1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * AMD Secure Encrypted Virtualization (SEV) driver interface
4 *
5 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc.
6 *
7 * Author: Brijesh Singh <brijesh.singh@amd.com>
8 *
9 * SEV API spec is available at https://developer.amd.com/sev
10 */
11
12 #ifndef __PSP_SEV_H__
13 #define __PSP_SEV_H__
14
15 #include <uapi/linux/psp-sev.h>
16
17 #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */
18
19 /**
20 * SEV platform state
21 */
22 enum sev_state {
23 SEV_STATE_UNINIT = 0x0,
24 SEV_STATE_INIT = 0x1,
25 SEV_STATE_WORKING = 0x2,
26
27 SEV_STATE_MAX
28 };
29
30 /**
31 * SEV platform and guest management commands
32 */
33 enum sev_cmd {
34 /* platform commands */
35 SEV_CMD_INIT = 0x001,
36 SEV_CMD_SHUTDOWN = 0x002,
37 SEV_CMD_FACTORY_RESET = 0x003,
38 SEV_CMD_PLATFORM_STATUS = 0x004,
39 SEV_CMD_PEK_GEN = 0x005,
40 SEV_CMD_PEK_CSR = 0x006,
41 SEV_CMD_PEK_CERT_IMPORT = 0x007,
42 SEV_CMD_PDH_CERT_EXPORT = 0x008,
43 SEV_CMD_PDH_GEN = 0x009,
44 SEV_CMD_DF_FLUSH = 0x00A,
45 SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B,
46 SEV_CMD_GET_ID = 0x00C,
47 SEV_CMD_INIT_EX = 0x00D,
48
49 /* Guest commands */
50 SEV_CMD_DECOMMISSION = 0x020,
51 SEV_CMD_ACTIVATE = 0x021,
52 SEV_CMD_DEACTIVATE = 0x022,
53 SEV_CMD_GUEST_STATUS = 0x023,
54
55 /* Guest launch commands */
56 SEV_CMD_LAUNCH_START = 0x030,
57 SEV_CMD_LAUNCH_UPDATE_DATA = 0x031,
58 SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032,
59 SEV_CMD_LAUNCH_MEASURE = 0x033,
60 SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034,
61 SEV_CMD_LAUNCH_FINISH = 0x035,
62 SEV_CMD_ATTESTATION_REPORT = 0x036,
63
64 /* Guest migration commands (outgoing) */
65 SEV_CMD_SEND_START = 0x040,
66 SEV_CMD_SEND_UPDATE_DATA = 0x041,
67 SEV_CMD_SEND_UPDATE_VMSA = 0x042,
68 SEV_CMD_SEND_FINISH = 0x043,
69 SEV_CMD_SEND_CANCEL = 0x044,
70
71 /* Guest migration commands (incoming) */
72 SEV_CMD_RECEIVE_START = 0x050,
73 SEV_CMD_RECEIVE_UPDATE_DATA = 0x051,
74 SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052,
75 SEV_CMD_RECEIVE_FINISH = 0x053,
76
77 /* Guest debug commands */
78 SEV_CMD_DBG_DECRYPT = 0x060,
79 SEV_CMD_DBG_ENCRYPT = 0x061,
80
81 /* SNP specific commands */
82 SEV_CMD_SNP_INIT = 0x081,
83 SEV_CMD_SNP_SHUTDOWN = 0x082,
84 SEV_CMD_SNP_PLATFORM_STATUS = 0x083,
85 SEV_CMD_SNP_DF_FLUSH = 0x084,
86 SEV_CMD_SNP_INIT_EX = 0x085,
87 SEV_CMD_SNP_SHUTDOWN_EX = 0x086,
88 SEV_CMD_SNP_DECOMMISSION = 0x090,
89 SEV_CMD_SNP_ACTIVATE = 0x091,
90 SEV_CMD_SNP_GUEST_STATUS = 0x092,
91 SEV_CMD_SNP_GCTX_CREATE = 0x093,
92 SEV_CMD_SNP_GUEST_REQUEST = 0x094,
93 SEV_CMD_SNP_ACTIVATE_EX = 0x095,
94 SEV_CMD_SNP_LAUNCH_START = 0x0A0,
95 SEV_CMD_SNP_LAUNCH_UPDATE = 0x0A1,
96 SEV_CMD_SNP_LAUNCH_FINISH = 0x0A2,
97 SEV_CMD_SNP_DBG_DECRYPT = 0x0B0,
98 SEV_CMD_SNP_DBG_ENCRYPT = 0x0B1,
99 SEV_CMD_SNP_PAGE_SWAP_OUT = 0x0C0,
100 SEV_CMD_SNP_PAGE_SWAP_IN = 0x0C1,
101 SEV_CMD_SNP_PAGE_MOVE = 0x0C2,
102 SEV_CMD_SNP_PAGE_MD_INIT = 0x0C3,
103 SEV_CMD_SNP_PAGE_SET_STATE = 0x0C6,
104 SEV_CMD_SNP_PAGE_RECLAIM = 0x0C7,
105 SEV_CMD_SNP_PAGE_UNSMASH = 0x0C8,
106 SEV_CMD_SNP_CONFIG = 0x0C9,
107 SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX = 0x0CA,
108 SEV_CMD_SNP_COMMIT = 0x0CB,
