1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * AMD Secure Encrypted Virtualization (SEV) driver interface
4 *
5 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
6 *
7 * Author: Brijesh Singh <brijesh.singh@amd.com>
8 *
9 * SEV API spec is available at https://developer.amd.com/sev
10 */
11
12 #ifndef __PSP_SEV_H__
13 #define __PSP_SEV_H__
14
15 #include <uapi/linux/psp-sev.h>
16
17 #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
18
19 /**
20 * SEV platform state
21 */
22 enum sev_state {
23 SEV_STATE_UNINIT = 0x0,
24 SEV_STATE_INIT = 0x1,
25 SEV_STATE_WORKING = 0x2,
26
27 SEV_STATE_MAX
28 };
29
30 /**
31 * SEV platform and guest management commands
32 */
33 enum sev_cmd {
34 /* platform commands */
35 SEV_CMD_INIT = 0x001,
36 SEV_CMD_SHUTDOWN = 0x002,
37 SEV_CMD_FACTORY_RESET = 0x003,
38 SEV_CMD_PLATFORM_STATUS = 0x004,
39 SEV_CMD_PEK_GEN = 0x005,
40 SEV_CMD_PEK_CSR = 0x006,
41 SEV_CMD_PEK_CERT_IMPORT = 0x007,
42 SEV_CMD_PDH_CERT_EXPORT = 0x008,
43 SEV_CMD_PDH_GEN = 0x009,
44 SEV_CMD_DF_FLUSH = 0x00A,
45 SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
46 SEV_CMD_GET_ID = 0x00C,
47 SEV_CMD_INIT_EX = 0x00D,
48
49 /* Guest commands */
50 SEV_CMD_DECOMMISSION = 0x020,
51 SEV_CMD_ACTIVATE = 0x021,
52 SEV_CMD_DEACTIVATE = 0x022,
53 SEV_CMD_GUEST_STATUS = 0x023,
54
55 /* Guest launch commands */
56 SEV_CMD_LAUNCH_START = 0x030,
57 SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
58 SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
59 SEV_CMD_LAUNCH_MEASURE = 0x033,
60 SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
61 SEV_CMD_LAUNCH_FINISH = 0x035,
62 SEV_CMD_ATTESTATION_REPORT = 0x036,
63
64 /* Guest migration commands (outgoing) */
65 SEV_CMD_SEND_START = 0x040,
66 SEV_CMD_SEND_UPDATE_DATA = 0x041,
67 SEV_CMD_SEND_UPDATE_VMSA = 0x042,
68 SEV_CMD_SEND_FINISH = 0x043,
69 SEV_CMD_SEND_CANCEL = 0x044,
70
71 /* Guest migration commands (incoming) */
72 SEV_CMD_RECEIVE_START = 0x050,
73 SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
74 SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
75 SEV_CMD_RECEIVE_FINISH = 0x053,
76
77 /* Guest debug commands */
78 SEV_CMD_DBG_DECRYPT = 0x060,
79 SEV_CMD_DBG_ENCRYPT = 0x061,
80
81 /* SNP specific commands */
82 SEV_CMD_SNP_INIT = 0x081,
83 SEV_CMD_SNP_SHUTDOWN = 0x082,
84 SEV_CMD_SNP_PLATFORM_STATUS = 0x083,
85 SEV_CMD_SNP_DF_FLUSH = 0x084,
86 SEV_CMD_SNP_INIT_EX = 0x085,
87 SEV_CMD_SNP_SHUTDOWN_EX = 0x086,
88 SEV_CMD_SNP_DECOMMISSION = 0x090,
89 SEV_CMD_SNP_ACTIVATE = 0x091,
90 SEV_CMD_SNP_GUEST_STATUS = 0x092,
91 SEV_CMD_SNP_GCTX_CREATE = 0x093,
92 SEV_CMD_SNP_GUEST_REQUEST = 0x094,
93 SEV_CMD_SNP_ACTIVATE_EX = 0x095,
94 SEV_CMD_SNP_LAUNCH_START = 0x0A0,
95 SEV_CMD_SNP_LAUNCH_UPDATE = 0x0A1,
96 SEV_CMD_SNP_LAUNCH_FINISH = 0x0A2,
97 SEV_CMD_SNP_DBG_DECRYPT = 0x0B0,
98 SEV_CMD_SNP_DBG_ENCRYPT = 0x0B1,
99 SEV_CMD_SNP_PAGE_SWAP_OUT = 0x0C0,
100 SEV_CMD_SNP_PAGE_SWAP_IN = 0x0C1,
101 SEV_CMD_SNP_PAGE_MOVE = 0x0C2,
102 SEV_CMD_SNP_PAGE_MD_INIT = 0x0C3,
103 SEV_CMD_SNP_PAGE_SET_STATE = 0x0C6,
104 SEV_CMD_SNP_PAGE_RECLAIM = 0x0C7,
105 SEV_CMD_SNP_PAGE_UNSMASH = 0x0C8,
106 SEV_CMD_SNP_CONFIG = 0x0C9,
107 SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX = 0x0CA,
108 SEV_CMD_SNP_COMMIT = 0x0CB,
109 SEV_CMD_SNP_VLEK_LOAD = 0x0CD,
110
111 SEV_CMD_MAX,
112 };
113
114 /**
115 * struct sev_data_init - INIT command parameters
116 *
117 * @flags: processing flags
118 * @tmr_address: system physical address used for SEV-ES
119 * @tmr_len: len of tmr_address
120 */
121 struct sev_data_init {
122 u32 flags; /* In */
123 u32 reserved; /* In */
124 u64 tmr_address; /* In */
125 u32 tmr_len; /* In */
126 } __packed;
127
128 /**
129 * struct sev_data_init_ex - INIT_EX command parameters
130 *
131 * @length: len of the command buffer read by the PSP
132 * @flags: processing flags
133 * @tmr_address: system physical address used for SEV-ES
134 * @tmr_len: len of tmr_address
135 * @nv_address: system physical address used for PSP NV storage
