1 /* SPDX-License-Identifier: GPL-2.0-only */
3 * AMD Secure Encrypted Virtualization (SEV) driver interface
5 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
7 * Author: Brijesh Singh <brijesh.singh@amd.com>
9 * SEV API spec is available at https://developer.amd.com/sev
15 #include <uapi/linux/psp-sev.h>
18 #include <linux/mem_encrypt.h>
20 #define __psp_pa(x) __sme_pa(x)
22 #define __psp_pa(x) __pa(x)
25 #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
31 SEV_STATE_UNINIT = 0x0,
33 SEV_STATE_WORKING = 0x2,
39 * SEV platform and guest management commands
42 /* platform commands */
44 SEV_CMD_SHUTDOWN = 0x002,
45 SEV_CMD_FACTORY_RESET = 0x003,
46 SEV_CMD_PLATFORM_STATUS = 0x004,
47 SEV_CMD_PEK_GEN = 0x005,
48 SEV_CMD_PEK_CSR = 0x006,
49 SEV_CMD_PEK_CERT_IMPORT = 0x007,
50 SEV_CMD_PDH_CERT_EXPORT = 0x008,
51 SEV_CMD_PDH_GEN = 0x009,
52 SEV_CMD_DF_FLUSH = 0x00A,
53 SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
54 SEV_CMD_GET_ID = 0x00C,
57 SEV_CMD_DECOMMISSION = 0x020,
58 SEV_CMD_ACTIVATE = 0x021,
59 SEV_CMD_DEACTIVATE = 0x022,
60 SEV_CMD_GUEST_STATUS = 0x023,
62 /* Guest launch commands */
63 SEV_CMD_LAUNCH_START = 0x030,
64 SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
65 SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
66 SEV_CMD_LAUNCH_MEASURE = 0x033,
67 SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
68 SEV_CMD_LAUNCH_FINISH = 0x035,
69 SEV_CMD_ATTESTATION_REPORT = 0x036,
71 /* Guest migration commands (outgoing) */
72 SEV_CMD_SEND_START = 0x040,
73 SEV_CMD_SEND_UPDATE_DATA = 0x041,
74 SEV_CMD_SEND_UPDATE_VMSA = 0x042,
75 SEV_CMD_SEND_FINISH = 0x043,
77 /* Guest migration commands (incoming) */
78 SEV_CMD_RECEIVE_START = 0x050,
79 SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
80 SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
81 SEV_CMD_RECEIVE_FINISH = 0x053,
83 /* Guest debug commands */
84 SEV_CMD_DBG_DECRYPT = 0x060,
85 SEV_CMD_DBG_ENCRYPT = 0x061,
91 * struct sev_data_init - INIT command parameters
93 * @flags: processing flags
94 * @tmr_address: system physical address used for SEV-ES
95 * @tmr_len: len of tmr_address
97 struct sev_data_init {
99 u32 reserved; /* In */
100 u64 tmr_address; /* In */
101 u32 tmr_len; /* In */
104 #define SEV_INIT_FLAGS_SEV_ES 0x01
107 * struct sev_data_pek_csr - PEK_CSR command parameters
109 * @address: PEK certificate chain
110 * @len: len of certificate
112 struct sev_data_pek_csr {
113 u64 address; /* In */
114 u32 len; /* In/Out */
118 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
120 * @pek_address: PEK certificate chain
121 * @pek_len: len of PEK certificate
122 * @oca_address: OCA certificate chain
123 * @oca_len: len of OCA certificate
125 struct sev_data_pek_cert_import {
126 u64 pek_cert_address; /* In */
127 u32 pek_cert_len; /* In */
128 u32 reserved; /* In */
129 u64 oca_cert_address; /* In */
130 u32 oca_cert_len; /* In */
134 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
136 * @address: physical address of firmware image
137 * @len: len of the firmware image
139 struct sev_data_download_firmware {
140 u64 address; /* In */
145 * struct sev_data_get_id - GET_ID command parameters
147 * @address: physical address of region to place unique CPU ID(s)
148 * @len: len of the region
150 struct sev_data_get_id {
151 u64 address; /* In */
152 u32 len; /* In/Out */
155 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
157 * @pdh_address: PDH certificate address
158 * @pdh_len: len of PDH certificate
159 * @cert_chain_address: PDH certificate chain
160 * @cert_chain_len: len of PDH certificate chain
162 struct sev_data_pdh_cert_export {
163 u64 pdh_cert_address; /* In */
164 u32 pdh_cert_len; /* In/Out */
165 u32 reserved; /* In */
166 u64 cert_chain_address; /* In */
167 u32 cert_chain_len; /* In/Out */
171 * struct sev_data_decommission - DECOMMISSION command parameters
173 * @handle: handle of the VM to decommission
