2 * AMD Secure Encrypted Virtualization (SEV) driver interface
4 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
6 * Author: Brijesh Singh <brijesh.singh@amd.com>
8 * SEV spec 0.14 is available at:
9 * http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2 as
13 * published by the Free Software Foundation.
19 #include <uapi/linux/psp-sev.h>
22 #include <linux/mem_encrypt.h>
24 #define __psp_pa(x) __sme_pa(x)
26 #define __psp_pa(x) __pa(x)
29 #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
35 SEV_STATE_UNINIT
= 0x0,
37 SEV_STATE_WORKING
= 0x2,
43 * SEV platform and guest management commands
46 /* platform commands */
48 SEV_CMD_SHUTDOWN
= 0x002,
49 SEV_CMD_FACTORY_RESET
= 0x003,
50 SEV_CMD_PLATFORM_STATUS
= 0x004,
51 SEV_CMD_PEK_GEN
= 0x005,
52 SEV_CMD_PEK_CSR
= 0x006,
53 SEV_CMD_PEK_CERT_IMPORT
= 0x007,
54 SEV_CMD_PDH_CERT_EXPORT
= 0x008,
55 SEV_CMD_PDH_GEN
= 0x009,
56 SEV_CMD_DF_FLUSH
= 0x00A,
57 SEV_CMD_DOWNLOAD_FIRMWARE
= 0x00B,
58 SEV_CMD_GET_ID
= 0x00C,
61 SEV_CMD_DECOMMISSION
= 0x020,
62 SEV_CMD_ACTIVATE
= 0x021,
63 SEV_CMD_DEACTIVATE
= 0x022,
64 SEV_CMD_GUEST_STATUS
= 0x023,
66 /* Guest launch commands */
67 SEV_CMD_LAUNCH_START
= 0x030,
68 SEV_CMD_LAUNCH_UPDATE_DATA
= 0x031,
69 SEV_CMD_LAUNCH_UPDATE_VMSA
= 0x032,
70 SEV_CMD_LAUNCH_MEASURE
= 0x033,
71 SEV_CMD_LAUNCH_UPDATE_SECRET
= 0x034,
72 SEV_CMD_LAUNCH_FINISH
= 0x035,
74 /* Guest migration commands (outgoing) */
75 SEV_CMD_SEND_START
= 0x040,
76 SEV_CMD_SEND_UPDATE_DATA
= 0x041,
77 SEV_CMD_SEND_UPDATE_VMSA
= 0x042,
78 SEV_CMD_SEND_FINISH
= 0x043,
80 /* Guest migration commands (incoming) */
81 SEV_CMD_RECEIVE_START
= 0x050,
82 SEV_CMD_RECEIVE_UPDATE_DATA
= 0x051,
83 SEV_CMD_RECEIVE_UPDATE_VMSA
= 0x052,
84 SEV_CMD_RECEIVE_FINISH
= 0x053,
86 /* Guest debug commands */
87 SEV_CMD_DBG_DECRYPT
= 0x060,
88 SEV_CMD_DBG_ENCRYPT
= 0x061,
94 * struct sev_data_init - INIT command parameters
96 * @flags: processing flags
97 * @tmr_address: system physical address used for SEV-ES
98 * @tmr_len: len of tmr_address
100 struct sev_data_init
{
102 u32 reserved
; /* In */
103 u64 tmr_address
; /* In */
104 u32 tmr_len
; /* In */
108 * struct sev_data_pek_csr - PEK_CSR command parameters
110 * @address: PEK certificate chain
111 * @len: len of certificate
113 struct sev_data_pek_csr
{
114 u64 address
; /* In */
115 u32 len
; /* In/Out */
119 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
121 * @pek_address: PEK certificate chain
122 * @pek_len: len of PEK certificate
123 * @oca_address: OCA certificate chain
124 * @oca_len: len of OCA certificate
126 struct sev_data_pek_cert_import
{
127 u64 pek_cert_address
; /* In */
128 u32 pek_cert_len
; /* In */
129 u32 reserved
; /* In */
130 u64 oca_cert_address
; /* In */
131 u32 oca_cert_len
; /* In */
135 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
137 * @address: physical address of firmware image
138 * @len: len of the firmware image
140 struct sev_data_download_firmware
{
141 u64 address
; /* In */
146 * struct sev_data_get_id - GET_ID command parameters
148 * @address: physical address of region to place unique CPU ID(s)
149 * @len: len of the region
151 struct sev_data_get_id
{
152 u64 address
; /* In */
153 u32 len
; /* In/Out */
156 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
158 * @pdh_address: PDH certificate address
159 * @pdh_len: len of PDH certificate
160 * @cert_chain_address: PDH certificate chain
161 * @cert_chain_len: len of PDH certificate chain
163 struct sev_data_pdh_cert_export
{
164 u64 pdh_cert_address
; /* In */
165 u32 pdh_cert_len
; /* In/Out */
166 u32 reserved
; /* In */
167 u64 cert_chain_address
; /* In */
168 u32 cert_chain_len
; /* In/Out */
172 * struct sev_data_decommission - DECOMMISSION command parameters
174 * @handle: handle of the VM to decommission
176 struct sev_data_decommission
{
181 * struct sev_data_activate - ACTIVATE command parameters
183 * @handle: handle of the VM to activate
184 * @asid: asid assigned to the VM
186 struct sev_data_activate
{
192 * struct sev_data_deactivate - DEACTIVATE command parameters
194 * @handle: handle of the VM to deactivate
196 struct sev_data_deactivate
{
201 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