136 * @nv_len: len of nv_address
137 */
138 struct sev_data_init_ex {
139 u32 length; /* In */
140 u32 flags; /* In */
141 u64 tmr_address; /* In */
142 u32 tmr_len; /* In */
143 u32 reserved; /* In */
144 u64 nv_address; /* In/Out */
145 u32 nv_len; /* In */
146 } __packed;
147
148 #define SEV_INIT_FLAGS_SEV_ES 0x01
149
150 /**
151 * struct sev_data_pek_csr - PEK_CSR command parameters
152 *
153 * @address: PEK certificate chain
154 * @len: len of certificate
155 */
156 struct sev_data_pek_csr {
157 u64 address; /* In */
158 u32 len; /* In/Out */
159 } __packed;
160
161 /**
162 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
163 *
164 * @pek_address: PEK certificate chain
165 * @pek_len: len of PEK certificate
166 * @oca_address: OCA certificate chain
167 * @oca_len: len of OCA certificate
168 */
169 struct sev_data_pek_cert_import {
170 u64 pek_cert_address; /* In */
171 u32 pek_cert_len; /* In */
172 u32 reserved; /* In */
173 u64 oca_cert_address; /* In */
174 u32 oca_cert_len; /* In */
175 } __packed;
176
177 /**
178 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
179 *
180 * @address: physical address of firmware image
181 * @len: len of the firmware image
182 */
183 struct sev_data_download_firmware {
184 u64 address; /* In */
185 u32 len; /* In */
186 } __packed;
187
188 /**
189 * struct sev_data_get_id - GET_ID command parameters
190 *
191 * @address: physical address of region to place unique CPU ID(s)
192 * @len: len of the region
193 */
194 struct sev_data_get_id {
195 u64 address; /* In */
196 u32 len; /* In/Out */
197 } __packed;
198 /**
199 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
200 *
201 * @pdh_address: PDH certificate address
202 * @pdh_len: len of PDH certificate
203 * @cert_chain_address: PDH certificate chain
204 * @cert_chain_len: len of PDH certificate chain
205 */
206 struct sev_data_pdh_cert_export {
207 u64 pdh_cert_address; /* In */
208 u32 pdh_cert_len; /* In/Out */
209 u32 reserved; /* In */
210 u64 cert_chain_address; /* In */
211 u32 cert_chain_len; /* In/Out */
212 } __packed;
213
214 /**
215 * struct sev_data_decommission - DECOMMISSION command parameters
216 *
217 * @handle: handle of the VM to decommission
218 */
219 struct sev_data_decommission {
220 u32 handle; /* In */
221 } __packed;
222
223 /**
224 * struct sev_data_activate - ACTIVATE command parameters
225 *
226 * @handle: handle of the VM to activate
227 * @asid: asid assigned to the VM
228 */
229 struct sev_data_activate {
230 u32 handle; /* In */
231 u32 asid; /* In */
232 } __packed;
233
234 /**
235 * struct sev_data_deactivate - DEACTIVATE command parameters
236 *
237 * @handle: handle of the VM to deactivate
238 */
239 struct sev_data_deactivate {
240 u32 handle; /* In */
241 } __packed;
242
243 /**
244 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
245 *
246 * @handle: handle of the VM to retrieve status
247 * @policy: policy information for the VM
248 * @asid: current ASID of the VM
249 * @state: current state of the VM
250 */
251 struct sev_data_guest_status {
252 u32 handle; /* In */
253 u32 policy; /* Out */
254 u32 asid; /* Out */
255 u8 state; /* Out */
256 } __packed;
257
258 /**
259 * struct sev_data_launch_start - LAUNCH_START command parameters
260 *
261 * @handle: handle assigned to the VM
262 * @policy: guest launch policy
263 * @dh_cert_address: physical address of DH certificate blob
264 * @dh_cert_len: len of DH certificate blob
265 * @session_address: physical address of session parameters
266 * @session_len: len of session parameters
267 */
268 struct sev_data_launch_start {
269 u32 handle; /* In/Out */
270 u32 policy; /* In */
271 u64 dh_cert_address; /* In */
272 u32 dh_cert_len; /* In */
273 u32 reserved; /* In */
274 u64 session_address; /* In */
275 u32 session_len; /* In */
276 } __packed;
277
278 /**
279 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
280 *
281 * @handle: handle of the VM to update
282 * @len: len of memory to be encrypted
