| Message ID | 20171020023413.122280-12-brijesh.singh@amd.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Herbert Xu |
| Headers | show |
On 10/19/2017 09:33 PM, Brijesh Singh wrote: > Define Secure Encrypted Virtualization (SEV) key management command id > and structure. The command definition is available in SEV KM [1] spec > 0.14. > > [1] http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf > > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: "Radim Krčmář" <rkrcmar@redhat.com> > Cc: Borislav Petkov <bp@suse.de> > Cc: Herbert Xu <herbert@gondor.apana.org.au> > Cc: Gary Hook <gary.hook@amd.com> > Cc: Tom Lendacky <thomas.lendacky@amd.com> > Cc: linux-crypto@vger.kernel.org > Cc: kvm@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Improvements-by: Borislav Petkov <bp@suse.de> > Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> > Reviewed-by: Borislav Petkov <bp@suse.de> Acked-by: Gary R Hook <gary.hook@amd.com> > --- > include/linux/psp-sev.h | 494 ++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 494 insertions(+) > create mode 100644 include/linux/psp-sev.h > > diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h > new file mode 100644 > index 000000000000..15bda519538e > --- /dev/null > +++ b/include/linux/psp-sev.h > @@ -0,0 +1,494 @@ > +/* > + * AMD Secure Encrypted Virtualization (SEV) driver interface > + * > + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. > + * > + * Author: Brijesh Singh <brijesh.singh@amd.com> > + * > + * SEV spec 0.14 is available at: > + * http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License version 2 as > + * published by the Free Software Foundation. > + */ > + > +#ifndef __PSP_SEV_H__ > +#define __PSP_SEV_H__ > + > +#include <uapi/linux/psp-sev.h> > + > +#ifdef CONFIG_X86 > +#include <linux/mem_encrypt.h> > + > +#define __psp_pa(x) __sme_pa(x) > +#else > +#define __psp_pa(x) __pa(x) > +#endif > + > +#define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */ > + > +/** > + * SEV platform state > + */ > +enum sev_state { > + SEV_STATE_UNINIT = 0x0, > + SEV_STATE_INIT = 0x1, > + SEV_STATE_WORKING = 0x2, > + > + SEV_STATE_MAX > +}; > + > +/** > + * SEV platform and guest management commands > + */ > +enum sev_cmd { > + /* platform commands */ > + SEV_CMD_INIT = 0x001, > + SEV_CMD_SHUTDOWN = 0x002, > + SEV_CMD_FACTORY_RESET = 0x003, > + SEV_CMD_PLATFORM_STATUS = 0x004, > + SEV_CMD_PEK_GEN = 0x005, > + SEV_CMD_PEK_CSR = 0x006, > + SEV_CMD_PEK_CERT_IMPORT = 0x007, > + SEV_CMD_PDH_CERT_EXPORT = 0x008, > + SEV_CMD_PDH_GEN = 0x009, > + SEV_CMD_DF_FLUSH = 0x00A, > + > + /* Guest commands */ > + SEV_CMD_DECOMMISSION = 0x020, > + SEV_CMD_ACTIVATE = 0x021, > + SEV_CMD_DEACTIVATE = 0x022, > + SEV_CMD_GUEST_STATUS = 0x023, > + > + /* Guest launch commands */ > + SEV_CMD_LAUNCH_START = 0x030, > + SEV_CMD_LAUNCH_UPDATE_DATA = 0x031, > + SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032, > + SEV_CMD_LAUNCH_MEASURE = 0x033, > + SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034, > + SEV_CMD_LAUNCH_FINISH = 0x035, > + > + /* Guest migration commands (outgoing) */ > + SEV_CMD_SEND_START = 0x040, > + SEV_CMD_SEND_UPDATE_DATA = 0x041, > + SEV_CMD_SEND_UPDATE_VMSA = 0x042, > + SEV_CMD_SEND_FINISH = 0x043, > + > + /* Guest migration commands (incoming) */ > + SEV_CMD_RECEIVE_START = 0x050, > + SEV_CMD_RECEIVE_UPDATE_DATA = 0x051, > + SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052, > + SEV_CMD_RECEIVE_FINISH = 0x053, > + > + /* Guest debug commands */ > + SEV_CMD_DBG_DECRYPT = 0x060, > + SEV_CMD_DBG_ENCRYPT = 0x061, > + > + SEV_CMD_MAX, > +}; > + > +/** > + * status code returned by the commands > + */ > +enum psp_ret_code { > + SEV_RET_SUCCESS = 0, > + SEV_RET_INVALID_PLATFORM_STATE, > + SEV_RET_INVALID_GUEST_STATE, > + SEV_RET_INAVLID_CONFIG, > + SEV_RET_INVALID_len, > + SEV_RET_ALREADY_OWNED, > + SEV_RET_INVALID_CERTIFICATE, > + SEV_RET_POLICY_FAILURE, > + SEV_RET_INACTIVE, > + SEV_RET_INVALID_ADDRESS, > + SEV_RET_BAD_SIGNATURE, > + SEV_RET_BAD_MEASUREMENT, > + SEV_RET_ASID_OWNED, > + SEV_RET_INVALID_ASID, > + SEV_RET_WBINVD_REQUIRED, > + SEV_RET_DFFLUSH_REQUIRED, > + SEV_RET_INVALID_GUEST, > + SEV_RET_INVALID_COMMAND, > + SEV_RET_ACTIVE, > + SEV_RET_HWSEV_RET_PLATFORM, > + SEV_RET_HWSEV_RET_UNSAFE, > + SEV_RET_UNSUPPORTED, > + SEV_RET_MAX, > +}; > + > +/** > + * struct