203 * @handle: handle of the VM to retrieve status
204 * @policy: policy information for the VM
205 * @asid: current ASID of the VM
206 * @state: current state of the VM
208 struct sev_data_guest_status
{
210 u32 policy
; /* Out */
216 * struct sev_data_launch_start - LAUNCH_START command parameters
218 * @handle: handle assigned to the VM
219 * @policy: guest launch policy
220 * @dh_cert_address: physical address of DH certificate blob
221 * @dh_cert_len: len of DH certificate blob
222 * @session_address: physical address of session parameters
223 * @session_len: len of session parameters
225 struct sev_data_launch_start
{
226 u32 handle
; /* In/Out */
228 u64 dh_cert_address
; /* In */
229 u32 dh_cert_len
; /* In */
230 u32 reserved
; /* In */
231 u64 session_address
; /* In */
232 u32 session_len
; /* In */
236 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
238 * @handle: handle of the VM to update
239 * @len: len of memory to be encrypted
240 * @address: physical address of memory region to encrypt
242 struct sev_data_launch_update_data
{
245 u64 address
; /* In */
250 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
252 * @handle: handle of the VM
253 * @address: physical address of memory region to encrypt
254 * @len: len of memory region to encrypt
256 struct sev_data_launch_update_vmsa
{
259 u64 address
; /* In */
264 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
266 * @handle: handle of the VM to process
267 * @address: physical address containing the measurement blob
268 * @len: len of measurement blob
270 struct sev_data_launch_measure
{
273 u64 address
; /* In */
274 u32 len
; /* In/Out */
278 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
280 * @handle: handle of the VM to process
281 * @hdr_address: physical address containing the packet header
282 * @hdr_len: len of packet header
283 * @guest_address: system physical address of guest memory region
284 * @guest_len: len of guest_paddr
285 * @trans_address: physical address of transport memory buffer
286 * @trans_len: len of transport memory buffer
288 struct sev_data_launch_secret
{
291 u64 hdr_address
; /* In */
292 u32 hdr_len
; /* In */
294 u64 guest_address
; /* In */
295 u32 guest_len
; /* In */
297 u64 trans_address
; /* In */
298 u32 trans_len
; /* In */
302 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
304 * @handle: handle of the VM to process
306 struct sev_data_launch_finish
{
311 * struct sev_data_send_start - SEND_START command parameters
313 * @handle: handle of the VM to process
314 * @policy: policy information for the VM
315 * @pdh_cert_address: physical address containing PDH certificate
316 * @pdh_cert_len: len of PDH certificate
317 * @plat_certs_address: physical address containing platform certificate
318 * @plat_certs_len: len of platform certificate
319 * @amd_certs_address: physical address containing AMD certificate
320 * @amd_certs_len: len of AMD certificate
321 * @session_address: physical address containing Session data
322 * @session_len: len of session data
324 struct sev_data_send_start
{
326 u32 policy
; /* Out */
327 u64 pdh_cert_address
; /* In */
328 u32 pdh_cert_len
; /* In */
330 u64 plat_cert_address
; /* In */
331 u32 plat_cert_len
; /* In */
333 u64 amd_cert_address
; /* In */
334 u32 amd_cert_len
; /* In */
336 u64 session_address
; /* In */
337 u32 session_len
; /* In/Out */
341 * struct sev_data_send_update - SEND_UPDATE_DATA command
343 * @handle: handle of the VM to process
344 * @hdr_address: physical address containing packet header
345 * @hdr_len: len of packet header
346 * @guest_address: physical address of guest memory region to send
347 * @guest_len: len of guest memory region to send
348 * @trans_address: physical address of host memory region
349 * @trans_len: len of host memory region
351 struct sev_data_send_update_data
{
354 u64 hdr_address
; /* In */
355 u32 hdr_len
; /* In/Out */
357 u64 guest_address
; /* In */
358 u32 guest_len
; /* In */
360 u64 trans_address
; /* In */
361 u32 trans_len
; /* In */
365 * struct sev_data_send_update - SEND_UPDATE_VMSA command
367 * @handle: handle of the VM to process
368 * @hdr_address: physical address containing packet header