283 * @address: physical address of memory region to encrypt
284 */
285 struct sev_data_launch_update_data {
286 u32 handle; /* In */
287 u32 reserved;
288 u64 address; /* In */
289 u32 len; /* In */
290 } __packed;
291
292 /**
293 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
294 *
295 * @handle: handle of the VM
296 * @address: physical address of memory region to encrypt
297 * @len: len of memory region to encrypt
298 */
299 struct sev_data_launch_update_vmsa {
300 u32 handle; /* In */
301 u32 reserved;
302 u64 address; /* In */
303 u32 len; /* In */
304 } __packed;
305
306 /**
307 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
308 *
309 * @handle: handle of the VM to process
310 * @address: physical address containing the measurement blob
311 * @len: len of measurement blob
312 */
313 struct sev_data_launch_measure {
314 u32 handle; /* In */
315 u32 reserved;
316 u64 address; /* In */
317 u32 len; /* In/Out */
318 } __packed;
319
320 /**
321 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
322 *
323 * @handle: handle of the VM to process
324 * @hdr_address: physical address containing the packet header
325 * @hdr_len: len of packet header
326 * @guest_address: system physical address of guest memory region
327 * @guest_len: len of guest_paddr
328 * @trans_address: physical address of transport memory buffer
329 * @trans_len: len of transport memory buffer
330 */
331 struct sev_data_launch_secret {
332 u32 handle; /* In */
333 u32 reserved1;
334 u64 hdr_address; /* In */
335 u32 hdr_len; /* In */
336 u32 reserved2;
337 u64 guest_address; /* In */
338 u32 guest_len; /* In */
339 u32 reserved3;
340 u64 trans_address; /* In */
341 u32 trans_len; /* In */
342 } __packed;
343
344 /**
345 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
346 *
347 * @handle: handle of the VM to process
348 */
349 struct sev_data_launch_finish {
350 u32 handle; /* In */
351 } __packed;
352
353 /**
354 * struct sev_data_send_start - SEND_START command parameters
355 *
356 * @handle: handle of the VM to process
357 * @policy: policy information for the VM
358 * @pdh_cert_address: physical address containing PDH certificate
359 * @pdh_cert_len: len of PDH certificate
360 * @plat_certs_address: physical address containing platform certificate
361 * @plat_certs_len: len of platform certificate
362 * @amd_certs_address: physical address containing AMD certificate
363 * @amd_certs_len: len of AMD certificate
364 * @session_address: physical address containing Session data
365 * @session_len: len of session data
366 */
367 struct sev_data_send_start {
368 u32 handle; /* In */
369 u32 policy; /* Out */
370 u64 pdh_cert_address; /* In */
371 u32 pdh_cert_len; /* In */
372 u32 reserved1;
373 u64 plat_certs_address; /* In */
374 u32 plat_certs_len; /* In */
375 u32 reserved2;
376 u64 amd_certs_address; /* In */
377 u32 amd_certs_len; /* In */
378 u32 reserved3;
379 u64 session_address; /* In */
380 u32 session_len; /* In/Out */
381 } __packed;
382
383 /**
384 * struct sev_data_send_update - SEND_UPDATE_DATA command
385 *
386 * @handle: handle of the VM to process
387 * @hdr_address: physical address containing packet header
388 * @hdr_len: len of packet header
389 * @guest_address: physical address of guest memory region to send
390 * @guest_len: len of guest memory region to send
391 * @trans_address: physical address of host memory region
392 * @trans_len: len of host memory region
393 */
394 struct sev_data_send_update_data {
395 u32 handle; /* In */
396 u32 reserved1;
397 u64 hdr_address; /* In */
398 u32 hdr_len; /* In/Out */
399 u32 reserved2;
400 u64 guest_address; /* In */
401 u32 guest_len; /* In */
402 u32 reserved3;
403 u64 trans_address; /* In */
404 u32 trans_len; /* In */
405 } __packed;
406
407 /**
408 * struct sev_data_send_update - SEND_UPDATE_VMSA command
409 *
410 * @handle: handle of the VM to process
411 * @hdr_address: physical address containing packet header
412 * @hdr_len: len of packet header
