From patchwork Mon Jul 24 20:02:40 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brijesh Singh X-Patchwork-Id: 9860247 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 033B560349 for ; Mon, 24 Jul 2017 20:04:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E5D30285A2 for ; Mon, 24 Jul 2017 20:04:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DA118285AA; Mon, 24 Jul 2017 20:04:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 23A36285A2 for ; Mon, 24 Jul 2017 20:04:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753080AbdGXUE3 (ORCPT ); Mon, 24 Jul 2017 16:04:29 -0400 Received: from mail-by2nam01on0040.outbound.protection.outlook.com ([104.47.34.40]:32685 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751832AbdGXUDi (ORCPT ); Mon, 24 Jul 2017 16:03:38 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=4gA63zWELOwUPGHG+5AfI/ILqAuO9asu9Kn58TELVg0=; b=xDTSgr3PMMJNfgbWGQLxqRXNUBDtccgh5Wg/UmKZY+1N3PONQw/GkxnvH1WkIU+/AMSPT0M3NUO/DG3VKlqRDGQG0oUpJP277QCwjF5m0x/s2CbK4cCJipwVZB3fIiJMFAjLcpaerB6WRb6rFMxeupCw1/crEbtCYdfCdN1LJqY= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; Received: from ubuntu-010236106000.amd.com (165.204.78.1) by BY2PR12MB0145.namprd12.prod.outlook.com (10.162.82.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1282.10; Mon, 24 Jul 2017 20:03:23 +0000 From: Brijesh Singh To: linux-kernel@vger.kernel.org, x86@kernel.org, kvm@vger.kernel.org Cc: Thomas Gleixner , Borislav Petkov , Joerg Roedel , "Michael S . Tsirkin" , Paolo Bonzini , =?UTF-8?q?=5C=22Radim=20Kr=C4=8Dm=C3=A1=C5=99=5C=22?= , Tom Lendacky , Brijesh Singh , Herbert Xu , "David S . Miller" , Gary Hook , linux-crypto@vger.kernel.org Subject: [RFC Part2 PATCH v3 03/26] crypto: ccp: Add Secure Encrypted Virtualization (SEV) device support Date: Mon, 24 Jul 2017 15:02:40 -0500 Message-Id: <20170724200303.12197-4-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.4 In-Reply-To: <20170724200303.12197-1-brijesh.singh@amd.com> References: <20170724200303.12197-1-brijesh.singh@amd.com> MIME-Version: 1.0 X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: DM3PR12CA0049.namprd12.prod.outlook.com (10.161.151.17) To BY2PR12MB0145.namprd12.prod.outlook.com (10.162.82.18) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 82151bdc-ae39-4416-9a3c-08d4d2cf0afb X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(48565401081)(300000503095)(300135400095)(201703131423075)(201703031133081)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:BY2PR12MB0145; X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 3:o3XM+slCdbsHvDysISqNcs/YBlRMIVvxe+NBcKc7vmWFJRU7ArIiwxC/OWR3m2RYI98siW+indq78Mt/fwO1zBJ2ESqBJ/vW0kWm/5UPUWKaUZFKu+dngrIIs/PJs3w+Zdc7kRXP24HiNMKXw0zvX0++Ugyf4C1IBZ9VGz62C6Pfg2Pye4s+vZYCUaHG8kX6NAvejOIQqCWmm+ZckuVxVewxT5GQ8FVezGU/6hTN+EX6kxRoOr7YsC6lNr1PF3O95OsmhPbbLDWkkRxNXyOYs9mCsg9BS74zBeYx26UgYa1as+UJOjOqt311cgB0rndeEciaxeKSTe4bawipEh8n0MV6p0VWtPOXrC5Fq3QNtiyZBEYfP8h/a0iJe35r/WW6m9qpQ+YgAez6h0eSR1mAkb6D/0I4rjZnRpgwOc+WRX6JlHRQ2+5cWBZnkkb7bi/198SlbdFQCcibEY3Nz7LKi46iKpGj7zZsKvydXNVYx7ZhLtT3TsVMTg1RWAvvO2Y2gunu98efk4aoX2AyUaNfiQblvxLHuUWfO8YkbvHGGwUVcFeYVWdenBsVI0Kfw1dEgnQked4/SRvIIx3gKBnBU6iSAFjPB5Ri6n+a3NfckEiLmrA95Rgmuom2Jm5kwsnRNo60wIt8ASHBpf/vd2JbVZhXTKQW+u2iBelMknJPMwmKt410OEz0h+m+/Jt3ZpWD6UEAMErKCV/V4WtRK/FDT5RpbKnLGQ/5kaHC0rbyaXsrKL0XxO6QXjmoLVfKBEyJW2OblxNRZrrs4KDdmN9vwA== X-MS-TrafficTypeDiagnostic: BY2PR12MB0145: X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 25:noG4j7FmMwObRgqV/nrwJN/fgvqaXhotRnWLbv2eodANPuY7GUjgVvxeybjalc4WgdzSTV6mv9uDplx9ssjwdTCXDL1vz7PMvVNNIapcD3CqUja92unIBBtCRQiMa7cctuVZoCFEu8a6aZ/KsAlWAvLgzkBhNZJgQewjuQZox4VQkgsWwcFGMGPGerX2agiPXxMgf+tS1D0ZPa0sjGnFGmhl3kta4O4J8oyC1ebI+5ohOVPmJE+tpscgAIkerSCJjQlAWhyHYMaMbWUMxFCCBEK6u7YZdJda/1hwY4fydgFdQpsl3HA6JvTFP2/fXM4rucCQzaN8VT5rfcvfD8Bt5wZYZHZiolLNdd4E2TdvaSMkDe74hnbnSJvaMyfXKZSskxzHZnfI2DdMCqqDjtdhvaUDRA6ebOBPTlONeTvR0gdyTfSq1/MtsN6r2tZ6VHVvdQAKykNgv1jDOrHXdc6ReLIUBiYh6fasjvZUwytNTklLfkbg5ROFc3B+BGxPMLovTbnNQnn6GxQGW/ok+5gSsPz2czuViHsHXC59CuXLMej5k/Qp43ngu6j6nvzrNP0TeL9qVrhkDav51C/t8HcWNQv5sU4obYe4nBhIlRrLapoieOycG+KcoWUITEIaeQ2dqwR3K0+2yG75hoNX15Z4YTrU5F99+2f5YbXAeFI2hWmxUwg7dJC+PLM4ENDcRpeICYiMsWctBRLUyLmuafRcKgg8812kzUrW/8t4u6c1YvdKW0IN6Y+8IHHiOsZRf5Ay+8PlU2ujqK/azmAim/A5RyWqo82ZWzYLEKa+AcEN7e5MUuTAxtfonuCdgK3gz/xt8iGXES0P3VTOWSAFDZpNpJ1pKR/LmHnQDz2MHRD18vOvp+MJszNWs2kp+vd4yk2YQYlaYebcqjL8MYSlJyq4GgIqp/UcSoUbjKTrTMPKL B0= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 31:SEuLLXgzxikbB0lDmwLvMoanOiyupKCV2XynYAJ/f4BBPPuvGi1tjV8f0VneNu2JrFWK2ns9vRX7Z+/W2zwxK7XWVkxzc2qs0Z6QAG6BJogmkcF4gW4n11QKIZNcGByGkpdGuiOsdUe9uLuwWkw74/Ou5fRoKmqh8iMoX/XrFqtiltIagdhuLol3JEtX58KvRNU6vAktiHiUumISnXVWHxnkrzdrh5Qsbdh1rdVg7FE9woFExxlXNQzaa7DGgMXz+73TiqYcC/0WYTFMmk8PGS3VXkWD4KNGC+yGe6bX9kg7mkobL1kHr6xOprKHI7XbeIw5lF1aOqUHp9CRAdm9NVTxQP0CCqmbDnqFyncnqZDMmhoMr3Qn5jzEtvzv8E3XCFMto5v6ijKiSw1KHgaufbZ4zuLLOavJ/5G/gOyPYYoADylM+Xzoy3SJt48piPvKpUSDMJQnP3TzvFCO58y1SJJfalpQApH3n9JgDJUDSFc4qhcJrE2V5Dfyue6mvRrPBlb72DeZ7amSoCfCZe0KKwFmQ4I92djmP/IOpbZnZBMF3hGEXOzRf8iqh1xq216RPZIDd/bJZRANM9z/DHwdFZvWsX32uT8RNposWmXL2tVH53vg8Z0ymBJcuH+Db0HyorueguB/kr35GeXIt1G6IpCbXgBHXBLItByxldFGjl8= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 20:KjDJVmu48q5uYm3UrGJHmPMrcYLx7Q4+zhUfSUU/Klnyr0qsXPsUx9WfhS8+SXXSqywRjX/YWJSeYZPK6dB9wb010U1tGjNvnAbGEY4ZhxSVYr+brBc9MJ70rTE9v1PoCGoiDLgSevwn/5L+28Enkvt2YsPUr9Ct2aNHkSJU+p1GGB4H104k3ReY476+dTfi/G0WTUMb6gep97VHeuuhNacG4Nf2v0UveSEwVjg6yDL0NICWzV15QXw3SyiSPFqREn7gTEhLOYqngfBf+wfxn4U/HoKbjd9pOIBSeh/rlakMr9EXVMmjtQyZ/XGP8khYH0X2dmEgBEitfy63jUdQIUTy/mcRkoDrstxyxkuT+6fwEjmzjbv7L0sxNr71hZTkSx20neELLFRIHGYv8T7t/FPOBXTLj4lMITgGgXCqr64b4TNXcAWhtZxDNE5SVvvCy2HtuW2ZceOmAHhm9FYur7ej/cEBCYPTgcoqrsVjg1cfHaGZTXxodKyjlb+351MR X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(9452136761055)(767451399110)(17755550239193); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(6055026)(6041248)(20161123562025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123564025)(20161123555025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BY2PR12MB0145; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BY2PR12MB0145; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0145; 4:SgrU10NOlRcHH1NjwU+xYHlHT1EVYNQSkKoSsL4a0J?= =?us-ascii?Q?PLEkj9CuO6ahUVc8JaAQIjOl07OBqsyAT64FPFvbk+QaExvuCTK0sUgpQElD?= =?us-ascii?Q?3hlwuQFl570fYI8qCCVEznkOictzNvPbesl6pg22P12XnkPNtKomhK60bxM8?= =?us-ascii?Q?vPr1Z688+2NUbmRdmhizJsXf70U+UjVWVBm8HTC6QgLz7gm+OGH4ffUc6IKs?= =?us-ascii?Q?hVeR8UAAz1cqQBZYpsUdIPinkpdrks/LhM7pMcxzcuZrsJbMd93I8Io3sZGd?= =?us-ascii?Q?Vxs6B4XWxHbuqExSydBVI1QqtvuaPMYvZH3K5RmSxW4o30ItlzVllZRtlX3J?= =?us-ascii?Q?rOwY0nsmHDle+jZ/aOpgLoXy6gbBC4lW5kkO+oxpTXBxIUFly3fjhEBvdoKf?= =?us-ascii?Q?NaqHJBs3UeCeUGbGuHyhv9aH8OanQEzMKKd5rR70zBU8FREyN6PYCu0KFkD0?= =?us-ascii?Q?vitGg+Y0Ji/lD7DLmwbnaPwsz+kdA1ZkbqeZTaO1zt4htLKWbSLRIPd1YWQm?= =?us-ascii?Q?XgjIxKTp2i9fFXVIs1X3Id9b7qXQmZFpvynOKllOerXpdvgPGeGtiQ4TtcWT?= =?us-ascii?Q?MYfnD+PZ/x0LEGJpEhKICXz5cvh56cBoJr8AI6Mt+YFs6gsRBNt2UwUbfprI?= =?us-ascii?Q?0bVlF1S8fT2uRQGt9Q9CIjWDJH/rqzFKw+A/MuM1j6wmKNQrgNTEFuCYJVVJ?= =?us-ascii?Q?YkJtjn2QNLZH8HFVE3teSXDIDpjGhQnmhLKodnaIzUKIw2UNc8c+7YioMk5J?= =?us-ascii?Q?xxO7UDAqqSL1NZWMxcQERcXVDUoBKePMHltA5FnxXj8gCo1y51gGR+B3Ri3M?= =?us-ascii?Q?NYn0Sjkwsg7SNmuqH2tc3TIM9h4f8GxU2nKhOW3GMnIcgTl/lohF4HslmwmH?= =?us-ascii?Q?WJFGB3Bet9MWEVBcB4VooZiLqIKXxZngFA38eAK4jMh+/43taq/9tbLiO65y?= =?us-ascii?Q?e9JWTREnwsOnJNX2eXBgM59wsKwOSmFj6RjjOuj/t3ZKkxjxL02R6nzX3PLu?= =?us-ascii?Q?/xfNNOpKgXVpnppdO8KPaTtTvRDuFPMQZPvH1519OFugVkWF8ojjUaD69z/c?= =?us-ascii?Q?WDeaLUPyc0TRo9cbggAI6K5+EsTRGTeePV87TW9RsYT4qR7t2yUAhRWxkSGD?= =?us-ascii?Q?aMbHQuu1MkOaYVOb3w1nUe4yul0DEQPQ8qvXOiwF/vHa24AtBWnCw5zVCYFN?