usb: uas: add support for more quirk flags
[platform/kernel/linux-rpi.git] / include / linux / psp-sev.h
1 /*
2  * AMD Secure Encrypted Virtualization (SEV) driver interface
3  *
4  * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
5  *
6  * Author: Brijesh Singh <brijesh.singh@amd.com>
7  *
8  * SEV spec 0.14 is available at:
9  * http://support.amd.com/TechDocs/55766_SEV-KM API_Specification.pdf
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License version 2 as
13  * published by the Free Software Foundation.
14  */
15
16 #ifndef __PSP_SEV_H__
17 #define __PSP_SEV_H__
18
19 #include <uapi/linux/psp-sev.h>
20
21 #ifdef CONFIG_X86
22 #include <linux/mem_encrypt.h>
23
24 #define __psp_pa(x)     __sme_pa(x)
25 #else
26 #define __psp_pa(x)     __pa(x)
27 #endif
28
29 #define SEV_FW_BLOB_MAX_SIZE    0x4000  /* 16KB */
30
31 /**
32  * SEV platform state
33  */
34 enum sev_state {
35         SEV_STATE_UNINIT                = 0x0,
36         SEV_STATE_INIT                  = 0x1,
37         SEV_STATE_WORKING               = 0x2,
38
39         SEV_STATE_MAX
40 };
41
42 /**
43  * SEV platform and guest management commands
44  */
45 enum sev_cmd {
46         /* platform commands */
47         SEV_CMD_INIT                    = 0x001,
48         SEV_CMD_SHUTDOWN                = 0x002,
49         SEV_CMD_FACTORY_RESET           = 0x003,
50         SEV_CMD_PLATFORM_STATUS         = 0x004,
51         SEV_CMD_PEK_GEN                 = 0x005,
52         SEV_CMD_PEK_CSR                 = 0x006,
53         SEV_CMD_PEK_CERT_IMPORT         = 0x007,
54         SEV_CMD_PDH_CERT_EXPORT         = 0x008,
55         SEV_CMD_PDH_GEN                 = 0x009,
56         SEV_CMD_DF_FLUSH                = 0x00A,
57         SEV_CMD_DOWNLOAD_FIRMWARE       = 0x00B,
58         SEV_CMD_GET_ID                  = 0x00C,
59
60         /* Guest commands */
61         SEV_CMD_DECOMMISSION            = 0x020,
62         SEV_CMD_ACTIVATE                = 0x021,
63         SEV_CMD_DEACTIVATE              = 0x022,
64         SEV_CMD_GUEST_STATUS            = 0x023,
65
66         /* Guest launch commands */
67         SEV_CMD_LAUNCH_START            = 0x030,
68         SEV_CMD_LAUNCH_UPDATE_DATA      = 0x031,
69         SEV_CMD_LAUNCH_UPDATE_VMSA      = 0x032,
70         SEV_CMD_LAUNCH_MEASURE          = 0x033,
71         SEV_CMD_LAUNCH_UPDATE_SECRET    = 0x034,
72         SEV_CMD_LAUNCH_FINISH           = 0x035,
73
74         /* Guest migration commands (outgoing) */
75         SEV_CMD_SEND_START              = 0x040,
76         SEV_CMD_SEND_UPDATE_DATA        = 0x041,
77         SEV_CMD_SEND_UPDATE_VMSA        = 0x042,
78         SEV_CMD_SEND_FINISH             = 0x043,
79
80         /* Guest migration commands (incoming) */
81         SEV_CMD_RECEIVE_START           = 0x050,
82         SEV_CMD_RECEIVE_UPDATE_DATA     = 0x051,
83         SEV_CMD_RECEIVE_UPDATE_VMSA     = 0x052,
84         SEV_CMD_RECEIVE_FINISH          = 0x053,
85
86         /* Guest debug commands */
87         SEV_CMD_DBG_DECRYPT             = 0x060,
88         SEV_CMD_DBG_ENCRYPT             = 0x061,
89
90         SEV_CMD_MAX,
91 };
92
93 /**
94  * struct sev_data_init - INIT command parameters
95  *
96  * @flags: processing flags
97  * @tmr_address: system physical address used for SEV-ES
98  * @tmr_len: len of tmr_address
99  */
100 struct sev_data_init {
101         u32 flags;                      /* In */
102         u32 reserved;                   /* In */
103         u64 tmr_address;                /* In */
104         u32 tmr_len;                    /* In */
105 } __packed;
106
107 /**
108  * struct sev_data_pek_csr - PEK_CSR command parameters
109  *
110  * @address: PEK certificate chain
111  * @len: len of certificate
112  */
113 struct sev_data_pek_csr {
114         u64 address;                            /* In */
115         u32 len;                                /* In/Out */
116 } __packed;
117
118 /**
119  * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
120  *
121  * @pek_address: PEK certificate chain
122  * @pek_len: len of PEK certificate
123  * @oca_address: OCA certificate chain
124  * @oca_len: len of OCA certificate
125  */
126 struct sev_data_pek_cert_import {
127         u64 pek_cert_address;                   /* In */
128         u32 pek_cert_len;                       /* In */
129         u32 reserved;                           /* In */
130         u64 oca_cert_address;                   /* In */
131         u32 oca_cert_len;                       /* In */
132 } __packed;
133
134 /**
135  * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
136  *
137  * @address: physical address of firmware image
138  * @len: len of the firmware image
139  */
140 struct sev_data_download_firmware {
141         u64 address;                            /* In */
142         u32 len;                                /* In */
143 } __packed;
144