sev_data_init - INIT command parameters > + * > + * @flags: processing flags > + * @tmr_address: system physical address used for SEV-ES > + * @tmr_len: len of tmr_address > + */ > +struct sev_data_init { > + u32 flags; /* In */ > + u32 reserved; /* In */ > + u64 tmr_address; /* In */ > + u32 tmr_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_pek_csr - PEK_CSR command parameters > + * > + * @address: PEK certificate chain > + * @len: len of certificate > + */ > +struct sev_data_pek_csr { > + u64 address; /* In */ > + u32 len; /* In/Out */ > +} __packed; > + > +/** > + * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters > + * > + * @pek_address: PEK certificate chain > + * @pek_len: len of PEK certificate > + * @oca_address: OCA certificate chain > + * @oca_len: len of OCA certificate > + */ > +struct sev_data_pek_cert_import { > + u64 pek_cert_address; /* In */ > + u32 pek_cert_len; /* In */ > + u32 reserved; /* In */ > + u64 oca_cert_address; /* In */ > + u32 oca_cert_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters > + * > + * @pdh_address: PDH certificate address > + * @pdh_len: len of PDH certificate > + * @cert_chain_address: PDH certificate chain > + * @cert_chain_len: len of PDH certificate chain > + */ > +struct sev_data_pdh_cert_export { > + u64 pdh_cert_address; /* In */ > + u32 pdh_cert_len; /* In/Out */ > + u32 reserved; /* In */ > + u64 cert_chain_address; /* In */ > + u32 cert_chain_len; /* In/Out */ > +} __packed; > + > +/** > + * struct sev_data_decommission - DECOMMISSION command parameters > + * > + * @handle: handle of the VM to decommission > + */ > +struct sev_data_decommission { > + u32 handle; /* In */ > +} __packed; > + > +/** > + * struct sev_data_activate - ACTIVATE command parameters > + * > + * @handle: handle of the VM to activate > + * @asid: asid assigned to the VM > + */ > +struct sev_data_activate { > + u32 handle; /* In */ > + u32 asid; /* In */ > +} __packed; > + > +/** > + * struct sev_data_deactivate - DEACTIVATE command parameters > + * > + * @handle: handle of the VM to deactivate > + */ > +struct sev_data_deactivate { > + u32 handle; /* In */ > +} __packed; > + > +/** > + * struct sev_data_guest_status - SEV GUEST_STATUS command parameters > + * > + * @handle: handle of the VM to retrieve status > + * @policy: policy information for the VM > + * @asid: current ASID of the VM > + * @state: current state of the VM > + */ > +struct sev_data_guest_status { > + u32 handle; /* In */ > + u32 policy; /* Out */ > + u32 asid; /* Out */ > + u8 state; /* Out */ > +} __packed; > + > +/** > + * struct sev_data_launch_start - LAUNCH_START command parameters > + * > + * @handle: handle assigned to the VM > + * @policy: guest launch policy > + * @dh_cert_address: physical address of DH certificate blob > + * @dh_cert_len: len of DH certificate blob > + * @session_address: physical address of session parameters > + * @session_len: len of session parameters > + */ > +struct sev_data_launch_start { > + u32 handle; /* In/Out */ > + u32 policy; /* In */ > + u64 dh_cert_address; /* In */ > + u32 dh_cert_len; /* In */ > + u32 reserved; /* In */ > + u64 session_address; /* In */ > + u32 session_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter > + * > + * @handle: handle of the VM to update > + * @len: len of memory to be encrypted > + * @address: physical address of memory region to encrypt > + */ > +struct sev_data_launch_update_data { > + u32 handle; /* In */ > + u32 reserved; > + u64 address; /* In */ > + u32 len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command > + * > + * @handle: handle of the VM > + * @address: physical address of memory region to encrypt > + * @len: len of memory