109 SEV_CMD_SNP_VLEK_LOAD = 0x0CD,
110 SEV_CMD_SNP_FEATURE_INFO = 0x0CE,
111
112 SEV_CMD_MAX,
113 };
114
115 /**
116 * struct sev_data_init - INIT command parameters
117 *
118 * @flags: processing flags
119 * @tmr_address: system physical address used for SEV-ES
120 * @tmr_len: len of tmr_address
121 */
122 struct sev_data_init {
123 u32 flags; /* In */
124 u32 reserved; /* In */
125 u64 tmr_address; /* In */
126 u32 tmr_len; /* In */
127 } __packed;
128
129 /**
130 * struct sev_data_init_ex - INIT_EX command parameters
131 *
132 * @length: len of the command buffer read by the PSP
133 * @flags: processing flags
134 * @tmr_address: system physical address used for SEV-ES
135 * @tmr_len: len of tmr_address
136 * @nv_address: system physical address used for PSP NV storage
137 * @nv_len: len of nv_address
138 */
139 struct sev_data_init_ex {
140 u32 length; /* In */
141 u32 flags; /* In */
142 u64 tmr_address; /* In */
143 u32 tmr_len; /* In */
144 u32 reserved; /* In */
145 u64 nv_address; /* In/Out */
146 u32 nv_len; /* In */
147 } __packed;
148
149 #define SEV_INIT_FLAGS_SEV_ES 0x01
150
151 /**
152 * struct sev_data_pek_csr - PEK_CSR command parameters
153 *
154 * @address: PEK certificate chain
155 * @len: len of certificate
156 */
157 struct sev_data_pek_csr {
158 u64 address; /* In */
159 u32 len; /* In/Out */
160 } __packed;
161
162 /**
163 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters
164 *
165 * @pek_address: PEK certificate chain
166 * @pek_len: len of PEK certificate
167 * @oca_address: OCA certificate chain
168 * @oca_len: len of OCA certificate
169 */
170 struct sev_data_pek_cert_import {
171 u64 pek_cert_address; /* In */
172 u32 pek_cert_len; /* In */
173 u32 reserved; /* In */
174 u64 oca_cert_address; /* In */
175 u32 oca_cert_len; /* In */
176 } __packed;
177
178 /**
179 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters
180 *
181 * @address: physical address of firmware image
182 * @len: len of the firmware image
183 */
184 struct sev_data_download_firmware {
185 u64 address; /* In */
186 u32 len; /* In */
187 } __packed;
188
189 /**
190 * struct sev_data_get_id - GET_ID command parameters
191 *
192 * @address: physical address of region to place unique CPU ID(s)
193 * @len: len of the region
194 */
195 struct sev_data_get_id {
196 u64 address; /* In */
197 u32 len; /* In/Out */
198 } __packed;
199 /**
200 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters
201 *
202 * @pdh_address: PDH certificate address
203 * @pdh_len: len of PDH certificate
204 * @cert_chain_address: PDH certificate chain
205 * @cert_chain_len: len of PDH certificate chain
206 */
207 struct sev_data_pdh_cert_export {
208 u64 pdh_cert_address; /* In */
209 u32 pdh_cert_len; /* In/Out */
210 u32 reserved; /* In */
211 u64 cert_chain_address; /* In */
212 u32 cert_chain_len; /* In/Out */
213 } __packed;
214
215 /**
216 * struct sev_data_decommission - DECOMMISSION command parameters
217 *
218 * @handle: handle of the VM to decommission
219 */
220 struct sev_data_decommission {
221 u32 handle; /* In */
222 } __packed;
223
224 /**
225 * struct sev_data_activate - ACTIVATE command parameters
226 *
227 * @handle: handle of the VM to activate