145 /**
146  * struct sev_data_get_id - GET_ID command parameters
147  *
148  * @address: physical address of region to place unique CPU ID(s)
149  * @len: len of the region
150  */
151 struct sev_data_get_id {
152         u64 address;                            /* In */
153         u32 len;                                /* In/Out */
154 } __packed;
155 /**
156  * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
157  *
158  * @pdh_address: PDH certificate address
159  * @pdh_len: len of PDH certificate
160  * @cert_chain_address: PDH certificate chain
161  * @cert_chain_len: len of PDH certificate chain
162  */
163 struct sev_data_pdh_cert_export {
164         u64 pdh_cert_address;                   /* In */
165         u32 pdh_cert_len;                       /* In/Out */
166         u32 reserved;                           /* In */
167         u64 cert_chain_address;                 /* In */
168         u32 cert_chain_len;                     /* In/Out */
169 } __packed;
170
171 /**
172  * struct sev_data_decommission - DECOMMISSION command parameters
173  *
174  * @handle: handle of the VM to decommission
175  */
176 struct sev_data_decommission {
177         u32 handle;                             /* In */
178 } __packed;
179
180 /**
181  * struct sev_data_activate - ACTIVATE command parameters
182  *
183  * @handle: handle of the VM to activate
184  * @asid: asid assigned to the VM
185  */
186 struct sev_data_activate {
187         u32 handle;                             /* In */
188         u32 asid;                               /* In */
189 } __packed;
190
191 /**
192  * struct sev_data_deactivate - DEACTIVATE command parameters
193  *
194  * @handle: handle of the VM to deactivate
195  */
196 struct sev_data_deactivate {
197         u32 handle;                             /* In */
198 } __packed;
199
200 /**
201  * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
202  *
203  * @handle: handle of the VM to retrieve status
204  * @policy: policy information for the VM
205  * @asid: current ASID of the VM
206  * @state: current state of the VM
207  */
208 struct sev_data_guest_status {
209         u32 handle;                             /* In */
210         u32 policy;                             /* Out */
211         u32 asid;                               /* Out */
212         u8 state;                               /* Out */
213 } __packed;
214
215 /**
216  * struct sev_data_launch_start - LAUNCH_START command parameters
217  *
218  * @handle: handle assigned to the VM
219  * @policy: guest launch policy
220  * @dh_cert_address: physical address of DH certificate blob
221  * @dh_cert_len: len of DH certificate blob
222  * @session_address: physical address of session parameters
223  * @session_len: len of session parameters
224  */
225 struct sev_data_launch_start {
226         u32 handle;                             /* In/Out */
227         u32 policy;                             /* In */
228         u64 dh_cert_address;                    /* In */
229         u32 dh_cert_len;                        /* In */
230         u32 reserved;                           /* In */
231         u64 session_address;                    /* In */
232         u32 session_len;                        /* In */
233 } __packed;
234
235 /**
236  * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
237  *
238  * @handle: handle of the VM to update
239  * @len: len of memory to be encrypted
240  * @address: physical address of memory region to encrypt
241  */
242 struct sev_data_launch_update_data {
243         u32 handle;                             /* In */
244         u32 reserved;
245         u64 address;                            /* In */
246         u32 len;                                /* In */
247 } __packed;
248
249 /**
250  * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
251  *
252  * @handle: handle of the VM
253  * @address: physical address of memory region to encrypt
254  * @len: len of memory region to encrypt
255  */
256 struct sev_data_launch_update_vmsa {
257         u32 handle;                             /* In */
258         u32 reserved;
259         u64 address;                            /* In */
260         u32 len;                                /* In */
261 } __packed;
262
263 /**
264  * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
265  *
266  * @handle: handle of the VM to process
267  * @address: physical address containing the measurement blob
268  * @len: len of measurement blob
269  */
270 struct sev_data_launch_measure {
271         u32 handle;                             /* In */
272         u32 reserved;
273         u64 address;                            /* In */
274         u32 len;                                /* In/Out */
275 } __packed;
276
277 /**
278  * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
279  *
280  * @handle: handle of the VM to process
