Lines Matching +full:bootloader +full:- +full:key
1 .. SPDX-License-Identifier: GPL-2.0
14 - Hypervisor ioctls: These query and set global attributes which affect the
17 - Guest ioctls: These query and set attributes of the SEV virtual machine.
27 which SEV technology provides this ioctl. SEV, SEV-ES, SEV-SNP or all.
37 the return value. General error numbers (-ENOMEM, -EINVAL)
40 The guest ioctl should be issued on a file descriptor of the /dev/sev-guest
44 the fw_error code will be set, otherwise fw_error will be set to -1.
48 counter (e.g. counter overflow), then -EIO will be returned.
60 /* bits[63:32]: VMM error code, bits[31:0] firmware error code (see psp-sev.h) */
82 /* Firmware error code on failure (see psp-sev.h) */
88 ------------------
90 :Technology: sev-snp
93 :Returns (out): struct snp_report_resp on success, -negative on error
96 SEV-SNP firmware. The ioctl uses the SNP_GUEST_REQUEST (MSG_REPORT_REQ) command
97 provided by the SEV-SNP firmware to query the attestation report.
100 contain the format described in the SEV-SNP specification. See the SEV-SNP
104 -----------------------
105 :Technology: sev-snp
108 :Returns (out): struct snp_derived_key_resp on success, -negative on error
110 The SNP_GET_DERIVED_KEY ioctl can be used to get a key derive from a root key.
111 The derived key can be used by the guest for any purpose, such as sealing keys
115 SEV-SNP firmware to derive the key. See SEV-SNP specification for further details
116 on the various fields passed in the key derivation request.
118 On success, the snp_derived_key_resp.data contains the derived key value. See
119 the SEV-SNP specification for further details.
123 ----------------------
124 :Technology: sev-snp
127 :Returns (out): struct snp_report_resp on success, -negative on error
134 The ioctl uses the SNP_GUEST_REQUEST (MSG_REPORT_REQ) command provided by the SEV-SNP
145 -----------------------
146 :Technology: sev-snp
149 :Returns (out): 0 on success, -negative on error
152 status includes API major, minor version and more. See the SEV-SNP
156 --------------
157 :Technology: sev-snp
159 :Returns (out): 0 on success, -negative on error
162 SEV-SNP firmware SNP_COMMIT command. This prevents roll-back to a previously
167 ------------------
168 :Technology: sev-snp
171 :Returns (out): 0 on success, -negative on error
173 SNP_SET_CONFIG is used to set the system-wide configuration such as
175 to SNP_CONFIG command defined in the SEV-SNP spec. The current values of
180 -----------------
181 :Technology: sev-snp
184 :Returns (out): 0 on success, -negative on error
188 Endorsement Key (VCEK), which is derived from chip-unique secrets, or a
189 Versioned Loaded Endorsement Key (VLEK) which is obtained from an AMD
190 Key Derivation Service (KDS) and derived from seeds allocated to
195 closely to the SNP_VLEK_LOAD firmware command specified in the SEV-SNP
198 3. SEV-SNP CPUID Enforcement
201 SEV-SNP guests can access a special page that contains a table of CPUID values
206 - Its address is obtained via bootloader/firmware (via CC blob), and those
207 binaries will be measured as part of the SEV-SNP attestation report.
208 - Its initial state will be encrypted/pvalidated, so attempts to modify
209 it during run-time will result in garbage being written, or #VC exceptions
212 - Attempts to bypass PSP checks by the hypervisor by using a normal page, or
213 a non-CPUID encrypted page will change the measurement provided by the
214 SEV-SNP attestation report.
215 - The CPUID page contents are *not* measured, but attempts to modify the
222 has taken care to make use of the SEV-SNP CPUID throughout all stages of boot.
226 4. SEV Guest Driver Communication Key
230 Processor (ASP, aka PSP) is protected by a VM Platform Communication Key
231 (VMPCK). By default, the sev-guest driver uses the VMPCK associated with the
232 VM Privilege Level (VMPL) at which the guest is running. Should this key be
233 wiped by the sev-guest driver (see the driver for reasons why a VMPCK can be
234 wiped), a different key can be used by reloading the sev-guest driver and
235 specifying the desired key using the vmpck_id module parameter.
239 ---------
241 SEV-SNP and GHCB specification: developer.amd.com/sev
243 The driver is based on SEV-SNP firmware spec 0.9 and GHCB spec version 2.0.