228 * @asid: asid assigned to the VM
229 */
230 struct sev_data_activate {
231 u32 handle; /* In */
232 u32 asid; /* In */
233 } __packed;
234
235 /**
236 * struct sev_data_deactivate - DEACTIVATE command parameters
237 *
238 * @handle: handle of the VM to deactivate
239 */
240 struct sev_data_deactivate {
241 u32 handle; /* In */
242 } __packed;
243
244 /**
245 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters
246 *
247 * @handle: handle of the VM to retrieve status
248 * @policy: policy information for the VM
249 * @asid: current ASID of the VM
250 * @state: current state of the VM
251 */
252 struct sev_data_guest_status {
253 u32 handle; /* In */
254 u32 policy; /* Out */
255 u32 asid; /* Out */
256 u8 state; /* Out */
257 } __packed;
258
259 /**
260 * struct sev_data_launch_start - LAUNCH_START command parameters
261 *
262 * @handle: handle assigned to the VM
263 * @policy: guest launch policy
264 * @dh_cert_address: physical address of DH certificate blob
265 * @dh_cert_len: len of DH certificate blob
266 * @session_address: physical address of session parameters
267 * @session_len: len of session parameters
268 */
269 struct sev_data_launch_start {
270 u32 handle; /* In/Out */
271 u32 policy; /* In */
272 u64 dh_cert_address; /* In */
273 u32 dh_cert_len; /* In */
274 u32 reserved; /* In */
275 u64 session_address; /* In */
276 u32 session_len; /* In */
277 } __packed;
278
279 /**
280 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter
281 *
282 * @handle: handle of the VM to update
283 * @len: len of memory to be encrypted
284 * @address: physical address of memory region to encrypt
285 */
286 struct sev_data_launch_update_data {
287 u32 handle; /* In */
288 u32 reserved;
289 u64 address; /* In */
290 u32 len; /* In */
291 } __packed;
292
293 /**
294 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command
295 *
296 * @handle: handle of the VM
297 * @address: physical address of memory region to encrypt
298 * @len: len of memory region to encrypt
299 */
300 struct sev_data_launch_update_vmsa {
301 u32 handle; /* In */
302 u32 reserved;
303 u64 address; /* In */
304 u32 len; /* In */
305 } __packed;
306
307 /**
308 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters
309 *
310 * @handle: handle of the VM to process
311 * @address: physical address containing the measurement blob
312 * @len: len of measurement blob
313 */
314 struct sev_data_launch_measure {
315 u32 handle; /* In */
316 u32 reserved;
317 u64 address; /* In */
318 u32 len; /* In/Out */
319 } __packed;
320
321 /**
322 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters
323 *
324 * @handle: handle of the VM to process
325 * @hdr_address: physical address containing the packet header
326 * @hdr_len: len of packet header
327 * @guest_address: system physical address of guest memory region
328 * @guest_len: len of guest_paddr
329 * @trans_address: physical address of transport memory buffer
330 * @trans_len: len of transport memory buffer
331 */
332 struct sev_data_launch_secret {
333 u32 handle; /* In */
334 u32 reserved1;
335 u64 hdr_address; /* In */
336 u32 hdr_len; /* In */
337 u32 reserved2;
338 u64 guest_address; /* In */
339 u32 guest_len; /* In */
340 u32 reserved3;
