1d9c52522SMasahiro Yamada /* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ 21d57b17cSBrijesh Singh /* 31d57b17cSBrijesh Singh * Userspace interface for AMD Secure Encrypted Virtualization (SEV) 41d57b17cSBrijesh Singh * platform management commands. 51d57b17cSBrijesh Singh * 61d57b17cSBrijesh Singh * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. 71d57b17cSBrijesh Singh * 81d57b17cSBrijesh Singh * Author: Brijesh Singh <brijesh.singh@amd.com> 91d57b17cSBrijesh Singh * 10d6112ea0SSingh, Brijesh * SEV API specification is available at: https://developer.amd.com/sev/ 111d57b17cSBrijesh Singh */ 121d57b17cSBrijesh Singh 131d57b17cSBrijesh Singh #ifndef __PSP_SEV_USER_H__ 141d57b17cSBrijesh Singh #define __PSP_SEV_USER_H__ 151d57b17cSBrijesh Singh 161d57b17cSBrijesh Singh #include <linux/types.h> 171d57b17cSBrijesh Singh 181d57b17cSBrijesh Singh /** 191d57b17cSBrijesh Singh * SEV platform commands 201d57b17cSBrijesh Singh */ 211d57b17cSBrijesh Singh enum { 221d57b17cSBrijesh Singh SEV_FACTORY_RESET = 0, 231d57b17cSBrijesh Singh SEV_PLATFORM_STATUS, 241d57b17cSBrijesh Singh SEV_PEK_GEN, 251d57b17cSBrijesh Singh SEV_PEK_CSR, 261d57b17cSBrijesh Singh SEV_PDH_GEN, 271d57b17cSBrijesh Singh SEV_PDH_CERT_EXPORT, 281d57b17cSBrijesh Singh SEV_PEK_CERT_IMPORT, 29d6112ea0SSingh, Brijesh SEV_GET_ID, /* This command is deprecated, use SEV_GET_ID2 */ 30d6112ea0SSingh, Brijesh SEV_GET_ID2, 31f5db8841SBrijesh Singh SNP_PLATFORM_STATUS, 32fad133c7STom Lendacky SNP_COMMIT, 33*cb645fe4SBrijesh Singh SNP_SET_CONFIG, 341d57b17cSBrijesh Singh 351d57b17cSBrijesh Singh SEV_MAX, 361d57b17cSBrijesh Singh }; 371d57b17cSBrijesh Singh 381d57b17cSBrijesh Singh /** 391d57b17cSBrijesh Singh * SEV Firmware status code 401d57b17cSBrijesh Singh */ 411d57b17cSBrijesh Singh typedef enum { 42efb339a8SPeter Gonda /* 43efb339a8SPeter Gonda * This error code is not in the SEV spec. Its purpose is to convey that 44efb339a8SPeter Gonda * there was an error that prevented the SEV firmware from being called. 45efb339a8SPeter Gonda * The SEV API error codes are 16 bits, so the -1 value will not overlap 46efb339a8SPeter Gonda * with possible values from the specification. 47efb339a8SPeter Gonda */ 48efb339a8SPeter Gonda SEV_RET_NO_FW_CALL = -1, 491d57b17cSBrijesh Singh SEV_RET_SUCCESS = 0, 501d57b17cSBrijesh Singh SEV_RET_INVALID_PLATFORM_STATE, 511d57b17cSBrijesh Singh SEV_RET_INVALID_GUEST_STATE, 521d57b17cSBrijesh Singh SEV_RET_INAVLID_CONFIG, 5345d0be87SBrijesh Singh SEV_RET_INVALID_LEN, 541d57b17cSBrijesh Singh SEV_RET_ALREADY_OWNED, 551d57b17cSBrijesh Singh SEV_RET_INVALID_CERTIFICATE, 561d57b17cSBrijesh Singh SEV_RET_POLICY_FAILURE, 571d57b17cSBrijesh Singh SEV_RET_INACTIVE, 581d57b17cSBrijesh Singh SEV_RET_INVALID_ADDRESS, 591d57b17cSBrijesh Singh SEV_RET_BAD_SIGNATURE, 601d57b17cSBrijesh Singh SEV_RET_BAD_MEASUREMENT, 611d57b17cSBrijesh Singh SEV_RET_ASID_OWNED, 621d57b17cSBrijesh Singh SEV_RET_INVALID_ASID, 631d57b17cSBrijesh Singh SEV_RET_WBINVD_REQUIRED, 641d57b17cSBrijesh