region to encrypt > + */ > +struct sev_data_launch_update_vmsa { > + u32 handle; /* In */ > + u32 reserved; > + u64 address; /* In */ > + u32 len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters > + * > + * @handle: handle of the VM to process > + * @address: physical address containing the measurement blob > + * @len: len of measurement blob > + */ > +struct sev_data_launch_measure { > + u32 handle; /* In */ > + u32 reserved; > + u64 address; /* In */ > + u32 len; /* In/Out */ > +} __packed; > + > +/** > + * struct sev_data_launch_secret - LAUNCH_SECRET command parameters > + * > + * @handle: handle of the VM to process > + * @hdr_address: physical address containing the packet header > + * @hdr_len: len of packet header > + * @guest_address: system physical address of guest memory region > + * @guest_len: len of guest_paddr > + * @trans_address: physical address of transport memory buffer > + * @trans_len: len of transport memory buffer > + */ > +struct sev_data_launch_secret { > + u32 handle; /* In */ > + u32 reserved1; > + u64 hdr_address; /* In */ > + u32 hdr_len; /* In */ > + u32 reserved2; > + u64 guest_address; /* In */ > + u32 guest_len; /* In */ > + u32 reserved3; > + u64 trans_address; /* In */ > + u32 trans_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_launch_finish - LAUNCH_FINISH command parameters > + * > + * @handle: handle of the VM to process > + */ > +struct sev_data_launch_finish { > + u32 handle; /* In */ > +} __packed; > + > +/** > + * struct sev_data_send_start - SEND_START command parameters > + * > + * @handle: handle of the VM to process > + * @policy: policy information for the VM > + * @pdh_cert_address: physical address containing PDH certificate > + * @pdh_cert_len: len of PDH certificate > + * @plat_certs_address: physical address containing platform certificate > + * @plat_certs_len: len of platform certificate > + * @amd_certs_address: physical address containing AMD certificate > + * @amd_certs_len: len of AMD certificate > + * @session_address: physical address containing Session data > + * @session_len: len of session data > + */ > +struct sev_data_send_start { > + u32 handle; /* In */ > + u32 policy; /* Out */ > + u64 pdh_cert_address; /* In */ > + u32 pdh_cert_len; /* In */ > + u32 reserved1; > + u64 plat_cert_address; /* In */ > + u32 plat_cert_len; /* In */ > + u32 reserved2; > + u64 amd_cert_address; /* In */ > + u32 amd_cert_len; /* In */ > + u32 reserved3; > + u64 session_address; /* In */ > + u32 session_len; /* In/Out */ > +} __packed; > + > +/** > + * struct sev_data_send_update - SEND_UPDATE_DATA command > + * > + * @handle: handle of the VM to process > + * @hdr_address: physical address containing packet header > + * @hdr_len: len of packet header > + * @guest_address: physical address of guest memory region to send > + * @guest_len: len of guest memory region to send > + * @trans_address: physical address of host memory region > + * @trans_len: len of host memory region > + */ > +struct sev_data_send_update_data { > + u32 handle; /* In */ > + u32 reserved1; > + u64 hdr_address; /* In */ > + u32 hdr_len; /* In/Out */ > + u32 reserved2; > + u64 guest_address; /* In */ > + u32 guest_len; /* In */ > + u32 reserved3; > + u64 trans_address; /* In */ > + u32 trans_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_send_update - SEND_UPDATE_VMSA command > + * > + * @handle: handle of the VM to process > + * @hdr_address: physical address containing packet header > + * @hdr_len: len of packet header > + * @guest_address: physical address of guest memory region to send > + * @guest_len: len of guest memory region to send > + * @trans_address: physical address of host memory region > + * @trans_len: len of host memory region > + */ > +struct sev_data_send_update_vmsa { > + u32 handle; /* In */ > + u64 hdr_address; /* In */ > + u32 hdr_len; /* In/Out */ > + u32 reserved2; > + u64 guest_address; /* In */ > + u32 guest_len; /* In */ > + u32 reserved3; > + u64 trans_address; /* In */ > + u32 