341 u64 trans_address; /* In */
342 u32 trans_len; /* In */
343 } __packed;
344
345 /**
346 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters
347 *
348 * @handle: handle of the VM to process
349 */
350 struct sev_data_launch_finish {
351 u32 handle; /* In */
352 } __packed;
353
354 /**
355 * struct sev_data_send_start - SEND_START command parameters
356 *
357 * @handle: handle of the VM to process
358 * @policy: policy information for the VM
359 * @pdh_cert_address: physical address containing PDH certificate
360 * @pdh_cert_len: len of PDH certificate
361 * @plat_certs_address: physical address containing platform certificate
362 * @plat_certs_len: len of platform certificate
363 * @amd_certs_address: physical address containing AMD certificate
364 * @amd_certs_len: len of AMD certificate
365 * @session_address: physical address containing Session data
366 * @session_len: len of session data
367 */
368 struct sev_data_send_start {
369 u32 handle; /* In */
370 u32 policy; /* Out */
371 u64 pdh_cert_address; /* In */
372 u32 pdh_cert_len; /* In */
373 u32 reserved1;
374 u64 plat_certs_address; /* In */
375 u32 plat_certs_len; /* In */
376 u32 reserved2;
377 u64 amd_certs_address; /* In */
378 u32 amd_certs_len; /* In */
379 u32 reserved3;
380 u64 session_address; /* In */
381 u32 session_len; /* In/Out */
382 } __packed;
383
384 /**
385 * struct sev_data_send_update - SEND_UPDATE_DATA command
386 *
387 * @handle: handle of the VM to process
388 * @hdr_address: physical address containing packet header
389 * @hdr_len: len of packet header
390 * @guest_address: physical address of guest memory region to send
391 * @guest_len: len of guest memory region to send
392 * @trans_address: physical address of host memory region
393 * @trans_len: len of host memory region
394 */
395 struct sev_data_send_update_data {
396 u32 handle; /* In */
397 u32 reserved1;
398 u64 hdr_address; /* In */
399 u32 hdr_len; /* In/Out */
400 u32 reserved2;
401 u64 guest_address; /* In */
402 u32 guest_len; /* In */
403 u32 reserved3;
404 u64 trans_address; /* In */
405 u32 trans_len; /* In */
406 } __packed;
407
408 /**
409 * struct sev_data_send_update - SEND_UPDATE_VMSA command
410 *
411 * @handle: handle of the VM to process
412 * @hdr_address: physical address containing packet header
413 * @hdr_len: len of packet header
414 * @guest_address: physical address of guest memory region to send
415 * @guest_len: len of guest memory region to send
416 * @trans_address: physical address of host memory region
417 * @trans_len: len of host memory region
418 */
419 struct sev_data_send_update_vmsa {
420 u32 handle; /* In */
421 u64 hdr_address; /* In */
422 u32 hdr_len; /* In/Out */
423 u32 reserved2;
424 u64 guest_address; /* In */
425 u32 guest_len; /* In */
426 u32 reserved3;
427 u64 trans_address; /* In */
428 u32 trans_len; /* In */
429 } __packed;
430
431 /**
432 * struct sev_data_send_finish - SEND_FINISH command parameters
433 *
434 * @handle: handle of the VM to process
435 */
436 struct sev_data_send_finish {
437 u32 handle; /* In */
438 } __packed;
439
440 /**
441 * struct sev_data_send_cancel - SEND_CANCEL command parameters
442 *
443 * @handle: handle of the VM to process
444 */