Singh SEV_RET_DFFLUSH_REQUIRED, 651d57b17cSBrijesh Singh SEV_RET_INVALID_GUEST, 661d57b17cSBrijesh Singh SEV_RET_INVALID_COMMAND, 671d57b17cSBrijesh Singh SEV_RET_ACTIVE, 681d57b17cSBrijesh Singh SEV_RET_HWSEV_RET_PLATFORM, 691d57b17cSBrijesh Singh SEV_RET_HWSEV_RET_UNSAFE, 701d57b17cSBrijesh Singh SEV_RET_UNSUPPORTED, 711d55fdc8SAshish Kalra SEV_RET_INVALID_PARAM, 721d55fdc8SAshish Kalra SEV_RET_RESOURCE_LIMIT, 731d55fdc8SAshish Kalra SEV_RET_SECURE_DATA_INVALID, 74f4790678SDan Williams SEV_RET_INVALID_KEY = 0x27, 753a45dc2bSBrijesh Singh SEV_RET_INVALID_PAGE_SIZE, 763a45dc2bSBrijesh Singh SEV_RET_INVALID_PAGE_STATE, 773a45dc2bSBrijesh Singh SEV_RET_INVALID_MDATA_ENTRY, 783a45dc2bSBrijesh Singh SEV_RET_INVALID_PAGE_OWNER, 793a45dc2bSBrijesh Singh SEV_RET_INVALID_PAGE_AEAD_OFLOW, 803a45dc2bSBrijesh Singh SEV_RET_RMP_INIT_REQUIRED, 811d57b17cSBrijesh Singh SEV_RET_MAX, 821d57b17cSBrijesh Singh } sev_ret_code; 831d57b17cSBrijesh Singh 841d57b17cSBrijesh Singh /** 851d57b17cSBrijesh Singh * struct sev_user_data_status - PLATFORM_STATUS command parameters 861d57b17cSBrijesh Singh * 871d57b17cSBrijesh Singh * @major: major API version 881d57b17cSBrijesh Singh * @minor: minor API version 891d57b17cSBrijesh Singh * @state: platform state 901d57b17cSBrijesh Singh * @flags: platform config flags 911d57b17cSBrijesh Singh * @build: firmware build id for API version 921d57b17cSBrijesh Singh * @guest_count: number of active guests 931d57b17cSBrijesh Singh */ 941d57b17cSBrijesh Singh struct sev_user_data_status { 951d57b17cSBrijesh Singh __u8 api_major; /* Out */ 961d57b17cSBrijesh Singh __u8 api_minor; /* Out */ 971d57b17cSBrijesh Singh __u8 state; /* Out */ 981d57b17cSBrijesh Singh __u32 flags; /* Out */ 991d57b17cSBrijesh Singh __u8 build; /* Out */ 1001d57b17cSBrijesh Singh __u32 guest_count; /* Out */ 1011d57b17cSBrijesh Singh } __packed; 1021d57b17cSBrijesh Singh 10397f9ac3dSTom Lendacky #define SEV_STATUS_FLAGS_CONFIG_ES 0x0100 10497f9ac3dSTom Lendacky 1051d57b17cSBrijesh Singh /** 1061d57b17cSBrijesh Singh * struct sev_user_data_pek_csr - PEK_CSR command parameters 1071d57b17cSBrijesh Singh * 1081d57b17cSBrijesh Singh * @address: PEK certificate chain 1091d57b17cSBrijesh Singh * @length: length of certificate 1101d57b17cSBrijesh Singh */ 1111d57b17cSBrijesh Singh struct sev_user_data_pek_csr { 1121d57b17cSBrijesh Singh __u64 address; /* In */ 1131d57b17cSBrijesh Singh __u32 length; /* In/Out */ 1141d57b17cSBrijesh Singh } __packed; 1151d57b17cSBrijesh Singh 1161d57b17cSBrijesh Singh /** 1171d57b17cSBrijesh Singh * struct sev_user_data_cert_import - PEK_CERT_IMPORT command parameters 1181d57b17cSBrijesh Singh * 1191d57b17cSBrijesh Singh * @pek_address: PEK certificate chain 1201d57b17cSBrijesh Singh * @pek_len: length of PEK certificate 1211d57b17cSBrijesh Singh * @oca_address: OCA certificate chain 1221d57b17cSBrijesh Singh * @oca_len: length of OCA certificate 1231d57b17cSBrijesh Singh */ 1241d57b17cSBrijesh Singh struct sev_user_data_pek_cert_import { 