281  * @hdr_address: physical address containing the packet header
282  * @hdr_len: len of packet header
283  * @guest_address: system physical address of guest memory region
284  * @guest_len: len of guest_paddr
285  * @trans_address: physical address of transport memory buffer
286  * @trans_len: len of transport memory buffer
287  */
288 struct sev_data_launch_secret {
289         u32 handle;                             /* In */
290         u32 reserved1;
291         u64 hdr_address;                        /* In */
292         u32 hdr_len;                            /* In */
293         u32 reserved2;
294         u64 guest_address;                      /* In */
295         u32 guest_len;                          /* In */
296         u32 reserved3;
297         u64 trans_address;                      /* In */
298         u32 trans_len;                          /* In */
299 } __packed;
300
301 /**
302  * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
303  *
304  * @handle: handle of the VM to process
305  */
306 struct sev_data_launch_finish {
307         u32 handle;                             /* In */
308 } __packed;
309
310 /**
311  * struct sev_data_send_start - SEND_START command parameters
312  *
313  * @handle: handle of the VM to process
314  * @policy: policy information for the VM
315  * @pdh_cert_address: physical address containing PDH certificate
316  * @pdh_cert_len: len of PDH certificate
317  * @plat_certs_address: physical address containing platform certificate
318  * @plat_certs_len: len of platform certificate
319  * @amd_certs_address: physical address containing AMD certificate
320  * @amd_certs_len: len of AMD certificate
321  * @session_address: physical address containing Session data
322  * @session_len: len of session data
323  */
324 struct sev_data_send_start {
325         u32 handle;                             /* In */
326         u32 policy;                             /* Out */
327         u64 pdh_cert_address;                   /* In */
328         u32 pdh_cert_len;                       /* In */
329         u32 reserved1;
330         u64 plat_cert_address;                  /* In */
331         u32 plat_cert_len;                      /* In */
332         u32 reserved2;
333         u64 amd_cert_address;                   /* In */
334         u32 amd_cert_len;                       /* In */
335         u32 reserved3;
336         u64 session_address;                    /* In */
337         u32 session_len;                        /* In/Out */
338 } __packed;
339
340 /**
341  * struct sev_data_send_update - SEND_UPDATE_DATA command
342  *
343  * @handle: handle of the VM to process
344  * @hdr_address: physical address containing packet header
345  * @hdr_len: len of packet header
346  * @guest_address: physical address of guest memory region to send
347  * @guest_len: len of guest memory region to send
348  * @trans_address: physical address of host memory region
349  * @trans_len: len of host memory region
350  */
351 struct sev_data_send_update_data {
352         u32 handle;                             /* In */
353         u32 reserved1;
354         u64 hdr_address;                        /* In */
355         u32 hdr_len;                            /* In/Out */
356         u32 reserved2;
357         u64 guest_address;                      /* In */
358         u32 guest_len;                          /* In */
359         u32 reserved3;
360         u64 trans_address;                      /* In */
361         u32 trans_len;                          /* In */
362 } __packed;
363
364 /**
365  * struct sev_data_send_update - SEND_UPDATE_VMSA command
366  *
367  * @handle: handle of the VM to process
368  * @hdr_address: physical address containing packet header
369  * @hdr_len: len of packet header
370  * @guest_address: physical address of guest memory region to send
371  * @guest_len: len of guest memory region to send
372  * @trans_address: physical address of host memory region
373  * @trans_len: len of host memory region
374  */
375 struct sev_data_send_update_vmsa {
376         u32 handle;                             /* In */
377         u64 hdr_address;                        /* In */
378         u32 hdr_len;                            /* In/Out */
379         u32 reserved2;
380         u64 guest_address;                      /* In */
381         u32 guest_len;                          /* In */
382         u32 reserved3;
383         u64 trans_address;                      /* In */
384         u32 trans_len;                          /* In */
385 } __packed;
386
387 /**
388  * struct sev_data_send_finish - SEND_FINISH command parameters
389  *
390  * @handle: handle of the VM to process
391  */
392 struct sev_data_send_finish {
393         u32 handle;                             /* In */
394 } __packed;
395
396 /**
397  * struct sev_data_receive_start - RECEIVE_START command parameters