445 struct sev_data_send_cancel {
446 u32 handle; /* In */
447 } __packed;
448
449 /**
450 * struct sev_data_receive_start - RECEIVE_START command parameters
451 *
452 * @handle: handle of the VM to perform receive operation
453 * @pdh_cert_address: system physical address containing PDH certificate blob
454 * @pdh_cert_len: len of PDH certificate blob
455 * @session_address: system physical address containing session blob
456 * @session_len: len of session blob
457 */
458 struct sev_data_receive_start {
459 u32 handle; /* In/Out */
460 u32 policy; /* In */
461 u64 pdh_cert_address; /* In */
462 u32 pdh_cert_len; /* In */
463 u32 reserved1;
464 u64 session_address; /* In */
465 u32 session_len; /* In */
466 } __packed;
467
468 /**
469 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters
470 *
471 * @handle: handle of the VM to update
472 * @hdr_address: physical address containing packet header blob
473 * @hdr_len: len of packet header
474 * @guest_address: system physical address of guest memory region
475 * @guest_len: len of guest memory region
476 * @trans_address: system physical address of transport buffer
477 * @trans_len: len of transport buffer
478 */
479 struct sev_data_receive_update_data {
480 u32 handle; /* In */
481 u32 reserved1;
482 u64 hdr_address; /* In */
483 u32 hdr_len; /* In */
484 u32 reserved2;
485 u64 guest_address; /* In */
486 u32 guest_len; /* In */
487 u32 reserved3;
488 u64 trans_address; /* In */
489 u32 trans_len; /* In */
490 } __packed;
491
492 /**
493 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters
494 *
495 * @handle: handle of the VM to update
496 * @hdr_address: physical address containing packet header blob
497 * @hdr_len: len of packet header
498 * @guest_address: system physical address of guest memory region
499 * @guest_len: len of guest memory region
500 * @trans_address: system physical address of transport buffer
501 * @trans_len: len of transport buffer
502 */
503 struct sev_data_receive_update_vmsa {
504 u32 handle; /* In */
505 u32 reserved1;
506 u64 hdr_address; /* In */
507 u32 hdr_len; /* In */
508 u32 reserved2;
509 u64 guest_address; /* In */
510 u32 guest_len; /* In */
511 u32 reserved3;
512 u64 trans_address; /* In */
513 u32 trans_len; /* In */
514 } __packed;
515
516 /**
517 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters
518 *
519 * @handle: handle of the VM to finish
520 */
521 struct sev_data_receive_finish {
522 u32 handle; /* In */
523 } __packed;
524
525 /**
526 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
527 *
528 * @handle: handle of the VM to perform debug operation
529 * @src_addr: source address of data to operate on
530 * @dst_addr: destination address of data to operate on
531 * @len: len of data to operate on
532 */
533 struct sev_data_dbg {
534 u32 handle; /* In */
535 u32 reserved;
536 u64 src_addr; /* In */
537 u64 dst_addr; /* In */
538 u32 len; /* In */
539 } __packed;
540
541 /**
542 * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters
543 *
544 * @handle: handle of the VM
545 * @mnonce: a random nonce that will be included in the report.
546 * @address: physical address where the report will be copied.
547 * @len: length of the physical buffer.
