __packed;
395
396/**
397 * struct sev_data_send_cancel - SEND_CANCEL command parameters
398 *
399 * @handle: handle of the VM to process
400 */
401struct sev_data_send_cancel {
402 u32 handle; /* In */
403} __packed;
404
405/**
406 * struct sev_data_receive_start - RECEIVE_START command parameters
407 *
408 * @handle: handle of the VM to perform receive operation
409 * @pdh_cert_address: system physical address containing PDH certificate blob
410 * @pdh_cert_len: len of PDH certificate blob
411 * @session_address: system physical address containing session blob
412 * @session_len: len of session blob
413 */
414struct sev_data_receive_start {
415 u32 handle; /* In/Out */
416 u32 policy; /* In */
417 u64 pdh_cert_address; /* In */
418 u32 pdh_cert_len; /* In */
419 u32 reserved1;
420 u64 session_address; /* In */
421 u32 session_len; /* In */
422} __packed;
423
424/**
425 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
426 *
427 * @handle: handle of the VM to update
428 * @hdr_address: physical address containing packet header blob
429 * @hdr_len: len of packet header
430 * @guest_address: system physical address of guest memory region
431 * @guest_len: len of guest memory region
432 * @trans_address: system physical address of transport buffer
433 * @trans_len: len of transport buffer
434 */
435struct sev_data_receive_update_data {
436 u32 handle; /* In */
437 u32 reserved1;
438 u64 hdr_address; /* In */
439 u32 hdr_len; /* In */
440 u32 reserved2;
441 u64 guest_address; /* In */
442 u32 guest_len; /* In */
443 u32 reserved3;
444 u64 trans_address; /* In */
445 u32 trans_len; /* In */
446} __packed;
447
448/**
449 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
450 *
451 * @handle: handle of the VM to update
452 * @hdr_address: physical address containing packet header blob
453 * @hdr_len: len of packet header
454 * @guest_address: system physical address of guest memory region
455 * @guest_len: len of guest memory region
456 * @trans_address: system physical address of transport buffer
457 * @trans_len: len of transport buffer
458 */
459struct sev_data_receive_update_vmsa {
460 u32 handle; /* In */
461 u32 reserved1;
462 u64 hdr_address; /* In */
463 u32 hdr_len; /* In */
464 u32 reserved2;
465 u64 guest_address; /* In */
466 u32 guest_len; /* In */
467 u32 reserved3;
468 u64 trans_address; /* In */
469 u32 trans_len; /* In */
470} __packed;
471
472/**
473 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
474 *
475 * @handle: handle of the VM to finish
476 */
477struct sev_data_receive_finish {
478 u32 handle; /* In */
479} __packed;
480
481/**
482 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
483 *
484 * @handle: handle of the VM to perform debug operation
485 * @src_addr: source address of data to operate on
486 * @dst_addr: destination address of data to operate on
487 * @len: len of data to operate on
488 */
489struct sev_data_dbg {
490 u32 handle; /* In */
491 u32 reserved;
492 u64 src_addr; /* In */
493 u64 dst_addr; /* In */
494 u32 len; /* In */
495} __packed;
496
497/**
498 * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters
499 *
500 * @handle: handle of the VM
501 * @mnonce: a random nonce that will be included in the report.
502 * @address: physical address where the report will be copied.
503 * @len: length of the physical buffer.
504 */
505struct sev_data_attestation_report {
506 u32 handle; /* In */
507 u32 reserved;
508 u64 address; /* In */
509 u8 mnonce[16]; /* In */
510 u32 len; /* In/Out */
511} __packed;
512
513#ifdef CONFIG_CRYPTO_DEV_SP_PSP
514
515/**
516 * sev_platform_init - perform SEV INIT command
517 *
518 * @error: SEV command return code
519 *
520 * Returns:
521 * 0 if the SEV successfully processed the command
522 * -%ENODEV if the SEV device is not available
523 * -%ENOTSUPP if the SEV does not support SEV
524 * -%ETIMEDOUT if the SEV command timed out
525 * -%EIO if the SEV returned a non-zero return code
526 */
527int sev_platform_init(int *error);
528
529/**
530 * sev_platform_status - perform SEV PLATFORM_STATUS command
531 *
532 * @status: sev_user_data_status structure to be processed
533 * @error: SEV command return code
534 *
535 * Returns:
536 * 0 if the SEV successfully processed the command
537 * -%ENODEV if the SEV device is not available
538 * -%ENOTSUPP if the SEV does not support SEV
539 * -%ETIMEDOUT if the SEV command timed out
540 * -%EIO if the SEV returned a non-zero return code
541 */
542int sev_platform_status(struct sev_user_data_status *status, int *error);
543
544/**
545 * sev_issue_cmd_external_user - issue SEV command by other driver with a file
546 * handle.