= =?us-ascii?Q?VcesFNaUWJgSBrDzyMWrQySpHXHcj0wq+Olze3TZ6jtlMom8KE9QMJg7ZJAe?= =?us-ascii?Q?2xWRWQa5QWsEqWqcT5f29Fy0XYqiG1Inzd6WOI87qCNd1bPl0Q3esZa/ka01?= =?us-ascii?Q?PJIxwU14EfH5bFAdOXlQc=3D?= X-Forefront-PRVS: 0378F1E47A X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7370300001)(6009001)(39450400003)(39410400002)(39400400002)(39850400002)(39860400002)(39840400002)(189002)(199003)(7350300001)(68736007)(53416004)(105586002)(6306002)(53946003)(54906002)(97736004)(50466002)(6486002)(48376002)(2906002)(106356001)(33646002)(6116002)(1076002)(53936002)(3846002)(189998001)(101416001)(6666003)(2950100002)(478600001)(50986999)(76176999)(81156014)(50226002)(38730400002)(47776003)(5003940100001)(7416002)(86362001)(25786009)(4326008)(966005)(36756003)(42186005)(8676002)(81166006)(110136004)(575784001)(5660300001)(66066001)(7736002)(305945005)(2004002)(559001)(579004)(134885004); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR12MB0145; H:ubuntu-010236106000.amd.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0145; 23:6GT2cgwYXk0I56lkzq28D608quDNAjxvgF7sj5Bs2?= =?us-ascii?Q?xkum/dS9GRiY2Ia4BJKyVFh/2I3MHuD3RlKBzHrWtJtBc+aDxMgqh9o0nrxH?= =?us-ascii?Q?5uh0ZAy6aTkLXSRp6u6s9zC45TmqA0D4vt9gJKa7/wntcMBvGsipMnbgPqEc?= =?us-ascii?Q?OV0UraqvN52biFLZbwCnja1m860FABwmT0GGD3cKpO8BfJcDuEXLrRC3SxRQ?= =?us-ascii?Q?lkvycqGYsUnMZtp9FyuD0SAnpGgngBFx0PP0WlGhqCRkUO5uLfNchegIepMI?= =?us-ascii?Q?6rUI7cufAkvl0oYyrH9dO/sz6sir/iwQ4WqgefuapxoSAFQZp5Y9miAeOoPi?= =?us-ascii?Q?N7jN+6Mch4ftP6CLLiUED1J6B8BohXHjTuVrz6yjdSxXaGszW9ZT6l8GUQK/?= =?us-ascii?Q?lS7P99+z8uNl3oQ4RJKAV0SM0TOCEY23bqlFuPBhi9TILqmnNLBDXYRE4iqB?= =?us-ascii?Q?PE59Zps30B4TfIm/mwl+NhYi76p+G4aOUepA0iKxali39zQbEZuX1/XmOG+3?= =?us-ascii?Q?JdIhRRdUTz0AsRXpHrD+0lkZStm+eSmkMyb/MntOOymrFp8h/prcYgcCjlU1?= =?us-ascii?Q?qGk3G9EFGI+CW6dGFi1iVAUA/Rd46m5bH8TvVPDvA8PYSi24JGTlYVhh9PUQ?= =?us-ascii?Q?6vHdXxb21R11IdZzGi5mpuCuUZIjViTTFnMr3inGcRzdFDg0w+TCDrtpj8he?= =?us-ascii?Q?qx5IdaXsCdtIvD4q7nBp1EhvqVCxJzE2fRTg0tyIrlqPUtbbfpUok0PkjJPV?= =?us-ascii?Q?+0ad8txUWtRRRWa5dFFTCiIi5D52jB8SJh2uYfKORferk19ZzMUdU+jU6t+u?= =?us-ascii?Q?HT/pc/LlHyRJ+zIsSP52SNN3MXwGabBzpq18ef8Dc6uZyDsOZffOvSp1GGsL?= =?us-ascii?Q?zjgypIlWpQPxQqBQRQQgLLhOrHhnYNEic1kZ2PY9GrYOMhXDLE3BNaR27JRq?= =?us-ascii?Q?lF5ZUTwwTSCVjRjYeGqmrDZIFM+9ySxehuVbHz1VXCDnJGEF7jQmx4WRkKyW?= =?us-ascii?Q?YqWWLMwpFW3HxnUwb8ay8pbM7hDvKvUYBjmL9DNlcL6W/ZkjCsIdiz8+w6tx?= =?us-ascii?Q?wSTpO75xoihUS/tHMJuzZqqJ3DVwJCR1ttTDwaBEdYMIX4OysjjZ3G3plaCM?= =?us-ascii?Q?4I09GFbOsv/GhdKJUwSHiXR9kP03yzCLIb0mousNcSjm3f7Edxwk2/WdRaHR?= =?us-ascii?Q?6tjuFUivAVOl2iEYWBXqbkmAwFLUy5a4Zt8byWeVRhUwIZLSRbbzI41jGpB+?= =?us-ascii?Q?ZkbwaMxdD3Cy37u49FdCK093tBYXeQAy+TO/DP/8FFoenz+DV2Whp38hDnGW?= =?us-ascii?Q?7rXoDVA3XPnMSjElR2P+C4unDmjDgwNOrTDO4GQP97HFQu/PAIiI0xF+ktLC?= =?us-ascii?Q?4s7G4A4fp2BvdhkIAFXyXhH3CFJjtG7ajEelDrSOmoMXVm525wX3B6MCEWn0?= =?us-ascii?Q?tgvaIxcplR5oNnNkW736tUcnwfjFZc=3D?= X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR12MB0145; 6:Ios460uA8Ot5DDTQHJlDI1gr2yUo4d5SAUKWaH7Dhp?= =?us-ascii?Q?WXA0bMq2VCKdjMVAdl7Vh4OVwR8aN6GGZOTyCNdNOo1GYmeh55+6K9KPr2I6?= =?us-ascii?Q?dtQX1eJzlg9J2HJ7ERIe4HAaU0mLZLd6Gc+xxD4uruTuepdXod5hQ/0fICN9?= =?us-ascii?Q?FRcHBz/u2ajKVswypvfX3oCAvghEoyY5IP8oW90CzY2HV4/TjmBCm0/8SXpC?= =?us-ascii?Q?rS3D/GLezRWWyqm+Iqc3iXWGDAS09LV/RinLXcYskcBspxRUKbyRbBPoUdTx?= =?us-ascii?Q?qeEcmUFDhXVxqQRJQlsgQ9gTR5La/q3fB2OylkhZxpV0dwRQ54ktf9rVHkWU?= =?us-ascii?Q?RUQ7G+pPQu1VDV3//XBPJYVxj3T8F8aUF1sY6AXJnAUc43QaObJD9d60Aksn?= =?us-ascii?Q?V/Prq8wLFD/BPfz/AREAcg8a5XXmnqGuy7KfUHTKQUUqpLSrQTmfRygrNdeZ?= =?us-ascii?Q?g9SAN9zcUxTcoRALTPxNOOw8jwDUgTRHZMnSUfCQyqf8tKCob4iVs+ry1uha?= =?us-ascii?Q?t/5PpzF/PHyCDV4VhhcA6s2BJO7eUJft3C5tvSuINZgmh/ZjTFQz7qYUkx4h?= =?us-ascii?Q?QnGSx8HcdHR1lWZZt0miBZN5O4CuT/SDn/Kx8HTT+IbEoJz2T2ESMeDNUAph?= =?us-ascii?Q?B2WPylPZcPBYNKWmF0HcSJ5Wqqsc5It1HqKcNxq+xRmpNb8L1DPon7pEZsMq?= =?us-ascii?Q?mEi1LWBIJe8TUzk/pyhSILETOZ7zd9kznMhMNITYVPg25ZAFxD1P/keUi9gI?= =?us-ascii?Q?cnyuw3YFRb4szkc5jpk205YHaZHhIWWCP7g/7n3CVwj9MhhKoUg4xw/OZhXp?= =?us-ascii?Q?8FaAkMmHbVPA/DLQRgUM2l9roP8/+Rm2UoGVTKMd1+NQvJkL20t2Kyj29vIv?= =?us-ascii?Q?YeFUHUeKHp4qPRgG2iZaI9nfcnU0ps9hHWH0UsbicG6Mu/uG43Gmn8r4AnT8?= =?us-ascii?Q?f+J14y/DPkpYB16raDksLFfmlMr/W+vTbaFSTwOxyAiKRnewbD8QFGsf7drm?= =?us-ascii?Q?L3Y2B/Ii+hR2AsCEKCXHhl?= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 5:alBIRG8TVM+r2LOKwX4BzJGzaEYvbLpgd6aBi8YT2QlOSe0VPyvWA3sHJc3dAAUkO8mnzOZe48m2mHf2NtSePYShu6r/Pqd/BjIWRF7ypUojRJ9bFcb+VfUyhPuCd9uYhfVpKDGGhtDwPYRrEQFh3zerEouxtSsXqXjteqs48lJqgYb0cL9HeD1qTqnilipPWulkObo+ziRc2w3SNpAiaWQOZgmri+UfheU97j63stqPrWyyu0bXyXpE01Jp/EI5VrIIl3eZlCPggxlfcQJ4gO+S/Ezr8QdmYZMw2Q7926BbyHDkuSngwKx0/NLnzaBfF4tOVv9nW2gkxbflmHJc0dQ5QmWxp7HKH3wSMtoiyFgLSwUuETOYa3xeeSqItTYVfc9v1rPvsTXGLvr01q4fPiddThSkoK3EwNSXfsbziEsFPIp9SrMu6fzozNOh6D8IPXzmK+WeTVfkvNiZXRHcuXLRJmKfVY6jqxbN4uaK2XenKVZN4bHyzftN+zI3QCuK; 24:dY7PIke1e96RQ6feV18aRAeH7COGVVULDSztnxnjCCsRbAYRQYnhoDFsoPKYna+lbXKoSZzblZjVbkM+oVviBk5M1XK4+zYLByyy3p9HkFM= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 7:2GgF9RKw53QHIcwbAUgowEzGScWGzKiH2tHR/SdiuCHLnaI2XCBQV09VBEjgKkc2Fua1/x10kchWMFLDJztYtkAY6nxuggWQZhkYDN7EuFTGje3Cu3O3mEQ5P9Nmt8Zi2EHV05BxvCYvfrjc6Rc7R2iwD0Zp8DkuFbVuWM6GpmdwkzZ4ceXGS/q+tRYzQnMQHFYWTzeZbzUykan7Tm5BTgohMqqhhzFMLOSB9m7t/QsUCHjlZiF4kJExzs+n0dgbeivpqkkJMNAF2fpxlU8AIyOKBmR3RwUuybcqY67fsbk67vnouzuzdZoRmDpgatXemVH3KClgY9T3Kftw7a04ns0ezkqiUbmGsTCBaV9NcMDwbgEXaVZMUG4lI3ynEFUUnMoOC6Olr73Rg6aIlet21BX6nOSra8NBcQwzt3PjAsaTB4DUq3rBPIQjxQWOWVpam3yqJkx0jHwSSe8IfQgXwE4glPE4tEnMCLNjHVsHeqpp8dt+ra6l+UU2ykXtWHYRt8zA8mc3Wlcz3Ht63c+S8N2NVwy9tSfPSEQ18J+Zl9G285xQ3RzGqJriRgkB6p7Vy2cd9IQpEmZQ+bxLClF76BGQyDcDZTCNcoXneaCA3jPzJn/dGEEIugyfI6kPA7xh/vOd7YxWV8w7hhtLgZnwYn25H5SN4cCMOq0pms0wEW/8aho/Ro7W18jOO3znK/TkMbu9vOhys6ZsNQPm7kY1GOEV2k9vkOoneUB1BWXmhsYLEjYlCoY145BhfhPGcDBVqXo3D39ELQI0LGVfwlxIEbmQnGkDeqWyYj34yjy4elM= X-Microsoft-Exchange-Diagnostics: 1; BY2PR12MB0145; 20:rGRdljo+BtUJteto/t+Ny1g3s3IHZyGobG0nt9mG7AlZBrFnaVS5t8zYzSFaMiNnCsKcogXv078kcfQIeSreKsdumerQKsbTwAdqCvAzsJggdFq0lEaeGjFMQSdd+gaJx0byDOVA+G/8RF/Dgu/wx39kGTdJ7b7hckT/J2PkUoZd2cQji7MurX7o0W8vbsMRqjmvO71UrLba/LKkZ4IXoF8X7pN7x817yiT0owLOOqfBTAVByuLN/n1AlP1wE9V0 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2017 20:03:23.7750 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR12MB0145 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP AMDs new Secure Encrypted Virtualization (SEV) feature allows the memory contents of a virtual machine to be transparently encrypted with a key unique to the guest VM. The programming and management of the encryption keys are handled by the AMD Secure Processor (AMD-SP), which exposes the commands for these tasks. The complete spec for various commands are available at: http://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf This patch extends AMD-SP driver to provide: - a in-kernel APIs to communicate with SEV device. The APIs can be used by the hypervisor to create encryption context for the SEV guests. - a userspace IOCTL to manage the platform certificates etc Cc: Herbert Xu Cc: David S. Miller Cc: Gary Hook Cc: linux-crypto@vger.kernel.org Signed-off-by: Brijesh Singh --- drivers/crypto/ccp/Kconfig | 10 + drivers/crypto/ccp/Makefile | 1 + drivers/crypto/ccp/psp-dev.c | 4 + drivers/crypto/ccp/psp-dev.h | 27 ++ drivers/crypto/ccp/sev-dev.c | 416 ++++++++++++++++++++++++++ drivers/crypto/ccp/sev-dev.h | 67 +++++ drivers/crypto/ccp/sev-ops.c | 457 +++++++++++++++++++++++++++++ drivers/crypto/ccp/sp-pci.c | 2 +- include/linux/psp-sev.h | 683 +++++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/psp-sev.h | 110 +++++++ 10 files changed, 1776 insertions(+), 1 deletion(-) create mode 