413 * @guest_address: physical address of guest memory region to send
414 * @guest_len: len of guest memory region to send
415 * @trans_address: physical address of host memory region
416 * @trans_len: len of host memory region
417 */
418 struct sev_data_send_update_vmsa {
419 u32 handle; /* In */
420 u64 hdr_address; /* In */
421 u32 hdr_len; /* In/Out */
422 u32 reserved2;
423 u64 guest_address; /* In */
424 u32 guest_len; /* In */
425 u32 reserved3;
426 u64 trans_address; /* In */
427 u32 trans_len; /* In */
428 } __packed;
429
430 /**
431 * struct sev_data_send_finish - SEND_FINISH command parameters
432 *
433 * @handle: handle of the VM to process
434 */
435 struct sev_data_send_finish {
436 u32 handle; /* In */
437 } __packed;
438
439 /**
440 * struct sev_data_send_cancel - SEND_CANCEL command parameters
441 *
442 * @handle: handle of the VM to process
443 */
444 struct sev_data_send_cancel {
445 u32 handle; /* In */
446 } __packed;
447
448 /**
449 * struct sev_data_receive_start - RECEIVE_START command parameters
450 *
451 * @handle: handle of the VM to perform receive operation
452 * @pdh_cert_address: system physical address containing PDH certificate blob
453 * @pdh_cert_len: len of PDH certificate blob
454 * @session_address: system physical address containing session blob
455 * @session_len: len of session blob
456 */
457 struct sev_data_receive_start {
458 u32 handle; /* In/Out */
459 u32 policy; /* In */
460 u64 pdh_cert_address; /* In */
461 u32 pdh_cert_len; /* In */
462 u32 reserved1;
463 u64 session_address; /* In */
464 u32 session_len; /* In */
465 } __packed;
466
467 /**
468 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
469 *
470 * @handle: handle of the VM to update
471 * @hdr_address: physical address containing packet header blob
472 * @hdr_len: len of packet header
473 * @guest_address: system physical address of guest memory region
474 * @guest_len: len of guest memory region
475 * @trans_address: system physical address of transport buffer
476 * @trans_len: len of transport buffer
477 */
478 struct sev_data_receive_update_data {
479 u32 handle; /* In */
480 u32 reserved1;
481 u64 hdr_address; /* In */
482 u32 hdr_len; /* In */
483 u32 reserved2;
484 u64 guest_address; /* In */
485 u32 guest_len; /* In */
486 u32 reserved3;
487 u64 trans_address; /* In */
488 u32 trans_len; /* In */
489 } __packed;
490
491 /**
492 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
493 *
494 * @handle: handle of the VM to update
495 * @hdr_address: physical address containing packet header blob
496 * @hdr_len: len of packet header
497 * @guest_address: system physical address of guest memory region
498 * @guest_len: len of guest memory region
499 * @trans_address: system physical address of transport buffer
500 * @trans_len: len of transport buffer
501 */
502 struct sev_data_receive_update_vmsa {
503 u32 handle; /* In */
504 u32 reserved1;
505 u64 hdr_address; /* In */
506 u32 hdr_len; /* In */
507 u32 reserved2;
508 u64 guest_address; /* In */
509 u32 guest_len; /* In */
510 u32 reserved3;
511 u64 trans_address; /* In */
512 u32 trans_len; /* In */
513 } __packed;
514
515 /**
516 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
517 *
518 * @handle: handle of the VM to finish
519 */
520 struct sev_data_receive_finish {
521 u32 handle; /* In */
522 } __packed;
523
524 /**
525 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
526 *
527 * @handle: handle of the VM to perform debug operation
528 * @src_addr: source address of data to operate on
529 * @dst_addr: destination address of data to operate on
530 * @len: len of data to operate on
531 */
532 struct sev_data_dbg {
533 u32 handle; /* In */
534 u32 reserved;
535 u64 src_addr; /* In */
536 u64 dst_addr; /* In */
537 u32 len; /* In */
538 } __packed;
539
540 /**
541 * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters
542 *
543 * @handle: handle of the VM
544 * @mnonce: a random nonce that will be included in the report.