trans_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_send_finish - SEND_FINISH command parameters > + * > + * @handle: handle of the VM to process > + */ > +struct sev_data_send_finish { > + u32 handle; /* In */ > +} __packed; > + > +/** > + * struct sev_data_receive_start - RECEIVE_START command parameters > + * > + * @handle: handle of the VM to perform receive operation > + * @pdh_cert_address: system physical address containing PDH certificate blob > + * @pdh_cert_len: len of PDH certificate blob > + * @session_address: system physical address containing session blob > + * @session_len: len of session blob > + */ > +struct sev_data_receive_start { > + u32 handle; /* In/Out */ > + u32 policy; /* In */ > + u64 pdh_cert_address; /* In */ > + u32 pdh_cert_len; /* In */ > + u32 reserved1; > + u64 session_address; /* In */ > + u32 session_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters > + * > + * @handle: handle of the VM to update > + * @hdr_address: physical address containing packet header blob > + * @hdr_len: len of packet header > + * @guest_address: system physical address of guest memory region > + * @guest_len: len of guest memory region > + * @trans_address: system physical address of transport buffer > + * @trans_len: len of transport buffer > + */ > +struct sev_data_receive_update_data { > + u32 handle; /* In */ > + u32 reserved1; > + u64 hdr_address; /* In */ > + u32 hdr_len; /* In */ > + u32 reserved2; > + u64 guest_address; /* In */ > + u32 guest_len; /* In */ > + u32 reserved3; > + u64 trans_address; /* In */ > + u32 trans_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters > + * > + * @handle: handle of the VM to update > + * @hdr_address: physical address containing packet header blob > + * @hdr_len: len of packet header > + * @guest_address: system physical address of guest memory region > + * @guest_len: len of guest memory region > + * @trans_address: system physical address of transport buffer > + * @trans_len: len of transport buffer > + */ > +struct sev_data_receive_update_vmsa { > + u32 handle; /* In */ > + u32 reserved1; > + u64 hdr_address; /* In */ > + u32 hdr_len; /* In */ > + u32 reserved2; > + u64 guest_address; /* In */ > + u32 guest_len; /* In */ > + u32 reserved3; > + u64 trans_address; /* In */ > + u32 trans_len; /* In */ > +} __packed; > + > +/** > + * struct sev_data_receive_finish - RECEIVE_FINISH command parameters > + * > + * @handle: handle of the VM to finish > + */ > +struct sev_data_receive_finish { > + u32 handle; /* In */ > +} __packed; > + > +/** > + * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters > + * > + * @handle: handle of the VM to perform debug operation > + * @src_addr: source address of data to operate on > + * @dst_addr: destination address of data to operate on > + * @len: len of data to operate on > + */ > +struct sev_data_dbg { > + u32 handle; /* In */ > + u32 reserved; > + u64 src_addr; /* In */ > + u64 dst_addr; /* In */ > + u32 len; /* In */ > +} __packed; > + > +#endif /* __PSP_SEV_H__ */ >
diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h new file mode 100644 index 000000000000..15bda519538e --- /dev/null +++ b/include/linux/psp-sev.h @@ -0,0 +1,494 @@ +/* + * AMD Secure Encrypted Virtualization (SEV) driver interface + * + * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. + * + * Author: Brijesh Singh <brijesh.singh@amd.com> + * + * SEV spec 0.14 is available at: + * http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef __PSP_SEV_H__ +#define __PSP_SEV_H__ + +#include <uapi/linux/psp-sev.h> + +#ifdef CONFIG_X86 +#include <linux/mem_encrypt.h> + +#define __psp_pa(x) __sme_pa(x) +#else +#define __psp_pa(x) __pa(x) +#endif + +#define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */ + +/** + * SEV platform state + */ +enum sev_state { + SEV_STATE_UNINIT = 0x0, + SEV_STATE_INIT = 0x1, + SEV_STATE_WORKING = 0x2, + + SEV_STATE_MAX +}; + +/** + * SEV platform and guest management commands + */ +enum sev_cmd { + /* platform commands */ + SEV_CMD_INIT = 0x001, + SEV_CMD_SHUTDOWN = 0x002, + SEV_CMD_FACTORY_RESET = 0x003, + SEV_CMD_PLATFORM_STATUS = 0x004, + SEV_CMD_PEK_GEN = 0x005, + SEV_CMD_PEK_CSR = 0x006, + SEV_CMD_PEK_CERT_IMPORT = 0x007, + SEV_CMD_PDH_CERT_EXPORT = 0x008, + SEV_CMD_PDH_GEN = 0x009, + SEV_CMD_DF_FLUSH = 0x00A, + + /* Guest commands */ + SEV_CMD_DECOMMISSION = 0x020, + SEV_CMD_ACTIVATE = 0x021, + SEV_CMD_DEACTIVATE = 0x022, + SEV_CMD_GUEST_STATUS = 0x023, + + /* Guest launch commands */ + SEV_CMD_LAUNCH_START = 0x030, + SEV_CMD_LAUNCH_UPDATE_DATA = 0x031, + SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032, + SEV_CMD_LAUNCH_MEASURE = 0x033, + SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034, + SEV_CMD_LAUNCH_FINISH = 0x035, + + /* Guest migration commands (outgoing) */ + SEV_CMD_SEND_START = 0x040, + SEV_CMD_SEND_UPDATE_DATA = 0x041, + SEV_CMD_SEND_UPDATE_VMSA = 0x042, + SEV_CMD_SEND_FINISH = 0x043, + + /* Guest migration commands (incoming) */ + SEV_CMD_RECEIVE_START = 0x050, + SEV_CMD_RECEIVE_UPDATE_DATA = 0x051, + SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052, + SEV_CMD_RECEIVE_FINISH = 0x053, + + /* Guest debug commands */ + SEV_CMD_DBG_DECRYPT = 0x060, + SEV_CMD_DBG_ENCRYPT = 0x061, + + SEV_CMD_MAX, +}; + +/** + * status code returned by the commands + */ +enum psp_ret_code { + SEV_RET_SUCCESS = 0, + SEV_RET_INVALID_PLATFORM_STATE, + SEV_RET_INVALID_GUEST_STATE, + SEV_RET_INAVLID_CONFIG, + SEV_RET_INVALID_len, + SEV_RET_ALREADY_OWNED, + SEV_RET_INVALID_CERTIFICATE, + SEV_RET_POLICY_FAILURE, + SEV_RET_INACTIVE, + SEV_RET_INVALID_ADDRESS, + SEV_RET_BAD_SIGNATURE, + SEV_RET_BAD_MEASUREMENT, + SEV_RET_ASID_OWNED, + SEV_RET_INVALID_ASID, + SEV_RET_WBINVD_REQUIRED, + SEV_RET_DFFLUSH_REQUIRED, + SEV_RET_INVALID_GUEST, + SEV_RET_INVALID_COMMAND, + SEV_RET_ACTIVE, + SEV_RET_HWSEV_RET_PLATFORM, + SEV_RET_HWSEV_RET_UNSAFE, + SEV_RET_UNSUPPORTED, + SEV_RET_MAX, +}; + +/** + * struct sev_data_init - INIT command parameters + * + * @flags: processing flags + * @tmr_address: system physical address used for SEV-ES + * @tmr_len: len of tmr_address + */ +struct sev_data_init { + u32 flags; /* In */ + u32 reserved; /* In */ + u64 tmr_address; /* In */ + u32 tmr_len; /* In */ +} __packed; + +/** + * struct sev_data_pek_csr - PEK_CSR command parameters + * + * @address: PEK certificate chain + * @len: len of certificate + */ +struct sev_data_pek_csr { + u64 address; /* In */ + u32 len; /* In/Out */ +} __packed; + +/** + * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters + * + * @pek_address: PEK certificate chain + * @pek_len: len of PEK certificate + * @oca_address: OCA certificate chain + * @oca_len: len of OCA certificate + */ +struct sev_data_pek_cert_import { + u64 pek_cert_address; /* In */ + u32 pek_cert_len; /* In */ + u32 reserved; /* In */ + u64 oca_cert_address; /* In */ + u32 oca_cert_len; /* In */ +} __packed; + +/** + * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters + * + * @pdh_address: PDH certificate address + * @pdh_len: len of PDH certificate + * @cert_chain_address: PDH certificate chain + * @cert_chain_len: len of PDH certificate chain + */ +struct sev_data_pdh_cert_export { + u64 pdh_cert_address; /* In */ + u32 pdh_cert_len; /* In/Out */ + u32 reserved; /* In */ + u64 cert_chain_address; /* In */ + u32 cert_chain_len; /* In/Out */ +} __packed; + +/** + * struct sev_data_decommission - DECOMMISSION command parameters + * + * @handle: handle of the VM to decommission + */ +struct sev_data_decommission { + u32 handle; /* In */ +} __packed; + +/** + * struct sev_data_activate - ACTIVATE command parameters + * + * @handle: handle of the VM to activate + * @asid: asid assigned to the VM + */ +struct sev_data_activate { + u32 handle; /* In */ + u32 asid; /* In */ +} __packed; + +/** + * struct sev_data_deactivate - DEACTIVATE command parameters + * + * @handle: handle of the VM to deactivate + */ +struct sev_data_deactivate { + u32 handle; /* In */ +} __packed; + +/** + * struct sev_data_guest_status - SEV GUEST_STATUS command