100644 drivers/crypto/ccp/sev-dev.c create mode 100644 drivers/crypto/ccp/sev-dev.h create mode 100644 drivers/crypto/ccp/sev-ops.c create mode 100644 include/linux/psp-sev.h create mode 100644 include/uapi/linux/psp-sev.h diff --git a/drivers/crypto/ccp/Kconfig b/drivers/crypto/ccp/Kconfig index 41c0ff5..ae0ff1c 100644 --- a/drivers/crypto/ccp/Kconfig +++ b/drivers/crypto/ccp/Kconfig @@ -40,3 +40,13 @@ config CRYPTO_DEV_SP_PSP Provide the support for AMD Platform Security Processor (PSP) device which can be used for communicating with Secure Encryption Virtualization (SEV) firmware. + +config CRYPTO_DEV_PSP_SEV + bool "Secure Encrypted Virtualization (SEV) interface" + default y + depends on CRYPTO_DEV_CCP_DD + depends on CRYPTO_DEV_SP_PSP + help + Provide the kernel and userspace (/dev/sev) interface to communicate with + Secure Encrypted Virtualization (SEV) firmware running inside AMD Platform + Security Processor (PSP) diff --git a/drivers/crypto/ccp/Makefile b/drivers/crypto/ccp/Makefile index 8aae4ff..94ca748 100644 --- a/drivers/crypto/ccp/Makefile +++ b/drivers/crypto/ccp/Makefile @@ -8,6 +8,7 @@ ccp-$(CONFIG_CRYPTO_DEV_SP_CCP) += ccp-dev.o \ ccp-debugfs.o ccp-$(CONFIG_PCI) += sp-pci.o ccp-$(CONFIG_CRYPTO_DEV_SP_PSP) += psp-dev.o +ccp-$(CONFIG_CRYPTO_DEV_PSP_SEV) += sev-dev.o sev-ops.o obj-$(CONFIG_CRYPTO_DEV_CCP_CRYPTO) += ccp-crypto.o ccp-crypto-objs := ccp-crypto-main.o \ diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c index bb0ea9a..0c9d25c 100644 --- a/drivers/crypto/ccp/psp-dev.c +++ b/drivers/crypto/ccp/psp-dev.c @@ -97,6 +97,7 @@ irqreturn_t psp_irq_handler(int irq, void *data) static int psp_init(struct psp_device *psp) { psp_add_device(psp); + sev_dev_init(psp); return 0; } @@ -166,17 +167,20 @@ void psp_dev_destroy(struct sp_device *sp) struct psp_device *psp = sp->psp_data; sp_free_psp_irq(sp, psp); + sev_dev_destroy(psp); psp_del_device(psp); } int psp_dev_resume(struct sp_device *sp) { + sev_dev_resume(sp->psp_data); return 0; } int psp_dev_suspend(struct sp_device *sp, pm_message_t state) { + sev_dev_suspend(sp->psp_data, state); return 0; } diff --git a/drivers/crypto/ccp/psp-dev.h b/drivers/crypto/ccp/psp-dev.h index 6e167b8..9334d87 100644 --- a/drivers/crypto/ccp/psp-dev.h +++ b/drivers/crypto/ccp/psp-dev.h @@ -78,5 +78,32 @@ int psp_free_tee_irq(struct psp_device *psp, void *data); struct psp_device *psp_get_master_device(void); extern const struct psp_vdata psp_entry; +#ifdef CONFIG_CRYPTO_DEV_PSP_SEV + +int sev_dev_init(struct psp_device *psp); +void sev_dev_destroy(struct psp_device *psp); +int sev_dev_resume(struct psp_device *psp); +int sev_dev_suspend(struct psp_device *psp, pm_message_t state); + +#else /* !CONFIG_CRYPTO_DEV_PSP_SEV */ + +static inline int sev_dev_init(struct psp_device *psp) +{ + return -ENODEV; +} + +static inline void sev_dev_destroy(struct psp_device *psp) { } + +static inline int sev_dev_resume(struct psp_device *psp) +{ + return -ENODEV; +} + +static inline int sev_dev_suspend(struct psp_device *psp, pm_message_t state) +{ + return -ENODEV; +} + +#endif /* CONFIG_CRYPTO_DEV_PSP_SEV */ #endif /* __PSP_DEV_H */ diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c new file mode 100644 index 0000000..a2b41dd --- /dev/null +++ b/drivers/crypto/ccp/sev-dev.c @@ -0,0 +1,416 @@ +/* + * AMD Secure Encrypted Virtualization (SEV) interface + * + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. + * + * Author: Brijesh Singh + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "psp-dev.h" +#include "sev-dev.h" + +extern const struct file_operations sev_fops; + +static LIST_HEAD(sev_devs); +static DEFINE_SPINLOCK(sev_devs_lock); +static atomic_t sev_id; + +static unsigned int sev_poll; +module_param(sev_poll, uint, 0444); +MODULE_PARM_DESC(sev_poll, "Poll for sev command completion - any non-zero value"); + +DEFINE_MUTEX(sev_cmd_mutex); + +void sev_add_device(struct sev_device *sev) +{ + unsigned long flags; + + spin_lock_irqsave(&sev_devs_lock, flags); + + list_add_tail(&sev->entry, &sev_devs); + + spin_unlock_irqrestore(&sev_devs_lock, flags); +} + +void sev_del_device(struct sev_device *sev) +{ + unsigned long flags; + + spin_lock_irqsave(&sev_devs_lock, flags); + + list_del(&sev->entry); + spin_unlock_irqrestore(&sev_devs_lock, flags); +} + +static struct sev_device *get_sev_master_device(void) +{ + struct psp_device *psp = psp_get_master_device(); + + return psp ? psp->sev_data : NULL; +} + +static int sev_wait_cmd_poll(struct sev_device *sev, unsigned int timeout, + unsigned int *reg) +{ + int wait = timeout * 10; /* 100ms sleep => timeout * 10 */ + + while (--wait) { + msleep(100); + + *reg = ioread32(sev->io_regs + PSP_CMDRESP); + if (*reg & PSP_CMDRESP_RESP) + break; + } + + if (!wait) { + dev_err(sev->dev, "sev command timed out\n"); + return -ETIMEDOUT; + } + + return 0; +} + +static int sev_wait_cmd_ioc(struct sev_device *sev, unsigned int *reg) +{ + sev->int_rcvd = 0; + + wait_event(sev->int_queue, sev->int_rcvd); + *reg = ioread32(sev->io_regs + PSP_CMDRESP); + + return 0; +} + +static int sev_wait_cmd(struct sev_device *sev, unsigned int *reg) +{ + return (*reg & PSP_CMDRESP_IOC) ? sev_wait_cmd_ioc(sev, reg) + : sev_wait_cmd_poll(sev, 10, reg); +} + +static struct sev_device *sev_alloc_struct(struct psp_device *psp) +{ + struct device *dev = psp->dev; + struct sev_device *sev; + + sev = devm_kzalloc(dev, sizeof(*sev), GFP_KERNEL); + if (!sev) + return NULL; + + sev->dev = dev; + sev->psp = psp; + sev->id = atomic_inc_return(&sev_id); + + snprintf(sev->name, sizeof(sev->name), "sev%u", sev->id); + init_waitqueue_head(&sev->int_queue); + + return sev; +} + +irqreturn_t sev_irq_handler(int irq, void *data) +{ + struct sev_device *sev = data; + unsigned int status; + + status = ioread32(sev->io_regs + PSP_P2CMSG_INTSTS); + if (status & (1 << PSP_CMD_COMPLETE_REG)) { + int reg; + + reg = ioread32(sev->io_regs + PSP_CMDRESP); + if (reg & PSP_CMDRESP_RESP) { + sev->int_rcvd = 1; + wake_up(&sev->int_queue); + } + } + + return IRQ_HANDLED; +} + +static bool check_sev_support(struct sev_device *sev) +{ + /* Bit 0 in PSP_FEATURE_REG is set then SEV is support in PSP */ + if (ioread32(sev->io_regs + PSP_FEATURE_REG) & 1) + return true; + + return false; +} + +int sev_dev_init(struct psp_device *psp) +{ + struct device *dev = psp->dev; + struct sev_device *sev; + int ret; + + ret = -ENOMEM; + sev = sev_alloc_struct(psp); + if (!sev) + goto e_err; + psp->sev_data = sev; + + sev->io_regs = psp->io_regs; + + dev_dbg(dev, "checking SEV support ...\n"); + /* check SEV support */ + if (!check_sev_support(sev)) { + dev_dbg(dev, "device does not support SEV\n"); + goto e_err; + } + + dev_dbg(dev, "requesting an IRQ ...