545 * @address: physical address where the report will be copied.
546 * @len: length of the physical buffer.
547 */
548 struct sev_data_attestation_report {
549 u32 handle; /* In */
550 u32 reserved;
551 u64 address; /* In */
552 u8 mnonce[16]; /* In */
553 u32 len; /* In/Out */
554 } __packed;
555
556 /**
557 * struct sev_data_snp_download_firmware - SNP_DOWNLOAD_FIRMWARE command params
558 *
559 * @address: physical address of firmware image
560 * @len: length of the firmware image
561 */
562 struct sev_data_snp_download_firmware {
563 u64 address; /* In */
564 u32 len; /* In */
565 } __packed;
566
567 /**
568 * struct sev_data_snp_activate - SNP_ACTIVATE command params
569 *
570 * @gctx_paddr: system physical address guest context page
571 * @asid: ASID to bind to the guest
572 */
573 struct sev_data_snp_activate {
574 u64 gctx_paddr; /* In */
575 u32 asid; /* In */
576 } __packed;
577
578 /**
579 * struct sev_data_snp_addr - generic SNP command params
580 *
581 * @address: physical address of generic data param
582 */
583 struct sev_data_snp_addr {
584 u64 address; /* In/Out */
585 } __packed;
586
587 /**
588 * struct sev_data_snp_launch_start - SNP_LAUNCH_START command params
589 *
590 * @gctx_paddr: system physical address of guest context page
591 * @policy: guest policy
592 * @ma_gctx_paddr: system physical address of migration agent
593 * @ma_en: the guest is associated with a migration agent
594 * @imi_en: launch flow is launching an IMI (Incoming Migration Image) for the
595 * purpose of guest-assisted migration.
596 * @rsvd: reserved
597 * @desired_tsc_khz: hypervisor desired mean TSC freq in kHz of the guest
598 * @gosvw: guest OS-visible workarounds, as defined by hypervisor
599 */
600 struct sev_data_snp_launch_start {
601 u64 gctx_paddr; /* In */
602 u64 policy; /* In */
603 u64 ma_gctx_paddr; /* In */
604 u32 ma_en:1; /* In */
605 u32 imi_en:1; /* In */
606 u32 rsvd:30;
607 u32 desired_tsc_khz; /* In */
608 u8 gosvw[16]; /* In */
609 } __packed;
610
611 /* SNP support page type */
612 enum {
613 SNP_PAGE_TYPE_NORMAL = 0x1,
614 SNP_PAGE_TYPE_VMSA = 0x2,
615 SNP_PAGE_TYPE_ZERO = 0x3,
616 SNP_PAGE_TYPE_UNMEASURED = 0x4,
617 SNP_PAGE_TYPE_SECRET = 0x5,
618 SNP_PAGE_TYPE_CPUID = 0x6,
619
620 SNP_PAGE_TYPE_MAX
621 };
622
623 /**
624 * struct sev_data_snp_launch_update - SNP_LAUNCH_UPDATE command params
625 *
626 * @gctx_paddr: system physical address of guest context page
627 * @page_size: page size 0 indicates 4K and 1 indicates 2MB page
628 * @page_type: encoded page type
629 * @imi_page: indicates that this page is part of the IMI (Incoming Migration
630 * Image) of the guest
631 * @rsvd: reserved
632 * @rsvd2: reserved
633 * @address: system physical address of destination page to encrypt
634 * @rsvd3: reserved
635 * @vmpl1_perms: VMPL permission mask for VMPL1
636 * @vmpl2_perms: VMPL permission mask for VMPL2
637 * @vmpl3_perms: VMPL permission mask for VMPL3
638 * @rsvd4: reserved
639 */
640 struct sev_data_snp_launch_update {
641 u64 gctx_paddr; /* In */
642 u32 page_size:1; /* In */
643 u32 page_type:3; /* In */