398  *
399  * @handle: handle of the VM to perform receive operation
400  * @pdh_cert_address: system physical address containing PDH certificate blob
401  * @pdh_cert_len: len of PDH certificate blob
402  * @session_address: system physical address containing session blob
403  * @session_len: len of session blob
404  */
405 struct sev_data_receive_start {
406         u32 handle;                             /* In/Out */
407         u32 policy;                             /* In */
408         u64 pdh_cert_address;                   /* In */
409         u32 pdh_cert_len;                       /* In */
410         u32 reserved1;
411         u64 session_address;                    /* In */
412         u32 session_len;                        /* In */
413 } __packed;
414
415 /**
416  * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
417  *
418  * @handle: handle of the VM to update
419  * @hdr_address: physical address containing packet header blob
420  * @hdr_len: len of packet header
421  * @guest_address: system physical address of guest memory region
422  * @guest_len: len of guest memory region
423  * @trans_address: system physical address of transport buffer
424  * @trans_len: len of transport buffer
425  */
426 struct sev_data_receive_update_data {
427         u32 handle;                             /* In */
428         u32 reserved1;
429         u64 hdr_address;                        /* In */
430         u32 hdr_len;                            /* In */
431         u32 reserved2;
432         u64 guest_address;                      /* In */
433         u32 guest_len;                          /* In */
434         u32 reserved3;
435         u64 trans_address;                      /* In */
436         u32 trans_len;                          /* In */
437 } __packed;
438
439 /**
440  * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
441  *
442  * @handle: handle of the VM to update
443  * @hdr_address: physical address containing packet header blob
444  * @hdr_len: len of packet header
445  * @guest_address: system physical address of guest memory region
446  * @guest_len: len of guest memory region
447  * @trans_address: system physical address of transport buffer
448  * @trans_len: len of transport buffer
449  */
450 struct sev_data_receive_update_vmsa {
451         u32 handle;                             /* In */
452         u32 reserved1;
453         u64 hdr_address;                        /* In */
454         u32 hdr_len;                            /* In */
455         u32 reserved2;
456         u64 guest_address;                      /* In */
457         u32 guest_len;                          /* In */
458         u32 reserved3;
459         u64 trans_address;                      /* In */
460         u32 trans_len;                          /* In */
461 } __packed;
462
463 /**
464  * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
465  *
466  * @handle: handle of the VM to finish
467  */
468 struct sev_data_receive_finish {
469         u32 handle;                             /* In */
470 } __packed;
471
472 /**
473  * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
474  *
475  * @handle: handle of the VM to perform debug operation
476  * @src_addr: source address of data to operate on
477  * @dst_addr: destination address of data to operate on
478  * @len: len of data to operate on
479  */
480 struct sev_data_dbg {
481         u32 handle;                             /* In */
482         u32 reserved;
483         u64 src_addr;                           /* In */
484         u64 dst_addr;                           /* In */
485         u32 len;                                /* In */
486 } __packed;
487
488 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
489
490 /**
491  * sev_platform_init - perform SEV INIT command
492  *
493  * @error: SEV command return code
494  *
495  * Returns:
496  * 0 if the SEV successfully processed the command
497  * -%ENODEV    if the SEV device is not available
498  * -%ENOTSUPP  if the SEV does not support SEV
499  * -%ETIMEDOUT if the SEV command timed out
500  * -%EIO       if the SEV returned a non-zero return code
501  */
502 int sev_platform_init(int *error);
503
504 /**
505  * sev_platform_status - perform SEV PLATFORM_STATUS command
506  *
507  * @status: sev_user_data_status structure to be processed
508  * @error: SEV command return code
509  *
510  * Returns:
511  * 0 if the SEV successfully processed the command
512  * -%ENODEV    if the SEV device is not available
513  * -%ENOTSUPP  if the SEV does not support SEV
514  * -%ETIMEDOUT if the SEV command timed out
515  * -%EIO       if the SEV returned a non-zero return code
516  */
517 int sev_platform_status(struct sev_user_data_status *status, int *error);
518
519 /**
520  * sev_issue_cmd_external_user - issue SEV command by other driver with a file
521  * handle.