\n"); + /* Request an irq */ + ret = psp_request_sev_irq(sev->psp, sev_irq_handler, sev); + if (ret) { + dev_err(dev, "unable to allocate an IRQ\n"); + goto e_err; + } + + /* initialize SEV ops */ + dev_dbg(dev, "init sev ops\n"); + ret = sev_ops_init(sev); + if (ret) { + dev_err(dev, "failed to init sev ops\n"); + goto e_irq; + } + + sev_add_device(sev); + + dev_notice(dev, "sev enabled\n"); + + return 0; + +e_irq: + psp_free_sev_irq(psp, sev); +e_err: + psp->sev_data = NULL; + + dev_notice(dev, "sev initialization failed\n"); + + return ret; +} + +void sev_dev_destroy(struct psp_device *psp) +{ + struct sev_device *sev = psp->sev_data; + + psp_free_sev_irq(psp, sev); + + sev_ops_destroy(sev); + + sev_del_device(sev); +} + +int sev_dev_resume(struct psp_device *psp) +{ + return 0; +} + +int sev_dev_suspend(struct psp_device *psp, pm_message_t state) +{ + return 0; +} + +static int sev_cmd_buffer_len(int cmd) +{ + int size; + + switch (cmd) { + case SEV_CMD_INIT: + size = sizeof(struct sev_data_init); + break; + case SEV_CMD_PLATFORM_STATUS: + size = sizeof(struct sev_data_status); + break; + case SEV_CMD_PEK_CSR: + size = sizeof(struct sev_data_pek_csr); + break; + case SEV_CMD_PEK_CERT_IMPORT: + size = sizeof(struct sev_data_pek_cert_import); + break; + case SEV_CMD_PDH_CERT_EXPORT: + size = sizeof(struct sev_data_pdh_cert_export); + break; + case SEV_CMD_LAUNCH_START: + size = sizeof(struct sev_data_launch_start); + break; + case SEV_CMD_LAUNCH_UPDATE_DATA: + size = sizeof(struct sev_data_launch_update_data); + break; + case SEV_CMD_LAUNCH_UPDATE_VMSA: + size = sizeof(struct sev_data_launch_update_vmsa); + break; + case SEV_CMD_LAUNCH_FINISH: + size = sizeof(struct sev_data_launch_finish); + break; + case SEV_CMD_LAUNCH_UPDATE_SECRET: + size = sizeof(struct sev_data_launch_secret); + break; + case SEV_CMD_LAUNCH_MEASURE: + size = sizeof(struct sev_data_launch_measure); + break; + case SEV_CMD_ACTIVATE: + size = sizeof(struct sev_data_activate); + break; + case SEV_CMD_DEACTIVATE: + size = sizeof(struct sev_data_deactivate); + break; + case SEV_CMD_DECOMMISSION: + size = sizeof(struct sev_data_decommission); + break; + case SEV_CMD_GUEST_STATUS: + size = sizeof(struct sev_data_guest_status); + break; + case SEV_CMD_DBG_DECRYPT: + case SEV_CMD_DBG_ENCRYPT: + size = sizeof(struct sev_data_dbg); + break; + case SEV_CMD_SEND_START: + size = sizeof(struct sev_data_send_start); + break; + case SEV_CMD_SEND_UPDATE_DATA: + size = sizeof(struct sev_data_send_update_data); + break; + case SEV_CMD_SEND_UPDATE_VMSA: + size = sizeof(struct sev_data_send_update_vmsa); + break; + case SEV_CMD_SEND_FINISH: + size = sizeof(struct sev_data_send_finish); + break; + case SEV_CMD_RECEIVE_START: + size = sizeof(struct sev_data_receive_start); + break; + case SEV_CMD_RECEIVE_UPDATE_DATA: + size = sizeof(struct sev_data_receive_update_data); + break; + case SEV_CMD_RECEIVE_UPDATE_VMSA: + size = sizeof(struct sev_data_receive_update_vmsa); + break; + case SEV_CMD_RECEIVE_FINISH: + size = sizeof(struct sev_data_receive_finish); + break; + default: + size = 0; + break; + } + + return size; +} + +int sev_issue_cmd(int cmd, void *data, int *psp_ret) +{ + struct sev_device *sev = get_sev_master_device(); + unsigned int phys_lsb, phys_msb; + unsigned int reg, ret; + + if (!sev) + return -ENODEV; + + if (psp_ret) + *psp_ret = 0; + + /* Set the physical address for the PSP */ + phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0; + phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0; + + dev_dbg(sev->dev, "sev command id %#x buffer 0x%08x%08x\n", + cmd, phys_msb, phys_lsb); + print_hex_dump_debug("(in): ", DUMP_PREFIX_OFFSET, 16, 2, data, + sev_cmd_buffer_len(cmd), false); + + /* Only one command at a time... */ + mutex_lock(&sev_cmd_mutex); + + iowrite32(phys_lsb, sev->io_regs + PSP_CMDBUFF_ADDR_LO); + iowrite32(phys_msb, sev->io_regs + PSP_CMDBUFF_ADDR_HI); + wmb(); + + reg = cmd; + reg <<= PSP_CMDRESP_CMD_SHIFT; + reg |= sev_poll ? 0 : PSP_CMDRESP_IOC; + iowrite32(reg, sev->io_regs + PSP_CMDRESP); + + ret = sev_wait_cmd(sev, ®); + if (ret) + goto unlock; + + if (psp_ret) + *psp_ret = reg & PSP_CMDRESP_ERR_MASK; + + if (reg & PSP_CMDRESP_ERR_MASK) { + dev_dbg(sev->dev, "sev command %u failed (%#010x)\n", + cmd, reg & PSP_CMDRESP_ERR_MASK); + ret = -EIO; + } + +unlock: + mutex_unlock(&sev_cmd_mutex); + print_hex_dump_debug("(out): ", DUMP_PREFIX_OFFSET, 16, 2, data, + sev_cmd_buffer_len(cmd), false); + return ret; +} + +int sev_platform_init(struct sev_data_init *data, int *error) +{ + return sev_issue_cmd(SEV_CMD_INIT, data, error); +} +EXPORT_SYMBOL_GPL(sev_platform_init); + +int sev_platform_shutdown(int *error) +{ + return sev_issue_cmd(SEV_CMD_SHUTDOWN, 0, error); +} +EXPORT_SYMBOL_GPL(sev_platform_shutdown); + +int sev_platform_status(struct sev_data_status *data, int *error) +{ + return sev_issue_cmd(SEV_CMD_PLATFORM_STATUS, data, error); +} +EXPORT_SYMBOL_GPL(sev_platform_status); + +int sev_issue_cmd_external_user(struct file *filep, unsigned int cmd, + void *data, int *error) +{ + if (!filep || filep->f_op != &sev_fops) + return -EBADF; + + return sev_issue_cmd(cmd, data, error); +} +EXPORT_SYMBOL_GPL(sev_issue_cmd_external_user); + +int sev_guest_deactivate(struct sev_data_deactivate *data, int *error) +{ + return sev_issue_cmd(SEV_CMD_DEACTIVATE, data, error); +} +EXPORT_SYMBOL_GPL(sev_guest_deactivate); + +int sev_guest_activate(struct sev_data_activate *data, int *error) +{ + return sev_issue_cmd(SEV_CMD_ACTIVATE, data, error); +} +EXPORT_SYMBOL_GPL(sev_guest_activate); + +int sev_guest_decommission(struct sev_data_decommission *data, int *error) +{ + return sev_issue_cmd(SEV_CMD_DECOMMISSION, data, error); +} +EXPORT_SYMBOL_GPL(sev_guest_decommission); + +int sev_guest_df_flush(int *error) +{ + return sev_issue_cmd(SEV_CMD_DF_FLUSH, 0, error); +} +EXPORT_SYMBOL_GPL(sev_guest_df_flush); diff --git a/drivers/crypto/ccp/sev-dev.h b/drivers/crypto/ccp/sev-dev.h new file mode 100644 index 0000000..0a8ce08 --- /dev/null +++ b/drivers/crypto/ccp/sev-dev.h @@ -0,0 +1,67 @@ +/* + * AMD Secure Encrypted Virtualization (SEV) interface + * + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. + * + * Author: Brijesh Singh + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef __SEV_DEV_H__ +#define __SEV_DEV_H__ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +#define PSP_C2PMSG(_num) ((_num) << 2) +#define PSP_CMDRESP PSP_C2PMSG(32) +#define PSP_CMDBUFF_ADDR_LO PSP_C2PMSG(56) +#define PSP_CMDBUFF_ADDR_HI PSP_C2PMSG(57) +#define PSP_FEATURE_REG PSP_C2PMSG(63) + +#define PSP_P2CMSG(_num) (_num << 2) +#define PSP_CMD_COMPLETE_REG 1 +#define PSP_CMD_COMPLETE PSP_P2CMSG(PSP_CMD_COMPLETE_REG) + +#define MAX_PSP_NAME_LEN 16 +#define SEV_DEFAULT_TIMEOUT 5 + +struct sev_device { + struct list_head entry; + + struct dentry *debugfs; + struct miscdevice misc; + + unsigned int id; + char name[MAX_PSP_NAME_LEN]; + + struct device *dev; + struct sp_device *sp; + struct psp_device *psp; + + void __iomem *io_regs; + + unsigned int int_rcvd; + wait_queue_head_t int_queue; +}; + +void sev_add_device(struct sev_device *sev); +void sev_del_device(struct sev_device *sev); + +int sev_ops_init(struct sev_device *sev); +void sev_ops_destroy(struct sev_device *sev); + +int sev_issue_cmd(int cmd, void *data, int *error); + +#endif /* __SEV_DEV_H */ diff --git a/drivers/crypto/ccp/sev-ops.c b/drivers/crypto/ccp/sev-ops.c new file mode 100644 index 0000000..a13d857 --- /dev/null +++ b/drivers/crypto/ccp/sev-ops.c @@ -0,0 +1,457 @@ +/* + * AMD Secure Encrypted Virtualization (SEV) command interface + * + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. + * + * Author: Brijesh Singh + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +#include "psp-dev.h" +#include "sev-dev.h" + +static bool sev_initialized; +static int sev_platform_get_state(int *state, int *error) +{ + int ret; + struct sev_data_status *data; + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + ret = sev_platform_status(data, error); + *state = data->state; + + kfree(data); + return ret; +} + +static int __sev_platform_init(int *error) +{ + int ret; + struct sev_data_init *data; + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + ret = sev_platform_init(data, error); + + kfree(data); + return ret; +} + +static int sev_ioctl_factory_reset(struct sev_issue_cmd *argp) +{ + return sev_issue_cmd(SEV_CMD_FACTORY_RESET, 0, &argp->error); +} + +static int sev_ioctl_platform_status(struct sev_issue_cmd *argp) +{ + int ret; + struct sev_data_status *data; + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + ret = sev_platform_status(data, &argp->error); + + if (copy_to_user((void *)argp->data, data, sizeof(*data))) + ret = -EFAULT; + + kfree(data); + return ret; +} + +static int sev_ioctl_pek_csr(struct sev_issue_cmd *argp) +{ + int do_shutdown = 0; + int ret, state, error; + void *csr_addr = NULL; + struct sev_data_pek_csr *data; + struct sev_user_data_pek_csr input; + + if (copy_from_user(&input, (void *)argp->data, + sizeof(struct sev_user_data_pek_csr))) + return -EFAULT; + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + /* + * PEK_CSR command can be issued when firmware is in INIT or WORKING + * state. If firmware is in UNINIT state then we transition into INIT + * state and issue the command. + */ + ret = sev_platform_get_state(&state, &argp->error); + if (ret) + return ret; + + if (state == SEV_STATE_UNINIT) { + /* transition the plaform into INIT state */ + ret = __sev_platform_init(&argp->error); + if (ret) + return ret; + do_shutdown = 1; + } + + if (input.address) { + csr_addr = kmalloc(input.length, GFP_KERNEL); + if (!csr_addr) { + ret = -ENOMEM; + goto e_free; + } + data->address = __psp_pa(csr_addr); + data->length = input.length; + } + + ret = sev_issue_cmd(SEV_CMD_PEK_CSR, data, &argp->error); + + if (csr_addr) { + if (copy_to_user((void *)input.address, csr_addr, + input.length)) { + ret = -EFAULT; + goto e_free; + } + } + + input.length = data->length; + if (copy_to_user((void *)argp->data, &input, + sizeof(struct sev_user_data_pek_csr))) + ret = -EFAULT; +e_free: + if (do_shutdown) + sev_platform_shutdown(&error); + kfree(csr_addr); + kfree(data); + return ret; +} + +static int sev_ioctl_pdh_gen(struct sev_issue_cmd *argp) +{ + int ret, state, error, do_shutdown = 0; + + /* + * PDH_GEN command can be issued when platform is in INIT or WORKING + * state. If we are in UNINIT state then transition into INIT. + */ + ret = sev_platform_get_state(&state, &argp->error); + if (ret) + return ret; + + if (state == SEV_STATE_UNINIT) { + /* transition the plaform into INIT state */ + ret = __sev_platform_init(&argp->error); + if (ret) + return ret; + do_shutdown = 1; + } + + ret = sev_issue_cmd(SEV_CMD_PDH_GEN, 0, &argp->error); + if (do_shutdown) + sev_platform_shutdown(&error); + return ret; +} + +static int sev_ioctl_pek_gen(struct sev_issue_cmd *argp) +{ + int do_shutdown = 0; + int error, ret, state; + + /* + * PEK_GEN command can be issued only when firmware is in INIT state. + * If firmware is in UNINIT state then we transition into INIT state + * and issue the command and then shutdown. + */ + ret = sev_platform_get_state(&state, &argp->error); + if (ret) + return ret; + + if (state == SEV_STATE_UNINIT) { + /* transition the plaform into INIT state */ + ret = __sev_platform_init(&argp->error); + if (ret) + return ret; + + do_shutdown = 1; + } + + ret = sev_issue_cmd(SEV_CMD_PEK_GEN, 0, &argp->error); + + if (do_shutdown) + sev_platform_shutdown(&error); + return ret; +} + +static int sev_ioctl_pek_cert_import(struct sev_issue_cmd *argp) +{ + int ret, state, error, do_shutdown = 0; + struct sev_data_pek_cert_import *data; + struct sev_user_data_pek_cert_import input; + void *pek_cert = NULL, *oca_cert = NULL; + + if (copy_from_user(&input, (void *)argp->data, sizeof(*data))) + return -EFAULT; + + if (!input.pek_cert_address || !input.pek_cert_length || + !input.oca_cert_address || !input.oca_cert_length) + return -EINVAL; + + ret = sev_platform_get_state(&state, &argp->error); + if (ret) + return ret; + + /* + * CERT_IMPORT command can be issued only when platform is in INIT + * state. If we are in UNINIT state then transition into INIT state + * and issue the command. + */ + if (state == SEV_STATE_UNINIT) { + /* transition platform init INIT state */ + ret = __sev_platform_init(&argp->error); + if (ret) + return ret; + do_shutdown = 1; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; + goto e_free; + } + + pek_cert = kmalloc(input.pek_cert_length, GFP_KERNEL); + if (!pek_cert) { + ret = -ENOMEM; + goto e_free; + } + + /* copy PEK certificate from userspace */ + if (copy_from_user(pek_cert, (void *)input.pek_cert_address, + input.pek_cert_length)) { + ret = -EFAULT; + goto e_free; + } + + data->pek_cert_address = __psp_pa(pek_cert); + data->pek_cert_length = input.pek_cert_length; + + oca_cert = kmalloc(input.oca_cert_length, GFP_KERNEL); + if (!oca_cert) { + ret = -ENOMEM; + goto e_free; + } + + /* copy OCA certificate from userspace */ + if (copy_from_user(oca_cert, (void *)input.oca_cert_address, + input.oca_cert_length)) { + ret = -EFAULT; + goto e_free; + } + + data->oca_cert_address = __psp_pa(oca_cert); + data->oca_cert_length = input.oca_cert_length; + + ret = sev_issue_cmd(SEV_CMD_PEK_CERT_IMPORT, data, &argp->error); +e_free: + if (do_shutdown) + sev_platform_shutdown(&error); + kfree(oca_cert); + kfree(pek_cert); + kfree(data); + return ret; +} + +static int sev_ioctl_pdh_cert_export(struct sev_issue_cmd *argp) +{ + int ret, state, error, need_shutdown = 0; + struct sev_data_pdh_cert_export *data; + struct sev_user_data_pdh_cert_export input; + void *pdh_cert = NULL, *cert_chain = NULL; + + if (copy_from_user(&input, (void *)argp->data, sizeof(*data))) + return -EFAULT; + + /* + * CERT_EXPORT command can be issued in INIT or WORKING state. + * If we are in UNINIT state then transition into INIT state and + * shutdown before exiting. But if platform is in WORKING state + * then EXPORT the certificate but do not shutdown the platform. + */ + ret = sev_platform_get_state(&state, &argp->error); + if (ret) + return ret; + + if (state == SEV_STATE_UNINIT) { + ret = __sev_platform_init(&argp->error); + if (ret) + return ret; + need_shutdown = 1; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; + goto e_free; + } + + if (input.pdh_cert_address) { + pdh_cert = kmalloc(input.pdh_cert_length, GFP_KERNEL); + if (!pdh_cert) { + ret = -ENOMEM; + goto e_free; + } + + data->pdh_cert_address = __psp_pa(pdh_cert); + data->pdh_cert_length = input.pdh_cert_length; + } + + if (input.cert_chain_address) { + cert_chain = kmalloc(input.cert_chain_length, GFP_KERNEL); + if (!cert_chain) { + ret = -ENOMEM; + goto e_free; + } + + data->cert_chain_address = __psp_pa(cert_chain); + data->cert_chain_length = input.cert_chain_length; + } + + ret = sev_issue_cmd(SEV_CMD_PDH_CERT_EXPORT, data, &argp->error); + + input.cert_chain_length = data->cert_chain_length; + input.pdh_cert_length = data->pdh_cert_length; + + /* copy PDH certificate to userspace */ + if (pdh_cert) { + if (copy_to_user((void *)input.pdh_cert_address, + pdh_cert, input.pdh_cert_length)) { + ret = -EFAULT; + goto e_free; + } + } + + /* copy certificate chain to userspace */ + if (cert_chain) { + if (copy_to_user((void *)input.cert_chain_address, + cert_chain, input.cert_chain_length)) { + ret = -EFAULT; + goto e_free; + } + } + + /* copy certificate length to userspace */ + if (copy_to_user((void *)argp->data, &input, + sizeof(struct sev_user_data_pdh_cert_export))) + ret = -EFAULT; + +e_free: + if (need_shutdown) + sev_platform_shutdown(&error); + + kfree(cert_chain); + kfree(pdh_cert); + kfree(data); + return ret; +} + +static long sev_ioctl(struct file *file, unsigned int ioctl, unsigned long arg) +{ + int ret = -EFAULT; + void __user *argp = (void __user *)arg; + struct sev_issue_cmd input; + + if (ioctl != SEV_ISSUE_CMD) + return -EINVAL; + + if (copy_from_user(&input, argp, sizeof(struct sev_issue_cmd))) + return -EFAULT; + + if (input.cmd > SEV_CMD_MAX) + return -EINVAL; + + switch (input.cmd) { + + case SEV_USER_CMD_FACTORY_RESET: { + ret = sev_ioctl_factory_reset(&input); + break; + } + case SEV_USER_CMD_PLATFORM_STATUS: { + ret = sev_ioctl_platform_status(&input); + break; + } + case SEV_USER_CMD_PEK_GEN: { + ret = sev_ioctl_pek_gen(&input); + break; + } + case SEV_USER_CMD_PDH_GEN: { + ret = sev_ioctl_pdh_gen(&input); + break; + } + case SEV_USER_CMD_PEK_CSR: { + ret = sev_ioctl_pek_csr(&input); + break; + } + case SEV_USER_CMD_PEK_CERT_IMPORT: { + ret = sev_ioctl_pek_cert_import(&input); + break; + } + case SEV_USER_CMD_PDH_CERT_EXPORT: { + ret = sev_ioctl_pdh_cert_export(&input); + break; + } + default: + ret = -EINVAL; + break; + } + + if (copy_to_user(argp, &input, sizeof(struct sev_issue_cmd))) + ret = -EFAULT; + + return ret; +} + +const struct file_operations sev_fops = { + .owner = THIS_MODULE, + .unlocked_ioctl = sev_ioctl, +}; + +int sev_ops_init(struct sev_device *sev) +{ + struct miscdevice *misc = &sev->misc; + + /* if sev device is already registered then do nothing */ + if (sev_initialized) + return 0; + + misc->minor = MISC_DYNAMIC_MINOR; + misc->name = sev->name; + misc->fops = &sev_fops; + sev_initialized = true; + + return misc_register(misc); +} + +void sev_ops_destroy(struct sev_device *sev) +{ + misc_deregister(&sev->misc); +} diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c index e58b3ad..20a0f35 100644 --- a/drivers/crypto/ccp/sp-pci.c +++ b/drivers/crypto/ccp/sp-pci.c @@ -280,7 +280,7 @@ static const struct sp_dev_vdata dev_vdata[] = { #ifdef CONFIG_CRYPTO_DEV_SP_CCP .ccp_vdata = &ccpv5a, #endif -#ifdef CONFIG_CRYPTO_DEV_PSP +#ifdef CONFIG_CRYPTO_DEV_SP_PSP .psp_vdata = &psp_entry #endif }, diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h new file mode 100644 index 0000000..1736880 --- /dev/null +++ b/include/linux/psp-sev.h @@ -0,0 +1,683 @@ +/* + * AMD Secure Encrypted Virtualization (SEV) driver interface + * + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. + * + * Author: Brijesh Singh + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef __PSP_SEV_H__ +#define __PSP_SEV_H__ + +#ifdef CONFIG_X86 +#include + +#define __psp_pa(x) __sme_pa(x) +#else +#define __psp_pa(x) __pa(x) +#endif + +/** + * SEV platform state + */ +enum sev_state { + SEV_STATE_UNINIT = 0x0, + SEV_STATE_INIT = 0x1, + SEV_STATE_WORKING = 0x2, + + SEV_STATE_MAX +}; + +/** + * SEV platform and guest management commands + */ +enum sev_cmd { + /* platform commands */ + SEV_CMD_INIT = 0x001, + SEV_CMD_SHUTDOWN = 0x002, + SEV_CMD_FACTORY_RESET = 0x003, + SEV_CMD_PLATFORM_STATUS = 0x004, + SEV_CMD_PEK_GEN = 0x005, + SEV_CMD_PEK_CSR = 0x006, + SEV_CMD_PEK_CERT_IMPORT = 0x007, + SEV_CMD_PDH_CERT_EXPORT = 0x008, + SEV_CMD_PDH_GEN = 0x009, + SEV_CMD_DF_FLUSH = 0x00A, + + /* Guest commands */ + SEV_CMD_DECOMMISSION = 0x020, + SEV_CMD_ACTIVATE = 0x021, + SEV_CMD_DEACTIVATE = 0x022, + SEV_CMD_GUEST_STATUS = 0x023, + + /* Guest launch commands */ + SEV_CMD_LAUNCH_START = 0x030, + SEV_CMD_LAUNCH_UPDATE_DATA = 0x031, + SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032, + SEV_CMD_LAUNCH_MEASURE = 0x033, + SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034, + SEV_CMD_LAUNCH_FINISH = 0x035, + + /* Guest migration commands (outgoing) */ + SEV_CMD_SEND_START = 0x040, + SEV_CMD_SEND_UPDATE_DATA = 0x041, + SEV_CMD_SEND_UPDATE_VMSA = 0x042, + SEV_CMD_SEND_FINISH = 0x043, + + /* Guest migration commands (incoming) */ + SEV_CMD_RECEIVE_START = 0x050, + SEV_CMD_RECEIVE_UPDATE_DATA = 0x051, + SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052, + SEV_CMD_RECEIVE_FINISH = 0x053, + + /* Guest debug commands */ + SEV_CMD_DBG_DECRYPT = 0x060, + SEV_CMD_DBG_ENCRYPT = 0x061, + + SEV_CMD_MAX, +}; + +/** + * status code returned by the commands + */ +enum psp_ret_code { + SEV_RET_SUCCESS = 0, + SEV_RET_INVALID_PLATFORM_STATE, + SEV_RET_INVALID_GUEST_STATE, + SEV_RET_INAVLID_CONFIG, + SEV_RET_INVALID_LENGTH, + SEV_RET_ALREADY_OWNED, + SEV_RET_INVALID_CERTIFICATE, + SEV_RET_POLICY_FAILURE, + SEV_RET_INACTIVE, + SEV_RET_INVALID_ADDRESS, + SEV_RET_BAD_SIGNATURE, + SEV_RET_BAD_MEASUREMENT, + SEV_RET_ASID_OWNED, + SEV_RET_INVALID_ASID, + SEV_RET_WBINVD_REQUIRED, + SEV_RET_DFFLUSH_REQUIRED, + SEV_RET_INVALID_GUEST, + SEV_RET_INVALID_COMMAND, + SEV_RET_ACTIVE, + SEV_RET_HWSEV_RET_PLATFORM, + SEV_RET_HWSEV_RET_UNSAFE, + SEV_RET_UNSUPPORTED, + SEV_RET_MAX, +}; + +/** + * struct sev_data_init - INIT command parameters + * + * @flags: processing flags + * @tmr_address: system physical address used for SEV-ES + * @tmr_length: length of tmr_address + */ +struct sev_data_init { + __u32 flags; /* In */ + __u32 reserved; /* In */ + __u64 tmr_address; /* In */ + __u32 tmr_length; /* In */ +}; + +/** + * struct sev_data_status - PLATFORM_STATUS command parameters + * + * @major: major API version + * @minor: minor API version + * @state: platform state + * @owner: self-owned or externally owned + * @config: platform config flags + * @guest_count: number of active guests + */ +struct sev_data_status { + __u8 api_major; /* Out */ + __u8 api_minor; /* Out */ + __u8 state; /* Out */ + __u8 owner; /* Out */ + __u32 config; /* Out */ + __u32 guest_count; /* Out */ +}; + +/** + * struct sev_data_pek_csr - PEK_CSR command parameters + * + * @address: PEK certificate chain + * @length: length of certificate + */ +struct sev_data_pek_csr { + __u64 address; /* In */ + __u32 length; /* In/Out */ +}; + +/** + * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters + * + * @pek_address: PEK certificate chain + * @pek_length: length of PEK certificate + * @oca_address: OCA certificate chain + * @oca_length: length of OCA certificate + */ +struct sev_data_pek_cert_import { + __u64 pek_cert_address; /* In */ + __u32 pek_cert_length; /* In */ + __u32 reserved; /* In */ + __u64 oca_cert_address; /* In */ + __u32 oca_cert_length; /* In */ +}; + +/** + * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters + * + * @pdh_address: PDH certificate address + * @pdh_length: length of PDH certificate + * @cert_chain_address: PDH certificate chain + * @cert_chain_length: length of PDH certificate chain + */ +struct sev_data_pdh_cert_export { + __u64 pdh_cert_address; /* In */ + __u32 pdh_cert_length; /* In/Out */ + __u32 reserved; /* In */ + __u64 cert_chain_address; /* In */ + __u32 cert_chain_length; /* In/Out */ +}; + +/** + * struct sev_data_decommission - DECOMMISSION command parameters + * + * @handle: handle of the VM to decommission + */ +struct sev_data_decommission { + u32 handle; /* In */ +}; + +/** + * struct sev_data_activate - ACTIVATE command parameters + * + * @handle: handle of the VM to activate + * @asid: asid assigned to the VM + */ +struct sev_data_activate { + u32 handle; /* In */ + u32 asid; /* In */ +}; + +/** + * struct sev_data_deactivate - DEACTIVATE command parameters + * + * @handle: handle of the VM to deactivate + */ +struct sev_data_deactivate { + u32 handle; /* In */ +}; + +/** + * struct sev_data_guest_status - SEV GUEST_STATUS command parameters + * + * @handle: handle of the VM to retrieve status + * @policy: policy information for the VM + * @asid: current ASID of the VM + * @state: current state of the VM + */ +struct sev_data_guest_status { + u32 handle; /* In */ + u32 policy; /* Out */ + u32 asid; /* Out */ + u8 state; /* Out */ +}; + +/** + * struct sev_data_launch_start - LAUNCH_START command parameters + * + * @handle: handle assigned to the VM + * @policy: guest launch policy + * @dh_cert_address: physical address of DH certificate blob + * @dh_cert_length: length of DH certificate blob + * @session_address: physical address of session parameters + * @session_len: length of session parameters + */ +struct sev_data_launch_start { + u32 