644 u32 imi_page:1; /* In */
645 u32 rsvd:27;
646 u32 rsvd2;
647 u64 address; /* In */
648 u32 rsvd3:8;
649 u32 vmpl1_perms:8; /* In */
650 u32 vmpl2_perms:8; /* In */
651 u32 vmpl3_perms:8; /* In */
652 u32 rsvd4;
653 } __packed;
654
655 /**
656 * struct sev_data_snp_launch_finish - SNP_LAUNCH_FINISH command params
657 *
658 * @gctx_paddr: system physical address of guest context page
659 * @id_block_paddr: system physical address of ID block
660 * @id_auth_paddr: system physical address of ID block authentication structure
661 * @id_block_en: indicates whether ID block is present
662 * @auth_key_en: indicates whether author key is present in authentication structure
663 * @vcek_disabled: indicates whether use of VCEK is allowed for attestation reports
664 * @rsvd: reserved
665 * @host_data: host-supplied data for guest, not interpreted by firmware
666 */
667 struct sev_data_snp_launch_finish {
668 u64 gctx_paddr;
669 u64 id_block_paddr;
670 u64 id_auth_paddr;
671 u8 id_block_en:1;
672 u8 auth_key_en:1;
673 u8 vcek_disabled:1;
674 u64 rsvd:61;
675 u8 host_data[32];
676 } __packed;
677
678 /**
679 * struct sev_data_snp_guest_status - SNP_GUEST_STATUS command params
680 *
681 * @gctx_paddr: system physical address of guest context page
682 * @address: system physical address of guest status page
683 */
684 struct sev_data_snp_guest_status {
685 u64 gctx_paddr;
686 u64 address;
687 } __packed;
688
689 /**
690 * struct sev_data_snp_page_reclaim - SNP_PAGE_RECLAIM command params
691 *
692 * @paddr: system physical address of page to be claimed. The 0th bit in the
693 * address indicates the page size. 0h indicates 4KB and 1h indicates
694 * 2MB page.
695 */
696 struct sev_data_snp_page_reclaim {
697 u64 paddr;
698 } __packed;
699
700 /**
701 * struct sev_data_snp_page_unsmash - SNP_PAGE_UNSMASH command params
702 *
703 * @paddr: system physical address of page to be unsmashed. The 0th bit in the
704 * address indicates the page size. 0h indicates 4 KB and 1h indicates
705 * 2 MB page.
706 */
707 struct sev_data_snp_page_unsmash {
708 u64 paddr;
709 } __packed;
710
711 /**
712 * struct sev_data_snp_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
713 *
714 * @gctx_paddr: system physical address of guest context page
715 * @src_addr: source address of data to operate on
716 * @dst_addr: destination address of data to operate on
717 */
718 struct sev_data_snp_dbg {
719 u64 gctx_paddr; /* In */
720 u64 src_addr; /* In */
721 u64 dst_addr; /* In */
722 } __packed;
723
724 /**
725 * struct sev_data_snp_guest_request - SNP_GUEST_REQUEST command params
726 *
727 * @gctx_paddr: system physical address of guest context page
728 * @req_paddr: system physical address of request page
729 * @res_paddr: system physical address of response page
730 */
731 struct sev_data_snp_guest_request {
732 u64 gctx_paddr; /* In */
733 u64 req_paddr; /* In */
734 u64 res_paddr; /* In */
735 } __packed;
736
737 /**
738 * struct sev_data_snp_init_ex - SNP_INIT_EX structure
739 *
740 * @init_rmp: indicate that the RMP should be initialized.