522  *
523  * This function can be used by other drivers to issue a SEV command on
524  * behalf of userspace. The caller must pass a valid SEV file descriptor
525  * so that we know that it has access to SEV device.
526  *
527  * @filep - SEV device file pointer
528  * @cmd - command to issue
529  * @data - command buffer
530  * @error: SEV command return code
531  *
532  * Returns:
533  * 0 if the SEV successfully processed the command
534  * -%ENODEV    if the SEV device is not available
535  * -%ENOTSUPP  if the SEV does not support SEV
536  * -%ETIMEDOUT if the SEV command timed out
537  * -%EIO       if the SEV returned a non-zero return code
538  * -%EINVAL    if the SEV file descriptor is not valid
539  */
540 int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
541                                 void *data, int *error);
542
543 /**
544  * sev_guest_deactivate - perform SEV DEACTIVATE command
545  *
546  * @deactivate: sev_data_deactivate structure to be processed
547  * @sev_ret: sev command return code
548  *
549  * Returns:
550  * 0 if the sev successfully processed the command
551  * -%ENODEV    if the sev device is not available
552  * -%ENOTSUPP  if the sev does not support SEV
553  * -%ETIMEDOUT if the sev command timed out
554  * -%EIO       if the sev returned a non-zero return code
555  */
556 int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
557
558 /**
559  * sev_guest_activate - perform SEV ACTIVATE command
560  *
561  * @activate: sev_data_activate structure to be processed
562  * @sev_ret: sev command return code
563  *
564  * Returns:
565  * 0 if the sev successfully processed the command
566  * -%ENODEV    if the sev device is not available
567  * -%ENOTSUPP  if the sev does not support SEV
568  * -%ETIMEDOUT if the sev command timed out
569  * -%EIO       if the sev returned a non-zero return code
570  */
571 int sev_guest_activate(struct sev_data_activate *data, int *error);
572
573 /**
574  * sev_guest_df_flush - perform SEV DF_FLUSH command
575  *
576  * @sev_ret: sev command return code
577  *
578  * Returns:
579  * 0 if the sev successfully processed the command
580  * -%ENODEV    if the sev device is not available
581  * -%ENOTSUPP  if the sev does not support SEV
582  * -%ETIMEDOUT if the sev command timed out
583  * -%EIO       if the sev returned a non-zero return code
584  */
585 int sev_guest_df_flush(int *error);
586
587 /**
588  * sev_guest_decommission - perform SEV DECOMMISSION command
589  *
590  * @decommission: sev_data_decommission structure to be processed
591  * @sev_ret: sev command return code
592  *
593  * Returns:
594  * 0 if the sev successfully processed the command
595  * -%ENODEV    if the sev device is not available
596  * -%ENOTSUPP  if the sev does not support SEV
597  * -%ETIMEDOUT if the sev command timed out
598  * -%EIO       if the sev returned a non-zero return code
599  */
600 int sev_guest_decommission(struct sev_data_decommission *data, int *error);
601
602 void *psp_copy_user_blob(u64 __user uaddr, u32 len);
603
604 #else   /* !CONFIG_CRYPTO_DEV_SP_PSP */
605
606 static inline int
607 sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
608
609 static inline int sev_platform_init(int *error) { return -ENODEV; }
610
611 static inline int
612 sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
613
614 static inline int
615 sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
616
617 static inline int
618 sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
619
620 static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
621
622 static inline int
623 sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
624
625 static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
626
627 #endif  /* CONFIG_CRYPTO_DEV_SP_PSP */
628
629 #endif  /* __PSP_SEV_H__ */