handle; /* In/Out */ + u32 policy; /* In */ + u64 dh_cert_address; /* In */ + u32 dh_cert_length; /* In */ + u32 reserved; /* In */ + u64 session_address; /* In */ + u32 session_length; /* In */ +}; + +/** + * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter + * + * @handle: handle of the VM to update + * @length: length of memory to be encrypted + * @address: physical address of memory region to encrypt + */ +struct sev_data_launch_update_data { + u32 handle; /* In */ + u32 reserved; + u64 address; /* In */ + u32 length; /* In */ +}; + +/** + * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command + * + * @handle: handle of the VM + * @address: physical address of memory region to encrypt + * @length: length of memory region to encrypt + */ +struct sev_data_launch_update_vmsa { + u32 handle; /* In */ + u32 reserved; + u64 address; /* In */ + u32 length; /* In */ +}; + +/** + * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters + * + * @handle: handle of the VM to process + * @address: physical address containing the measurement blob + * @length: length of measurement blob + */ +struct sev_data_launch_measure { + u32 handle; /* In */ + u32 reserved; + u64 address; /* In */ + u32 length; /* In/Out */ +}; + +/** + * struct sev_data_launch_secret - LAUNCH_SECRET command parameters + * + * @handle: handle of the VM to process + * @hdr_address: physical address containing the packet header + * @hdr_length: length of packet header + * @guest_address: system physical address of guest memory region + * @guest_length: length of guest_paddr + * @trans_address: physical address of transport memory buffer + * @trans_length: length of transport memory buffer + */ +struct sev_data_launch_secret { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_length; /* In */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_length; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_length; /* In */ +}; + +/** + * struct sev_data_launch_finish - LAUNCH_FINISH command parameters + * + * @handle: handle of the VM to process + */ +struct sev_data_launch_finish { + u32 handle; /* In */ +}; + +/** + * struct sev_data_send_start - SEND_START command parameters + * + * @handle: handle of the VM to process + * @policy: policy information for the VM + * @pdh_cert_address: physical address containing PDH certificate + * @pdh_cert_length: length of PDH certificate + * @plat_certs_address: physical address containing platform certificate + * @plat_certs_length: length of platform certificate + * @amd_certs_address: physical address containing AMD certificate + * @amd_certs_length: length of AMD certificate + * @session_address: physical address containing Session data + * @session_length: length of session data + */ +struct sev_data_send_start { + u32 handle; /* In */ + u32 policy; /* Out */ + u64 pdh_cert_address; /* In */ + u32 pdh_cert_length; /* In */ + u32 reserved1; + u64 plat_cert_address; /* In */ + u32 plat_cert_length; /* In */ + u32 reserved2; + u64 amd_cert_address; /* In */ + u32 amd_cert_length; /* In */ + u32 reserved3; + u64 session_address; /* In */ + u32 session_length; /* In/Out */ +}; + +/** + * struct sev_data_send_update - SEND_UPDATE_DATA command + * + * @handle: handle of the VM to process + * @hdr_address: physical address containing packet header + * @hdr_length: length of packet header + * @guest_address: physical address of guest memory region to send + * @guest_length: length of guest memory region to send + * @trans_address: physical address of host memory region + * @trans_length: length of host memory region + */ +struct sev_data_send_update_data { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_length; /* In/Out */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_length; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_length; /* In */ +}; + +/** + * struct sev_data_send_update - SEND_UPDATE_VMSA command + * + * @handle: handle of the VM to process + * @hdr_address: physical address containing packet header + * @hdr_length: length of packet header + * @guest_address: physical address of guest memory region to send + * @guest_length: length of guest memory region to send + * @trans_address: physical address of host memory region + * @trans_length: length of host memory region + */ +struct sev_data_send_update_vmsa { + u32 handle; /* In */ + u64 hdr_address; /* In */ + u32 hdr_length; /* In/Out */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_length; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_length; /* In */ +}; + +/** + * struct sev_data_send_finish - SEND_FINISH command parameters + * + * @handle: handle of the VM to process + */ +struct sev_data_send_finish { + u32 handle; /* In */ +}; + +/** + * struct sev_data_receive_start - RECEIVE_START command parameters + * + * @handle: handle of the VM to perform receive operation + * @pdh_cert_address: system physical address containing PDH certificate blob + * @pdh_cert_length: length of PDH certificate blob + * @session_address: system physical address containing session blob + * @session_length: length of session blob + */ +struct sev_data_receive_start { + u32 handle; /* In/Out */ + u32 policy; /* In */ + u64 pdh_cert_address; /* In */ + u32 pdh_cert_length; /* In */ + u32 reserved1; + u64 session_address; /* In */ + u32 session_length; /* In */ +}; + +/** + * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters + * + * @handle: handle of the VM to update + * @hdr_address: physical address containing packet header blob + * @hdr_length: length of packet header + * @guest_address: system physical address of guest memory region + * @guest_length: length of guest memory region + * @trans_address: system physical address of transport buffer + * @trans_length: length of transport buffer + */ +struct sev_data_receive_update_data { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_length; /* In */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_length; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_length; /* In */ +}; + +/** + * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters + * + * @handle: handle of the VM to update + * @hdr_address: physical address containing packet header blob + * @hdr_length: length of packet header + * @guest_address: system physical address of guest memory region + * @guest_length: length of guest memory region + * @trans_address: system physical address of transport buffer + * @trans_length: length of transport buffer + */ +struct sev_data_receive_update_vmsa { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_length; /* In */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_length; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_length; /* In */ +}; + +/** + * struct sev_data_receive_finish - RECEIVE_FINISH command parameters + * + * @handle: handle of the VM to finish + */ +struct sev_data_receive_finish { + u32 handle; /* In */ +}; + +/** + * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters + * + * @handle: handle of the VM to perform debug operation + * @src_addr: source address of data to operate on + * @dst_addr: destination address of data to operate on + * @length: length of data to operate on + */ +struct sev_data_dbg { + u32 handle; /* In */ + u32 reserved; + u64 src_addr; /* In */ + u64 dst_addr; /* In */ + u32 length; /* In */ +}; + +#if defined(CONFIG_CRYPTO_DEV_PSP_SEV) + +/** + * sev_platform_init - perform SEV INIT command + * + * @init: sev_data_init structure to be processed + * @error: SEV command return code + * + * Returns: + * 0 if the SEV successfully processed the command + * -%ENODEV if the SEV device is