1251d57b17cSBrijesh Singh __u64 pek_cert_address; /* In */ 1261d57b17cSBrijesh Singh __u32 pek_cert_len; /* In */ 1271d57b17cSBrijesh Singh __u64 oca_cert_address; /* In */ 1281d57b17cSBrijesh Singh __u32 oca_cert_len; /* In */ 1291d57b17cSBrijesh Singh } __packed; 1301d57b17cSBrijesh Singh 1311d57b17cSBrijesh Singh /** 1321d57b17cSBrijesh Singh * struct sev_user_data_pdh_cert_export - PDH_CERT_EXPORT command parameters 1331d57b17cSBrijesh Singh * 1341d57b17cSBrijesh Singh * @pdh_address: PDH certificate address 1351d57b17cSBrijesh Singh * @pdh_len: length of PDH certificate 1361d57b17cSBrijesh Singh * @cert_chain_address: PDH certificate chain 1371d57b17cSBrijesh Singh * @cert_chain_len: length of PDH certificate chain 1381d57b17cSBrijesh Singh */ 1391d57b17cSBrijesh Singh struct sev_user_data_pdh_cert_export { 1401d57b17cSBrijesh Singh __u64 pdh_cert_address; /* In */ 1411d57b17cSBrijesh Singh __u32 pdh_cert_len; /* In/Out */ 1421d57b17cSBrijesh Singh __u64 cert_chain_address; /* In */ 1431d57b17cSBrijesh Singh __u32 cert_chain_len; /* In/Out */ 1441d57b17cSBrijesh Singh } __packed; 1451d57b17cSBrijesh Singh 1461d57b17cSBrijesh Singh /** 147d6112ea0SSingh, Brijesh * struct sev_user_data_get_id - GET_ID command parameters (deprecated) 1480b3a830bSJanakarajan Natarajan * 1490b3a830bSJanakarajan Natarajan * @socket1: Buffer to pass unique ID of first socket 1500b3a830bSJanakarajan Natarajan * @socket2: Buffer to pass unique ID of second socket 1510b3a830bSJanakarajan Natarajan */ 1520b3a830bSJanakarajan Natarajan struct sev_user_data_get_id { 1530b3a830bSJanakarajan Natarajan __u8 socket1[64]; /* Out */ 1540b3a830bSJanakarajan Natarajan __u8 socket2[64]; /* Out */ 1550b3a830bSJanakarajan Natarajan } __packed; 1560b3a830bSJanakarajan Natarajan 1570b3a830bSJanakarajan Natarajan /** 158d6112ea0SSingh, Brijesh * struct sev_user_data_get_id2 - GET_ID command parameters 159d6112ea0SSingh, Brijesh * @address: Buffer to store unique ID 160d6112ea0SSingh, Brijesh * @length: length of the unique ID 161d6112ea0SSingh, Brijesh */ 162d6112ea0SSingh, Brijesh struct sev_user_data_get_id2 { 163d6112ea0SSingh, Brijesh __u64 address; /* In */ 164d6112ea0SSingh, Brijesh __u32 length; /* In/Out */ 165d6112ea0SSingh, Brijesh } __packed; 166d6112ea0SSingh, Brijesh 167d6112ea0SSingh, Brijesh /** 1683a45dc2bSBrijesh Singh * struct sev_user_data_snp_status - SNP status 1693a45dc2bSBrijesh Singh * 1703a45dc2bSBrijesh Singh * @api_major: API major version 1713a45dc2bSBrijesh Singh * @api_minor: API minor version 1723a45dc2bSBrijesh Singh * @state: current platform state 1733a45dc2bSBrijesh Singh * @is_rmp_initialized: whether RMP is initialized or not 1743a45dc2bSBrijesh Singh * @rsvd: reserved 1753a45dc2bSBrijesh Singh * @build_id: firmware build id for the API version 1763a45dc2bSBrijesh Singh * @mask_chip_id: whether chip id is present in attestation reports or not 1773a45dc2bSBrijesh Singh * @mask_chip_key: whether attestation reports are signed or not 1783a45dc2bSBrijesh Singh * @vlek_en: VLEK (Version Loaded Endorsement Key) hashstick is loaded 1793a45dc2bSBrijesh Singh * @rsvd1: reserved 1803a45dc2bSBrijesh Singh * @guest_count: the number of guest currently managed by the firmware 1813a45dc2bSBrijesh Singh * @current_tcb_version: current TCB version 1823a45dc2bSBrijesh Singh * @reported_tcb_version: reported TCB version 1833a45dc2bSBrijesh Singh */ 1843a45dc2bSBrijesh Singh struct sev_user_data_snp_status { 1853a45dc2bSBrijesh Singh __u8 api_major; /* Out */ 1863a45dc2bSBrijesh Singh __u8 api_minor; /* Out */ 1873a45dc2bSBrijesh Singh __u8 state; /* Out */ 1883a45dc2bSBrijesh Singh __u8 is_rmp_initialized:1; /* Out */ 1893a45dc2bSBrijesh Singh __u8 rsvd:7; 1903a45dc2bSBrijesh Singh __u32 build_id; /* Out */ 1913a45dc2bSBrijesh Singh __u32 mask_chip_id:1; /* Out */ 1923a45dc2bSBrijesh Singh __u32 mask_chip_key:1; /* Out */ 1933a45dc2bSBrijesh Singh __u32 vlek_en:1; /* Out */ 1943a45dc2bSBrijesh Singh __u32 rsvd1:29; 1953a45dc2bSBrijesh Singh __u32 guest_count; /* Out */ 1963a45dc2bSBrijesh Singh __u64 current_tcb_version; /* Out */ 1973a45dc2bSBrijesh Singh __u64 reported_tcb_version; /* Out */ 1983a45dc2bSBrijesh Singh } __packed; 1993a45dc2bSBrijesh Singh 2003a45dc2bSBrijesh Singh /** 2013a45dc2bSBrijesh Singh * struct sev_user_data_snp_config - system wide configuration value for SNP. 2023a45dc2bSBrijesh Singh * 2033a45dc2bSBrijesh Singh * @reported_tcb: the TCB version to report in the guest attestation report. 2043a45dc2bSBrijesh Singh * @mask_chip_id: whether chip id is present in attestation reports or not 2053a45dc2bSBrijesh Singh * @mask_chip_key: whether attestation reports are signed or not 2063a45dc2bSBrijesh Singh * @rsvd: reserved 2073a45dc2bSBrijesh Singh * @rsvd1: reserved 2083a45dc2bSBrijesh Singh */ 2093a45dc2bSBrijesh Singh struct sev_user_data_snp_config { 2103a45dc2bSBrijesh Singh __u64 reported_tcb ; /* In */ 2113a45dc2bSBrijesh Singh __u32 mask_chip_id:1; /* In */ 2123a45dc2bSBrijesh Singh __u32 mask_chip_key:1; /* In */ 2133a45dc2bSBrijesh Singh __u32 rsvd:30; /* In */ 2143a45dc2bSBrijesh Singh __u8 rsvd1[52]; 2153a45dc2bSBrijesh Singh } __packed; 2163a45dc2bSBrijesh Singh 2173a45dc2bSBrijesh Singh /** 2181d57b17cSBrijesh Singh * struct sev_issue_cmd - SEV ioctl parameters 2191d57b17cSBrijesh Singh * 2201d57b17cSBrijesh Singh * @cmd: SEV commands to execute 2211d57b17cSBrijesh Singh * @opaque: pointer to the command structure 2221d57b17cSBrijesh Singh * @error: SEV FW return code on failure 2231d57b17cSBrijesh Singh */ 2241d57b17cSBrijesh Singh struct sev_issue_cmd { 2251d57b17cSBrijesh Singh __u32 cmd; /* In */ 2261d57b17cSBrijesh Singh __u64 data; /* In */ 2271d57b17cSBrijesh Singh __u32 error; /* Out */ 2281d57b17cSBrijesh Singh } __packed; 2291d57b17cSBrijesh Singh 2301d57b17cSBrijesh Singh #define SEV_IOC_TYPE 'S' 2311d57b17cSBrijesh Singh #define SEV_ISSUE_CMD _IOWR(SEV_IOC_TYPE, 0x0, struct sev_issue_cmd) 2321d57b17cSBrijesh Singh 2331d57b17cSBrijesh Singh #endif /* __PSP_USER_SEV_H */ 234