741 * @list_paddr_en: indicate that list_paddr is valid
742 * @rsvd: reserved
743 * @rsvd1: reserved
744 * @list_paddr: system physical address of range list
745 * @rsvd2: reserved
746 */
747 struct sev_data_snp_init_ex {
748 u32 init_rmp:1;
749 u32 list_paddr_en:1;
750 u32 rsvd:30;
751 u32 rsvd1;
752 u64 list_paddr;
753 u8 rsvd2[48];
754 } __packed;
755
756 /**
757 * struct sev_data_range - RANGE structure
758 *
759 * @base: system physical address of first byte of range
760 * @page_count: number of 4KB pages in this range
761 * @rsvd: reserved
762 */
763 struct sev_data_range {
764 u64 base;
765 u32 page_count;
766 u32 rsvd;
767 } __packed;
768
769 /**
770 * struct sev_data_range_list - RANGE_LIST structure
771 *
772 * @num_elements: number of elements in RANGE_ARRAY
773 * @rsvd: reserved
774 * @ranges: array of num_elements of type RANGE
775 */
776 struct sev_data_range_list {
777 u32 num_elements;
778 u32 rsvd;
779 struct sev_data_range ranges[];
780 } __packed;
781
782 /**
783 * struct sev_data_snp_shutdown_ex - SNP_SHUTDOWN_EX structure
784 *
785 * @len: length of the command buffer read by the PSP
786 * @iommu_snp_shutdown: Disable enforcement of SNP in the IOMMU
787 * @rsvd1: reserved
788 */
789 struct sev_data_snp_shutdown_ex {
790 u32 len;
791 u32 iommu_snp_shutdown:1;
792 u32 rsvd1:31;
793 } __packed;
794
795 /**
796 * struct sev_platform_init_args
797 *
798 * @error: SEV firmware error code
799 * @probe: True if this is being called as part of CCP module probe, which
800 * will defer SEV_INIT/SEV_INIT_EX firmware initialization until needed
801 * unless psp_init_on_probe module param is set
802 */
803 struct sev_platform_init_args {
804 int error;
805 bool probe;
806 };
807
808 /**
809 * struct sev_data_snp_commit - SNP_COMMIT structure
810 *
811 * @len: length of the command buffer read by the PSP
812 */
813 struct sev_data_snp_commit {
814 u32 len;
815 } __packed;
816
817 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
818
819 /**
820 * sev_module_init - perform PSP SEV module initialization
821 *
822 * Returns:
823 * 0 if the PSP module is successfully initialized
824 * negative value if the PSP module initialization fails
825 */
826 int sev_module_init(void);
827
828 /**
829 * sev_platform_init - perform SEV INIT command
830 *
831 * @args: struct sev_platform_init_args to pass in arguments
832 *
833 * Returns:
834 * 0 if the SEV successfully processed the command
835 * -%ENODEV if the SEV device is not available
836 * -%ENOTSUPP if the SEV does not support SEV
837 * -%ETIMEDOUT if the SEV command timed out
838 * -%EIO if the SEV returned a non-zero return code
839 */
840 int sev_platform_init(struct sev_platform_init_args *args);
841
842 /**
843 * sev_platform_status - perform SEV PLATFORM_STATUS command
844 *
845 * @status: sev_user_data_status structure to be processed
846 * @error: SEV command return code
847 *
848 * Returns:
849 * 0 if the SEV successfully processed the command
850 * -%ENODEV if the SEV device is not available
851 * -%ENOTSUPP if the SEV does not support SEV
852 * -%ETIMEDOUT if the SEV command timed out
853 * -%EIO if the SEV returned a non-zero return code
854 */
855 int sev_platform_status(struct sev_user_data_status *status, int *error);
856
857 /**
858 * sev_issue_cmd_external_user - issue SEV command by other driver with a file
859 * handle.
860 *
861 * This function can be used by other drivers to issue a SEV command on
862 * behalf of userspace. The caller must pass a valid SEV file descriptor
863 * so that we know that it has access to SEV device.