547 *
548 * This function can be used by other drivers to issue a SEV command on
549 * behalf of userspace. The caller must pass a valid SEV file descriptor
550 * so that we know that it has access to SEV device.
551 *
552 * @filep - SEV device file pointer
553 * @cmd - command to issue
554 * @data - command buffer
555 * @error: SEV command return code
556 *
557 * Returns:
558 * 0 if the SEV successfully processed the command
559 * -%ENODEV if the SEV device is not available
560 * -%ENOTSUPP if the SEV does not support SEV
561 * -%ETIMEDOUT if the SEV command timed out
562 * -%EIO if the SEV returned a non-zero return code
563 * -%EINVAL if the SEV file descriptor is not valid
564 */
565int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
566 void *data, int *error);
567
568/**
569 * sev_guest_deactivate - perform SEV DEACTIVATE command
570 *
571 * @deactivate: sev_data_deactivate structure to be processed
572 * @sev_ret: sev command return code
573 *
574 * Returns:
575 * 0 if the sev successfully processed the command
576 * -%ENODEV if the sev device is not available
577 * -%ENOTSUPP if the sev does not support SEV
578 * -%ETIMEDOUT if the sev command timed out
579 * -%EIO if the sev returned a non-zero return code
580 */
581int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
582
583/**
584 * sev_guest_activate - perform SEV ACTIVATE command
585 *
586 * @activate: sev_data_activate structure to be processed
587 * @sev_ret: sev command return code
588 *
589 * Returns:
590 * 0 if the sev successfully processed the command
591 * -%ENODEV if the sev device is not available
592 * -%ENOTSUPP if the sev does not support SEV
593 * -%ETIMEDOUT if the sev command timed out
594 * -%EIO if the sev returned a non-zero return code
595 */
596int sev_guest_activate(struct sev_data_activate *data, int *error);
597
598/**
599 * sev_guest_df_flush - perform SEV DF_FLUSH command
600 *
601 * @sev_ret: sev command return code
602 *
603 * Returns:
604 * 0 if the sev successfully processed the command
605 * -%ENODEV if the sev device is not available
606 * -%ENOTSUPP if the sev does not support SEV
607 * -%ETIMEDOUT if the sev command timed out
608 * -%EIO if the sev returned a non-zero return code
609 */
610int sev_guest_df_flush(int *error);
611
612/**
613 * sev_guest_decommission - perform SEV DECOMMISSION command
614 *
615 * @decommission: sev_data_decommission structure to be processed
616 * @sev_ret: sev command return code
617 *
618 * Returns:
619 * 0 if the sev successfully processed the command
620 * -%ENODEV if the sev device is not available
621 * -%ENOTSUPP if the sev does not support SEV
622 * -%ETIMEDOUT if the sev command timed out
623 * -%EIO if the sev returned a non-zero return code
624 */
625int sev_guest_decommission(struct sev_data_decommission *data, int *error);
626
627void *psp_copy_user_blob(u64 uaddr, u32 len);
628
629#else /* !CONFIG_CRYPTO_DEV_SP_PSP */
630
631static inline int
632sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
633
634static inline int sev_platform_init(int *error) { return -ENODEV; }
635
636static inline int
637sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
638
639static inline int
640sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
641
642static inline int
643sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
644
645static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
646
647static inline int
648sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
649
650static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
651
652#endif /* CONFIG_CRYPTO_DEV_SP_PSP */
653
654#endif /* __PSP_SEV_H__ */