not available + * -%ENOTSUPP if the SEV does not support SEV + * -%ETIMEDOUT if the SEV command timed out + * -%EIO if the SEV returned a non-zero return code + */ +int sev_platform_init(struct sev_data_init *init, int *error); + +/** + * sev_platform_shutdown - perform SEV SHUTDOWN command + * + * @error: SEV command return code + * + * Returns: + * 0 if the SEV successfully processed the command + * -%ENODEV if the SEV device is not available + * -%ENOTSUPP if the SEV does not support SEV + * -%ETIMEDOUT if the SEV command timed out + * -%EIO if the SEV returned a non-zero return code + */ +int sev_platform_shutdown(int *error); + +/** + * sev_platform_status - perform SEV PLATFORM_STATUS command + * + * @init: sev_data_status structure to be processed + * @error: SEV command return code + * + * Returns: + * 0 if the SEV successfully processed the command + * -%ENODEV if the SEV device is not available + * -%ENOTSUPP if the SEV does not support SEV + * -%ETIMEDOUT if the SEV command timed out + * -%EIO if the SEV returned a non-zero return code + */ +int sev_platform_status(struct sev_data_status *status, int *error); + +/** + * sev_issue_cmd_external_user - issue SEV command by other driver + * + * The function can be used by other drivers to issue a SEV command on + * behalf by userspace. The caller must pass a valid SEV file descriptor + * so that we know that caller has access to SEV device. + * + * @filep - SEV device file pointer + * @cmd - command to issue + * @data - command buffer + * @error: SEV command return code + * + * Returns: + * 0 if the SEV successfully processed the command + * -%ENODEV if the SEV device is not available + * -%ENOTSUPP if the SEV does not support SEV + * -%ETIMEDOUT if the SEV command timed out + * -%EIO if the SEV returned a non-zero return code + * -%EINVAL if the SEV file descriptor is not valid + */ +int sev_issue_cmd_external_user(struct file *filep, unsigned int id, + void *data, int *error); + +/** + * sev_guest_deactivate - perform SEV DEACTIVATE command + * + * @deactivate: sev_data_deactivate structure to be processed + * @sev_ret: sev command return code + * + * Returns: + * 0 if the sev successfully processed the command + * -%ENODEV if the sev device is not available + * -%ENOTSUPP if the sev does not support SEV + * -%ETIMEDOUT if the sev command timed out + * -%EIO if the sev returned a non-zero return code + */ +int sev_guest_deactivate(struct sev_data_deactivate *data, int *error); + +/** + * sev_guest_activate - perform SEV ACTIVATE command + * + * @activate: sev_data_activate structure to be processed + * @sev_ret: sev command return code + * + * Returns: + * 0 if the sev successfully processed the command + * -%ENODEV if the sev device is not available + * -%ENOTSUPP if the sev does not support SEV + * -%ETIMEDOUT if the sev command timed out + * -%EIO if the sev returned a non-zero return code + */ +int sev_guest_activate(struct sev_data_activate *data, int *error); + +/** + * sev_guest_df_flush - perform SEV DF_FLUSH command + * + * @sev_ret: sev command return code + * + * Returns: + * 0 if the sev successfully processed the command + * -%ENODEV if the sev device is not available + * -%ENOTSUPP if the sev does not support SEV + * -%ETIMEDOUT if the sev command timed out + * -%EIO if the sev returned a non-zero return code + */ +int sev_guest_df_flush(int *error); + +/** + * sev_guest_decommission - perform SEV DECOMMISSION command + * + * @decommission: sev_data_decommission structure to be processed + * @sev_ret: sev command return code + * + * Returns: + * 0 if the sev successfully processed the command + * -%ENODEV if the sev device is not available + * -%ENOTSUPP if the sev does not support SEV + * -%ETIMEDOUT if the sev command timed out + * -%EIO if the sev returned a non-zero return code + */ +int sev_guest_decommission(struct sev_data_decommission *data, int *error); + +#else /* !CONFIG_CRYPTO_DEV_PSP_SEV */ + +static inline int sev_platform_status(struct sev_data_status *status, + int *error) +{ + return -ENODEV; +} + +static inline int sev_platform_init(struct sev_data_init *init, int *error) +{ + return -ENODEV; +} + +static inline int sev_platform_shutdown(int *error) +{ + return -ENODEV; +} + +static inline int sev_issue_cmd_external_user(int fd, unsigned int id, + void *data, int *error) +{ + return -ENODEV; +} + +static inline int sev_guest_deactivate(struct sev_data_deactivate *data, + int *error) +{ + return -ENODEV; +} + +static inline int sev_guest_decommission(struct sev_data_decommission *data, + int *error) +{ + return -ENODEV; +} + +static inline int sev_guest_activate(struct sev_data_activate *data, + int *error) +{ + return -ENODEV; +} + +static inline int sev_guest_df_flush(int *error) +{ + return -ENODEV; +} + +#endif /* CONFIG_CRYPTO_DEV_PSP_SEV */ + +#endif /* __PSP_SEV_H__ */ diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h new file mode 100644 index 0000000..eb802f8 --- /dev/null +++ b/include/uapi/linux/psp-sev.h @@ -0,0 +1,110 @@ + +/* + * Userspace interface for AMD Secure Encrypted Virtualization (SEV) + * + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. + * + * Author: Brijesh Singh + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef __PSP_SEV_USER_H__ +#define __PSP_SEV_USER_H__ + +#include + +/** + * SEV platform commands + */ +enum { + SEV_USER_CMD_FACTORY_RESET = 0, + SEV_USER_CMD_PLATFORM_STATUS, + SEV_USER_CMD_PEK_GEN, + SEV_USER_CMD_PEK_CSR, + SEV_USER_CMD_PDH_GEN, + SEV_USER_CMD_PDH_CERT_EXPORT, + SEV_USER_CMD_PEK_CERT_IMPORT, + + SEV_USER_CMD_MAX, +}; + +/** + * struct sev_user_data_status - PLATFORM_STATUS command parameters + * + * @major: major API version + * @minor: minor API version + * @state: platform state + * @owner: self-owned or externally owned + * @config: platform config flags + * @guest_count: number of active guests + */ +struct sev_user_data_status { + __u8 api_major; /* Out */ + __u8 api_minor; /* Out */ + __u8 state; /* Out */ + __u8 owner; /* Out */ + __u32 config; /* Out */ + __u32 guest_count; /* Out */ +}; + +/** + * struct sev_user_data_pek_csr - PEK_CSR command parameters + * + * @address: PEK certificate chain + * @length: length of certificate + */ +struct sev_user_data_pek_csr { + __u64 address; /* In */ + __u32 length; /* In/Out */ +}; + +/** + * struct sev_user_data_cert_import - PEK_CERT_IMPORT command parameters + * + * @pek_address: PEK certificate chain + * @pek_length: length of PEK certificate + * @oca_address: OCA certificate chain + * @oca_length: length of OCA certificate + */ +struct sev_user_data_pek_cert_import { + __u64 pek_cert_address; /* In */ + __u32 pek_cert_length; /* In */ + __u64 oca_cert_address; /* In */ + __u32 oca_cert_length; /* In */ +}; + +/** + * struct sev_user_data_pdh_cert_export - PDH_CERT_EXPORT command parameters + * + * @pdh_address: PDH certificate address + * @pdh_length: length of PDH certificate + * @cert_chain_address: PDH certificate chain + * @cert_chain_length: length of PDH certificate chain + */ +struct sev_user_data_pdh_cert_export { + __u64 pdh_cert_address; /* In */ + __u32 pdh_cert_length; /* In/Out */ + __u64 cert_chain_address; /* In */ + __u32 cert_chain_length; /* In/Out */ +}; + +/** + * struct sev_issue_cmd - SEV ioctl parameters + * + * @cmd: SEV commands to execute + * @opaque: pointer to the command structure + * @error: SEV FW return code on failure + */ +struct sev_issue_cmd { + __u32 cmd; /* In */ + __u64 data; /* In */ + __u32 error; /* Out */ +}; + +#define SEV_IOC_TYPE 'S' +#define SEV_ISSUE_CMD _IOWR(SEV_IOC_TYPE, 0x0, struct sev_issue_cmd) + +#endif /* __PSP_USER_SEV_H */