548 */
549 struct sev_data_attestation_report {
550 u32 handle; /* In */
551 u32 reserved;
552 u64 address; /* In */
553 u8 mnonce[16]; /* In */
554 u32 len; /* In/Out */
555 } __packed;
556
557 /**
558 * struct sev_data_snp_download_firmware - SNP_DOWNLOAD_FIRMWARE command params
559 *
560 * @address: physical address of firmware image
561 * @len: length of the firmware image
562 */
563 struct sev_data_snp_download_firmware {
564 u64 address; /* In */
565 u32 len; /* In */
566 } __packed;
567
568 /**
569 * struct sev_data_snp_activate - SNP_ACTIVATE command params
570 *
571 * @gctx_paddr: system physical address guest context page
572 * @asid: ASID to bind to the guest
573 */
574 struct sev_data_snp_activate {
575 u64 gctx_paddr; /* In */
576 u32 asid; /* In */
577 } __packed;
578
579 /**
580 * struct sev_data_snp_addr - generic SNP command params
581 *
582 * @address: physical address of generic data param
583 */
584 struct sev_data_snp_addr {
585 u64 address; /* In/Out */
586 } __packed;
587
588 /**
589 * struct sev_data_snp_launch_start - SNP_LAUNCH_START command params
590 *
591 * @gctx_paddr: system physical address of guest context page
592 * @policy: guest policy
593 * @ma_gctx_paddr: system physical address of migration agent
594 * @ma_en: the guest is associated with a migration agent
595 * @imi_en: launch flow is launching an IMI (Incoming Migration Image) for the
596 * purpose of guest-assisted migration.
597 * @rsvd: reserved
598 * @desired_tsc_khz: hypervisor desired mean TSC freq in kHz of the guest
599 * @gosvw: guest OS-visible workarounds, as defined by hypervisor
600 */
601 struct sev_data_snp_launch_start {
602 u64 gctx_paddr; /* In */
603 u64 policy; /* In */
604 u64 ma_gctx_paddr; /* In */
605 u32 ma_en:1; /* In */
606 u32 imi_en:1; /* In */
607 u32 rsvd:30;
608 u32 desired_tsc_khz; /* In */
609 u8 gosvw[16]; /* In */
610 } __packed;
611
612 /* SNP support page type */
613 enum {
614 SNP_PAGE_TYPE_NORMAL = 0x1,
615 SNP_PAGE_TYPE_VMSA = 0x2,
616 SNP_PAGE_TYPE_ZERO = 0x3,
617 SNP_PAGE_TYPE_UNMEASURED = 0x4,
618 SNP_PAGE_TYPE_SECRET = 0x5,
619 SNP_PAGE_TYPE_CPUID = 0x6,
620
621 SNP_PAGE_TYPE_MAX
622 };
623
624 /**
625 * struct sev_data_snp_launch_update - SNP_LAUNCH_UPDATE command params
626 *
627 * @gctx_paddr: system physical address of guest context page
628 * @page_size: page size 0 indicates 4K and 1 indicates 2MB page
629 * @page_type: encoded page type
630 * @imi_page: indicates that this page is part of the IMI (Incoming Migration
631 * Image) of the guest
632 * @rsvd: reserved
633 * @rsvd2: reserved
634 * @address: system physical address of destination page to encrypt
635 * @rsvd3: reserved
636 * @vmpl1_perms: VMPL permission mask for VMPL1
637 * @vmpl2_perms: VMPL permission mask for VMPL2
638 * @vmpl3_perms: VMPL permission mask for VMPL3
639 * @rsvd4: reserved
640 */
641 struct sev_data_snp_launch_update {
642 u64 gctx_paddr; /* In */
643 u32 page_size:1; /* In */
644 u32 page_type:3; /* In */
645 u32 imi_page:1; /* In */
646 u32 rsvd:27;
647 u32 rsvd2;
648 u64 address; /* In */
649 u32 rsvd3:8;
650 u32 vmpl1_perms:8; /* In */
651 u32 vmpl2_perms:8; /* In */
652 u32 vmpl3_perms:8; /* In */
653 u32 rsvd4;
654 } __packed;
655
656 /**
657 * struct sev_data_snp_launch_finish - SNP_LAUNCH_FINISH command params
658 *
659 * @gctx_paddr: system physical address of guest context page