175 struct sev_data_decommission {
180 * struct sev_data_activate - ACTIVATE command parameters
182 * @handle: handle of the VM to activate
183 * @asid: asid assigned to the VM
185 struct sev_data_activate {
191 * struct sev_data_deactivate - DEACTIVATE command parameters
193 * @handle: handle of the VM to deactivate
195 struct sev_data_deactivate {
200 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
202 * @handle: handle of the VM to retrieve status
203 * @policy: policy information for the VM
204 * @asid: current ASID of the VM
205 * @state: current state of the VM
207 struct sev_data_guest_status {
209 u32 policy; /* Out */
215 * struct sev_data_launch_start - LAUNCH_START command parameters
217 * @handle: handle assigned to the VM
218 * @policy: guest launch policy
219 * @dh_cert_address: physical address of DH certificate blob
220 * @dh_cert_len: len of DH certificate blob
221 * @session_address: physical address of session parameters
222 * @session_len: len of session parameters
224 struct sev_data_launch_start {
225 u32 handle; /* In/Out */
227 u64 dh_cert_address; /* In */
228 u32 dh_cert_len; /* In */
229 u32 reserved; /* In */
230 u64 session_address; /* In */
231 u32 session_len; /* In */
235 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
237 * @handle: handle of the VM to update
238 * @len: len of memory to be encrypted
239 * @address: physical address of memory region to encrypt
241 struct sev_data_launch_update_data {
244 u64 address; /* In */
249 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
251 * @handle: handle of the VM
252 * @address: physical address of memory region to encrypt
253 * @len: len of memory region to encrypt
255 struct sev_data_launch_update_vmsa {
258 u64 address; /* In */
263 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
265 * @handle: handle of the VM to process
266 * @address: physical address containing the measurement blob
267 * @len: len of measurement blob
269 struct sev_data_launch_measure {
272 u64 address; /* In */
273 u32 len; /* In/Out */
277 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
279 * @handle: handle of the VM to process
280 * @hdr_address: physical address containing the packet header
281 * @hdr_len: len of packet header
282 * @guest_address: system physical address of guest memory region
283 * @guest_len: len of guest_paddr
284 * @trans_address: physical address of transport memory buffer
285 * @trans_len: len of transport memory buffer
287 struct sev_data_launch_secret {
290 u64 hdr_address; /* In */
291 u32 hdr_len; /* In */
293 u64 guest_address; /* In */
294 u32 guest_len; /* In */
296 u64 trans_address; /* In */
297 u32 trans_len; /* In */
301 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
303 * @handle: handle of the VM to process
305 struct sev_data_launch_finish {
310 * struct sev_data_send_start - SEND_START command parameters
312 * @handle: handle of the VM to process
313 * @policy: policy information for the VM
314 * @pdh_cert_address: physical address containing PDH certificate
315 * @pdh_cert_len: len of PDH certificate
316 * @plat_certs_address: physical address containing platform certificate
317 * @plat_certs_len: len of platform certificate
318 * @amd_certs_address: physical address containing AMD certificate
319 * @amd_certs_len: len of AMD certificate
320 * @session_address: physical address containing Session data
321 * @session_len: len of session data
323 struct sev_data_send_start {
325 u32 policy; /* Out */
326 u64 pdh_cert_address; /* In */
327 u32 pdh_cert_len; /* In */
329 u64 plat_cert_address; /* In */
330 u32 plat_cert_len; /* In */
332 u64 amd_cert_address; /* In */
333 u32 amd_cert_len; /* In */
335 u64 session_address; /* In */
336 u32 session_len; /* In/Out */
340 * struct sev_data_send_update - SEND_UPDATE_DATA command
342 * @handle: handle of the VM to process
343 * @hdr_address: physical address containing packet header