369 * @hdr_len: len of packet header
370 * @guest_address: physical address of guest memory region to send
371 * @guest_len: len of guest memory region to send
372 * @trans_address: physical address of host memory region
373 * @trans_len: len of host memory region
375 struct sev_data_send_update_vmsa
{
377 u64 hdr_address
; /* In */
378 u32 hdr_len
; /* In/Out */
380 u64 guest_address
; /* In */
381 u32 guest_len
; /* In */
383 u64 trans_address
; /* In */
384 u32 trans_len
; /* In */
388 * struct sev_data_send_finish - SEND_FINISH command parameters
390 * @handle: handle of the VM to process
392 struct sev_data_send_finish
{
397 * struct sev_data_receive_start - RECEIVE_START command parameters
399 * @handle: handle of the VM to perform receive operation
400 * @pdh_cert_address: system physical address containing PDH certificate blob
401 * @pdh_cert_len: len of PDH certificate blob
402 * @session_address: system physical address containing session blob
403 * @session_len: len of session blob
405 struct sev_data_receive_start
{
406 u32 handle
; /* In/Out */
408 u64 pdh_cert_address
; /* In */
409 u32 pdh_cert_len
; /* In */
411 u64 session_address
; /* In */
412 u32 session_len
; /* In */
416 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
418 * @handle: handle of the VM to update
419 * @hdr_address: physical address containing packet header blob
420 * @hdr_len: len of packet header
421 * @guest_address: system physical address of guest memory region
422 * @guest_len: len of guest memory region
423 * @trans_address: system physical address of transport buffer
424 * @trans_len: len of transport buffer
426 struct sev_data_receive_update_data
{
429 u64 hdr_address
; /* In */
430 u32 hdr_len
; /* In */
432 u64 guest_address
; /* In */
433 u32 guest_len
; /* In */
435 u64 trans_address
; /* In */
436 u32 trans_len
; /* In */
440 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
442 * @handle: handle of the VM to update
443 * @hdr_address: physical address containing packet header blob
444 * @hdr_len: len of packet header
445 * @guest_address: system physical address of guest memory region
446 * @guest_len: len of guest memory region
447 * @trans_address: system physical address of transport buffer
448 * @trans_len: len of transport buffer
450 struct sev_data_receive_update_vmsa
{
453 u64 hdr_address
; /* In */
454 u32 hdr_len
; /* In */
456 u64 guest_address
; /* In */
457 u32 guest_len
; /* In */
459 u64 trans_address
; /* In */
460 u32 trans_len
; /* In */
464 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
466 * @handle: handle of the VM to finish
468 struct sev_data_receive_finish
{
473 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
475 * @handle: handle of the VM to perform debug operation
476 * @src_addr: source address of data to operate on
477 * @dst_addr: destination address of data to operate on
478 * @len: len of data to operate on
480 struct sev_data_dbg
{
483 u64 src_addr
; /* In */
484 u64 dst_addr
; /* In */
488 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
491 * sev_platform_init - perform SEV INIT command
493 * @error: SEV command return code
496 * 0 if the SEV successfully processed the command
497 * -%ENODEV if the SEV device is not available
498 * -%ENOTSUPP if the SEV does not support SEV
499 * -%ETIMEDOUT if the SEV command timed out
500 * -%EIO if the SEV returned a non-zero return code
502 int sev_platform_init(int *error
);
505 * sev_platform_status - perform SEV PLATFORM_STATUS command
507 * @status: sev_user_data_status structure to be processed
508 * @error: SEV command return code
511 * 0 if the SEV successfully processed the command
512 * -%ENODEV if the SEV device is not available
513 * -%ENOTSUPP if the SEV does not support SEV
514 * -%ETIMEDOUT if the SEV command timed out
515 * -%EIO if the SEV returned a non-zero return code
517 int sev_platform_status(struct sev_user_data_status
*status
, int *error
);
520 * sev_issue_cmd_external_user - issue SEV command by other driver with a file
523 * This function can be used by other drivers to issue a SEV command on
524 * behalf of userspace. The caller must pass a valid SEV file descriptor
525 * so that we know that it has access to SEV device.