864 *
865 * @filep - SEV device file pointer
866 * @cmd - command to issue
867 * @data - command buffer
868 * @error: SEV command return code
869 *
870 * Returns:
871 * 0 if the SEV successfully processed the command
872 * -%ENODEV if the SEV device is not available
873 * -%ENOTSUPP if the SEV does not support SEV
874 * -%ETIMEDOUT if the SEV command timed out
875 * -%EIO if the SEV returned a non-zero return code
876 * -%EINVAL if the SEV file descriptor is not valid
877 */
878 int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
879 void *data, int *error);
880
881 /**
882 * sev_guest_deactivate - perform SEV DEACTIVATE command
883 *
884 * @deactivate: sev_data_deactivate structure to be processed
885 * @sev_ret: sev command return code
886 *
887 * Returns:
888 * 0 if the sev successfully processed the command
889 * -%ENODEV if the sev device is not available
890 * -%ENOTSUPP if the sev does not support SEV
891 * -%ETIMEDOUT if the sev command timed out
892 * -%EIO if the sev returned a non-zero return code
893 */
894 int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
895
896 /**
897 * sev_guest_activate - perform SEV ACTIVATE command
898 *
899 * @activate: sev_data_activate structure to be processed
900 * @sev_ret: sev command return code
901 *
902 * Returns:
903 * 0 if the sev successfully processed the command
904 * -%ENODEV if the sev device is not available
905 * -%ENOTSUPP if the sev does not support SEV
906 * -%ETIMEDOUT if the sev command timed out
907 * -%EIO if the sev returned a non-zero return code
908 */
909 int sev_guest_activate(struct sev_data_activate *data, int *error);
910
911 /**
912 * sev_guest_df_flush - perform SEV DF_FLUSH command
913 *
914 * @sev_ret: sev command return code
915 *
916 * Returns:
917 * 0 if the sev successfully processed the command
918 * -%ENODEV if the sev device is not available
919 * -%ENOTSUPP if the sev does not support SEV
920 * -%ETIMEDOUT if the sev command timed out
921 * -%EIO if the sev returned a non-zero return code
922 */
923 int sev_guest_df_flush(int *error);
924
925 /**
926 * sev_guest_decommission - perform SEV DECOMMISSION command
927 *
928 * @decommission: sev_data_decommission structure to be processed
929 * @sev_ret: sev command return code
930 *
931 * Returns:
932 * 0 if the sev successfully processed the command
933 * -%ENODEV if the sev device is not available
934 * -%ENOTSUPP if the sev does not support SEV
935 * -%ETIMEDOUT if the sev command timed out
936 * -%EIO if the sev returned a non-zero return code
937 */
938 int sev_guest_decommission(struct sev_data_decommission *data, int *error);
939
940 /**
941 * sev_do_cmd - issue an SEV or an SEV-SNP command
942 *
943 * @cmd: SEV or SEV-SNP firmware command to issue
944 * @data: arguments for firmware command
945 * @psp_ret: SEV command return code
946 *
947 * Returns:
948 * 0 if the SEV device successfully processed the command
949 * -%ENODEV if the PSP device is not available
950 * -%ENOTSUPP if PSP device does not support SEV
951 * -%ETIMEDOUT if the SEV command timed out
952 * -%EIO if PSP device returned a non-zero return code
953 */
954 int sev_do_cmd(int cmd, void *data, int *psp_ret);
955
956 void *psp_copy_user_blob(u64 uaddr, u32 len);
957 void *snp_alloc_firmware_page(gfp_t mask);
958 void snp_free_firmware_page(void *addr);
959 void sev_platform_shutdown(void);
960
961 #else /* !CONFIG_CRYPTO_DEV_SP_PSP */
962
963 static inline int
sev_platform_status(struct sev_user_data_status * status,int * error)964 sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
965
sev_platform_init(struct sev_platform_init_args * args)966 static inline int sev_platform_init(struct sev_platform_init_args *args) { return -ENODEV; }
967
968 static inline int
sev_guest_deactivate(struct sev_data_deactivate * data,int * error)969 sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
970
971 static inline int
sev_guest_decommission(struct sev_data_decommission * data,int * error)972 sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
973
974 static inline int
sev_do_cmd(int cmd,void * data,int * psp_ret)975 sev_do_cmd(int cmd, void *data, int *psp_ret) { return -ENODEV; }
976
977 static inline int
sev_guest_activate(struct sev_data_activate * data,int * error)978 sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
979
sev_guest_df_flush(int * error)980 static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
981
982 static inline int
sev_issue_cmd_external_user(struct file * filep,unsigned int id,void * data,int * error)983 sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
984
psp_copy_user_blob(u64 __user uaddr,u32 len)985 static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
986
snp_alloc_firmware_page(gfp_t mask)987 static inline void *snp_alloc_firmware_page(gfp_t mask)
988 {
989 return NULL;
990 }
991
snp_free_firmware_page(void * addr)992 static inline void snp_free_firmware_page(void *addr) { }
993
sev_platform_shutdown(void)994 static inline void sev_platform_shutdown(void) { }
995
996 #endif /* CONFIG_CRYPTO_DEV_SP_PSP */
997
998 #endif /* __PSP_SEV_H__ */
999