parameters + * + * @handle: handle of the VM to retrieve status + * @policy: policy information for the VM + * @asid: current ASID of the VM + * @state: current state of the VM + */ +struct sev_data_guest_status { + u32 handle; /* In */ + u32 policy; /* Out */ + u32 asid; /* Out */ + u8 state; /* Out */ +} __packed; + +/** + * struct sev_data_launch_start - LAUNCH_START command parameters + * + * @handle: handle assigned to the VM + * @policy: guest launch policy + * @dh_cert_address: physical address of DH certificate blob + * @dh_cert_len: len of DH certificate blob + * @session_address: physical address of session parameters + * @session_len: len of session parameters + */ +struct sev_data_launch_start { + u32 handle; /* In/Out */ + u32 policy; /* In */ + u64 dh_cert_address; /* In */ + u32 dh_cert_len; /* In */ + u32 reserved; /* In */ + u64 session_address; /* In */ + u32 session_len; /* In */ +} __packed; + +/** + * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter + * + * @handle: handle of the VM to update + * @len: len of memory to be encrypted + * @address: physical address of memory region to encrypt + */ +struct sev_data_launch_update_data { + u32 handle; /* In */ + u32 reserved; + u64 address; /* In */ + u32 len; /* In */ +} __packed; + +/** + * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command + * + * @handle: handle of the VM + * @address: physical address of memory region to encrypt + * @len: len of memory region to encrypt + */ +struct sev_data_launch_update_vmsa { + u32 handle; /* In */ + u32 reserved; + u64 address; /* In */ + u32 len; /* In */ +} __packed; + +/** + * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters + * + * @handle: handle of the VM to process + * @address: physical address containing the measurement blob + * @len: len of measurement blob + */ +struct sev_data_launch_measure { + u32 handle; /* In */ + u32 reserved; + u64 address; /* In */ + u32 len; /* In/Out */ +} __packed; + +/** + * struct sev_data_launch_secret - LAUNCH_SECRET command parameters + * + * @handle: handle of the VM to process + * @hdr_address: physical address containing the packet header + * @hdr_len: len of packet header + * @guest_address: system physical address of guest memory region + * @guest_len: len of guest_paddr + * @trans_address: physical address of transport memory buffer + * @trans_len: len of transport memory buffer + */ +struct sev_data_launch_secret { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_len; /* In */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_len; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_len; /* In */ +} __packed; + +/** + * struct sev_data_launch_finish - LAUNCH_FINISH command parameters + * + * @handle: handle of the VM to process + */ +struct sev_data_launch_finish { + u32 handle; /* In */ +} __packed; + +/** + * struct sev_data_send_start - SEND_START command parameters + * + * @handle: handle of the VM to process + * @policy: policy information for the VM + * @pdh_cert_address: physical address containing PDH certificate + * @pdh_cert_len: len of PDH certificate + * @plat_certs_address: physical address containing platform certificate + * @plat_certs_len: len of platform certificate + * @amd_certs_address: physical address containing AMD certificate + * @amd_certs_len: len of AMD certificate + * @session_address: physical address containing Session data + * @session_len: len of session data + */ +struct sev_data_send_start { + u32 handle; /* In */ + u32 policy; /* Out */ + u64 pdh_cert_address; /* In */ + u32 pdh_cert_len; /* In */ + u32 reserved1; + u64 plat_cert_address; /* In */ + u32 plat_cert_len; /* In */ + u32 reserved2; + u64 amd_cert_address; /* In */ + u32 amd_cert_len; /* In */ + u32 reserved3; + u64 session_address; /* In */ + u32 session_len; /* In/Out */ +} __packed; + +/** + * struct sev_data_send_update - SEND_UPDATE_DATA command + * + * @handle: handle of the VM to process + * @hdr_address: physical address containing packet header + * @hdr_len: len of packet header + * @guest_address: physical address of guest memory region to send + * @guest_len: len of guest memory region to send + * @trans_address: physical address of host memory region + * @trans_len: len of host memory region + */ +struct sev_data_send_update_data { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_len; /* In/Out */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_len; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_len; /* In */ +} __packed; + +/** + * struct sev_data_send_update - SEND_UPDATE_VMSA command + * + * @handle: handle of the VM to process + * @hdr_address: physical address containing packet header + * @hdr_len: len of packet header + * @guest_address: physical address of guest memory region to send + * @guest_len: len of guest memory region to send + * @trans_address: physical address of host memory region + * @trans_len: len of host memory region + */ +struct sev_data_send_update_vmsa { + u32 handle; /* In */ + u64 hdr_address; /* In */ + u32 hdr_len; /* In/Out */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_len; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_len; /* In */ +} __packed; + +/** + * struct sev_data_send_finish - SEND_FINISH command parameters + * + * @handle: handle of the VM to process + */ +struct sev_data_send_finish { + u32 handle; /* In */ +} __packed; + +/** + * struct sev_data_receive_start - RECEIVE_START command parameters + * + * @handle: handle of the VM to perform receive operation + * @pdh_cert_address: system physical address containing PDH certificate blob + * @pdh_cert_len: len of PDH certificate blob + * @session_address: system physical address containing session blob + * @session_len: len of session blob + */ +struct sev_data_receive_start { + u32 handle; /* In/Out */ + u32 policy; /* In */ + u64 pdh_cert_address; /* In */ + u32 pdh_cert_len; /* In */ + u32 reserved1; + u64 session_address; /* In */ + u32 session_len; /* In */ +} __packed; + +/** + * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters + * + * @handle: handle of the VM to update + * @hdr_address: physical address containing packet header blob + * @hdr_len: len of packet header + * @guest_address: system physical address of guest memory region + * @guest_len: len of guest memory region + * @trans_address: system physical address of transport buffer + * @trans_len: len of transport buffer + */ +struct sev_data_receive_update_data { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_len; /* In */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_len; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_len; /* In */ +} __packed; + +/** + * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters + * + * @handle: handle of the VM to update + * @hdr_address: physical address containing packet header blob + * @hdr_len: len of packet header + * @guest_address: system physical address of guest memory region + * @guest_len: len of guest memory region + * @trans_address: system physical address of transport buffer + * @trans_len: len of transport buffer + */ +struct sev_data_receive_update_vmsa { + u32 handle; /* In */ + u32 reserved1; + u64 hdr_address; /* In */ + u32 hdr_len; /* In */ + u32 reserved2; + u64 guest_address; /* In */ + u32 guest_len; /* In */ + u32 reserved3; + u64 trans_address; /* In */ + u32 trans_len; /* In */ +} __packed; + +/** + * struct sev_data_receive_finish - RECEIVE_FINISH command parameters + * + * @handle: handle of the VM to finish + */ +struct sev_data_receive_finish { + u32 handle; /* In */ +} __packed; + +/** + * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters + * + * @handle: handle of the VM to perform debug operation + * @src_addr: source address of data to operate on + * @dst_addr: destination address of data to operate on + * @len: len of data to operate on + */ +struct sev_data_dbg { + u32 handle; /* In */ + u32 reserved; + u64 src_addr; /* In */ + u64 dst_addr; /* In */ + u32 len; /* In */ +} __packed; + +#endif /* __PSP_SEV_H__ */