344 * @hdr_len: len of packet header
345 * @guest_address: physical address of guest memory region to send
346 * @guest_len: len of guest memory region to send
347 * @trans_address: physical address of host memory region
348 * @trans_len: len of host memory region
350 struct sev_data_send_update_data {
353 u64 hdr_address; /* In */
354 u32 hdr_len; /* In/Out */
356 u64 guest_address; /* In */
357 u32 guest_len; /* In */
359 u64 trans_address; /* In */
360 u32 trans_len; /* In */
364 * struct sev_data_send_update - SEND_UPDATE_VMSA command
366 * @handle: handle of the VM to process
367 * @hdr_address: physical address containing packet header
368 * @hdr_len: len of packet header
369 * @guest_address: physical address of guest memory region to send
370 * @guest_len: len of guest memory region to send
371 * @trans_address: physical address of host memory region
372 * @trans_len: len of host memory region
374 struct sev_data_send_update_vmsa {
376 u64 hdr_address; /* In */
377 u32 hdr_len; /* In/Out */
379 u64 guest_address; /* In */
380 u32 guest_len; /* In */
382 u64 trans_address; /* In */
383 u32 trans_len; /* In */
387 * struct sev_data_send_finish - SEND_FINISH command parameters
389 * @handle: handle of the VM to process
391 struct sev_data_send_finish {
396 * struct sev_data_receive_start - RECEIVE_START command parameters
398 * @handle: handle of the VM to perform receive operation
399 * @pdh_cert_address: system physical address containing PDH certificate blob
400 * @pdh_cert_len: len of PDH certificate blob
401 * @session_address: system physical address containing session blob
402 * @session_len: len of session blob
404 struct sev_data_receive_start {
405 u32 handle; /* In/Out */
407 u64 pdh_cert_address; /* In */
408 u32 pdh_cert_len; /* In */
410 u64 session_address; /* In */
411 u32 session_len; /* In */
415 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
417 * @handle: handle of the VM to update
418 * @hdr_address: physical address containing packet header blob
419 * @hdr_len: len of packet header
420 * @guest_address: system physical address of guest memory region
421 * @guest_len: len of guest memory region
422 * @trans_address: system physical address of transport buffer
423 * @trans_len: len of transport buffer
425 struct sev_data_receive_update_data {
428 u64 hdr_address; /* In */
429 u32 hdr_len; /* In */
431 u64 guest_address; /* In */
432 u32 guest_len; /* In */
434 u64 trans_address; /* In */
435 u32 trans_len; /* In */
439 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
441 * @handle: handle of the VM to update
442 * @hdr_address: physical address containing packet header blob
443 * @hdr_len: len of packet header
444 * @guest_address: system physical address of guest memory region
445 * @guest_len: len of guest memory region
446 * @trans_address: system physical address of transport buffer
447 * @trans_len: len of transport buffer
449 struct sev_data_receive_update_vmsa {
452 u64 hdr_address; /* In */
453 u32 hdr_len; /* In */
455 u64 guest_address; /* In */
456 u32 guest_len; /* In */
458 u64 trans_address; /* In */
459 u32 trans_len; /* In */
463 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
465 * @handle: handle of the VM to finish
467 struct sev_data_receive_finish {
472 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
474 * @handle: handle of the VM to perform debug operation
475 * @src_addr: source address of data to operate on
476 * @dst_addr: destination address of data to operate on
477 * @len: len of data to operate on
479 struct sev_data_dbg {
482 u64 src_addr; /* In */
483 u64 dst_addr; /* In */
488 * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters
490 * @handle: handle of the VM
491 * @mnonce: a random nonce that will be included in the report.
492 * @address: physical address where the report will be copied.
493 * @len: length of the physical buffer.