527 * @filep - SEV device file pointer
528 * @cmd - command to issue
529 * @data - command buffer
530 * @error: SEV command return code
533 * 0 if the SEV successfully processed the command
534 * -%ENODEV if the SEV device is not available
535 * -%ENOTSUPP if the SEV does not support SEV
536 * -%ETIMEDOUT if the SEV command timed out
537 * -%EIO if the SEV returned a non-zero return code
538 * -%EINVAL if the SEV file descriptor is not valid
540 int sev_issue_cmd_external_user(struct file
*filep
, unsigned int id
,
541 void *data
, int *error
);
544 * sev_guest_deactivate - perform SEV DEACTIVATE command
546 * @deactivate: sev_data_deactivate structure to be processed
547 * @sev_ret: sev command return code
550 * 0 if the sev successfully processed the command
551 * -%ENODEV if the sev device is not available
552 * -%ENOTSUPP if the sev does not support SEV
553 * -%ETIMEDOUT if the sev command timed out
554 * -%EIO if the sev returned a non-zero return code
556 int sev_guest_deactivate(struct sev_data_deactivate
*data
, int *error
);
559 * sev_guest_activate - perform SEV ACTIVATE command
561 * @activate: sev_data_activate structure to be processed
562 * @sev_ret: sev command return code
565 * 0 if the sev successfully processed the command
566 * -%ENODEV if the sev device is not available
567 * -%ENOTSUPP if the sev does not support SEV
568 * -%ETIMEDOUT if the sev command timed out
569 * -%EIO if the sev returned a non-zero return code
571 int sev_guest_activate(struct sev_data_activate
*data
, int *error
);
574 * sev_guest_df_flush - perform SEV DF_FLUSH command
576 * @sev_ret: sev command return code
579 * 0 if the sev successfully processed the command
580 * -%ENODEV if the sev device is not available
581 * -%ENOTSUPP if the sev does not support SEV
582 * -%ETIMEDOUT if the sev command timed out
583 * -%EIO if the sev returned a non-zero return code
585 int sev_guest_df_flush(int *error
);
588 * sev_guest_decommission - perform SEV DECOMMISSION command
590 * @decommission: sev_data_decommission structure to be processed
591 * @sev_ret: sev command return code
594 * 0 if the sev successfully processed the command
595 * -%ENODEV if the sev device is not available
596 * -%ENOTSUPP if the sev does not support SEV
597 * -%ETIMEDOUT if the sev command timed out
598 * -%EIO if the sev returned a non-zero return code
600 int sev_guest_decommission(struct sev_data_decommission
*data
, int *error
);
602 void *psp_copy_user_blob(u64 __user uaddr
, u32 len
);
604 #else /* !CONFIG_CRYPTO_DEV_SP_PSP */
607 sev_platform_status(struct sev_user_data_status
*status
, int *error
) { return -ENODEV
; }
609 static inline int sev_platform_init(int *error
) { return -ENODEV
; }
612 sev_guest_deactivate(struct sev_data_deactivate
*data
, int *error
) { return -ENODEV
; }
615 sev_guest_decommission(struct sev_data_decommission
*data
, int *error
) { return -ENODEV
; }
618 sev_guest_activate(struct sev_data_activate
*data
, int *error
) { return -ENODEV
; }
620 static inline int sev_guest_df_flush(int *error
) { return -ENODEV
; }
623 sev_issue_cmd_external_user(struct file
*filep
, unsigned int id
, void *data
, int *error
) { return -ENODEV
; }
625 static inline void *psp_copy_user_blob(u64 __user uaddr
, u32 len
) { return ERR_PTR(-EINVAL
); }
627 #endif /* CONFIG_CRYPTO_DEV_SP_PSP */
629 #endif /* __PSP_SEV_H__ */