495 struct sev_data_attestation_report {
498 u64 address; /* In */
499 u8 mnonce[16]; /* In */
500 u32 len; /* In/Out */
503 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
506 * sev_platform_init - perform SEV INIT command
508 * @error: SEV command return code
511 * 0 if the SEV successfully processed the command
512 * -%ENODEV if the SEV device is not available
513 * -%ENOTSUPP if the SEV does not support SEV
514 * -%ETIMEDOUT if the SEV command timed out
515 * -%EIO if the SEV returned a non-zero return code
517 int sev_platform_init(int *error);
520 * sev_platform_status - perform SEV PLATFORM_STATUS command
522 * @status: sev_user_data_status structure to be processed
523 * @error: SEV command return code
526 * 0 if the SEV successfully processed the command
527 * -%ENODEV if the SEV device is not available
528 * -%ENOTSUPP if the SEV does not support SEV
529 * -%ETIMEDOUT if the SEV command timed out
530 * -%EIO if the SEV returned a non-zero return code
532 int sev_platform_status(struct sev_user_data_status *status, int *error);
535 * sev_issue_cmd_external_user - issue SEV command by other driver with a file
538 * This function can be used by other drivers to issue a SEV command on
539 * behalf of userspace. The caller must pass a valid SEV file descriptor
540 * so that we know that it has access to SEV device.
542 * @filep - SEV device file pointer
543 * @cmd - command to issue
544 * @data - command buffer
545 * @error: SEV command return code
548 * 0 if the SEV successfully processed the command
549 * -%ENODEV if the SEV device is not available
550 * -%ENOTSUPP if the SEV does not support SEV
551 * -%ETIMEDOUT if the SEV command timed out
552 * -%EIO if the SEV returned a non-zero return code
553 * -%EINVAL if the SEV file descriptor is not valid
555 int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
556 void *data, int *error);
559 * sev_guest_deactivate - perform SEV DEACTIVATE command
561 * @deactivate: sev_data_deactivate structure to be processed
562 * @sev_ret: sev command return code
565 * 0 if the sev successfully processed the command
566 * -%ENODEV if the sev device is not available
567 * -%ENOTSUPP if the sev does not support SEV
568 * -%ETIMEDOUT if the sev command timed out
569 * -%EIO if the sev returned a non-zero return code
571 int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
574 * sev_guest_activate - perform SEV ACTIVATE command
576 * @activate: sev_data_activate structure to be processed
577 * @sev_ret: sev command return code
580 * 0 if the sev successfully processed the command
581 * -%ENODEV if the sev device is not available
582 * -%ENOTSUPP if the sev does not support SEV
583 * -%ETIMEDOUT if the sev command timed out
584 * -%EIO if the sev returned a non-zero return code
586 int sev_guest_activate(struct sev_data_activate *data, int *error);
589 * sev_guest_df_flush - perform SEV DF_FLUSH command
591 * @sev_ret: sev command return code
594 * 0 if the sev successfully processed the command
595 * -%ENODEV if the sev device is not available
596 * -%ENOTSUPP if the sev does not support SEV
597 * -%ETIMEDOUT if the sev command timed out
598 * -%EIO if the sev returned a non-zero return code
600 int sev_guest_df_flush(int *error);
603 * sev_guest_decommission - perform SEV DECOMMISSION command
605 * @decommission: sev_data_decommission structure to be processed
606 * @sev_ret: sev command return code
609 * 0 if the sev successfully processed the command
610 * -%ENODEV if the sev device is not available
611 * -%ENOTSUPP if the sev does not support SEV
612 * -%ETIMEDOUT if the sev command timed out
613 * -%EIO if the sev returned a non-zero return code
615 int sev_guest_decommission(struct sev_data_decommission *data, int *error);
617 void *psp_copy_user_blob(u64 uaddr, u32 len);
619 #else /* !CONFIG_CRYPTO_DEV_SP_PSP */
622 sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
624 static inline int sev_platform_init(int *error) { return -ENODEV; }
627 sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
630 sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
633 sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
635 static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
638 sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
640 static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
642 #endif /* CONFIG_CRYPTO_DEV_SP_PSP */
644 #endif /* __PSP_SEV_H__ */