660 * @id_block_paddr: system physical address of ID block
661 * @id_auth_paddr: system physical address of ID block authentication structure
662 * @id_block_en: indicates whether ID block is present
663 * @auth_key_en: indicates whether author key is present in authentication structure
664 * @vcek_disabled: indicates whether use of VCEK is allowed for attestation reports
665 * @rsvd: reserved
666 * @host_data: host-supplied data for guest, not interpreted by firmware
667 */
668 struct sev_data_snp_launch_finish {
669 u64 gctx_paddr;
670 u64 id_block_paddr;
671 u64 id_auth_paddr;
672 u8 id_block_en:1;
673 u8 auth_key_en:1;
674 u8 vcek_disabled:1;
675 u64 rsvd:61;
676 u8 host_data[32];
677 } __packed;
678
679 /**
680 * struct sev_data_snp_guest_status - SNP_GUEST_STATUS command params
681 *
682 * @gctx_paddr: system physical address of guest context page
683 * @address: system physical address of guest status page
684 */
685 struct sev_data_snp_guest_status {
686 u64 gctx_paddr;
687 u64 address;
688 } __packed;
689
690 /**
691 * struct sev_data_snp_page_reclaim - SNP_PAGE_RECLAIM command params
692 *
693 * @paddr: system physical address of page to be claimed. The 0th bit in the
694 * address indicates the page size. 0h indicates 4KB and 1h indicates
695 * 2MB page.
696 */
697 struct sev_data_snp_page_reclaim {
698 u64 paddr;
699 } __packed;
700
701 /**
702 * struct sev_data_snp_page_unsmash - SNP_PAGE_UNSMASH command params
703 *
704 * @paddr: system physical address of page to be unsmashed. The 0th bit in the
705 * address indicates the page size. 0h indicates 4 KB and 1h indicates
706 * 2 MB page.
707 */
708 struct sev_data_snp_page_unsmash {
709 u64 paddr;
710 } __packed;
711
712 /**
713 * struct sev_data_snp_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters
714 *
715 * @gctx_paddr: system physical address of guest context page
716 * @src_addr: source address of data to operate on
717 * @dst_addr: destination address of data to operate on
718 */
719 struct sev_data_snp_dbg {
720 u64 gctx_paddr; /* In */
721 u64 src_addr; /* In */
722 u64 dst_addr; /* In */
723 } __packed;
724
725 /**
726 * struct sev_data_snp_guest_request - SNP_GUEST_REQUEST command params
727 *
728 * @gctx_paddr: system physical address of guest context page
729 * @req_paddr: system physical address of request page
730 * @res_paddr: system physical address of response page
731 */
732 struct sev_data_snp_guest_request {
733 u64 gctx_paddr; /* In */
734 u64 req_paddr; /* In */
735 u64 res_paddr; /* In */
736 } __packed;
737
738 /**
739 * struct sev_data_snp_init_ex - SNP_INIT_EX structure
740 *
741 * @init_rmp: indicate that the RMP should be initialized.
742 * @list_paddr_en: indicate that list_paddr is valid
743 * @rsvd: reserved
744 * @rsvd1: reserved
745 * @list_paddr: system physical address of range list
746 * @rsvd2: reserved
747 */
748 struct sev_data_snp_init_ex {
749 u32 init_rmp:1;
750 u32 list_paddr_en:1;
751 u32 rapl_dis:1;
752 u32 ciphertext_hiding_en:1;
753 u32 rsvd:28;
754 u32 rsvd1;
755 u64 list_paddr;
756 u16 max_snp_asid;
757 u8 rsvd2[46];
758 } __packed;
759
760 /**
761 * struct sev_data_range - RANGE structure
762 *
763 * @base: system physical address of first byte of range
764 * @page_count: number of 4KB pages in this range
765 * @rsvd: reserved
766 */
767 struct sev_data_range {
768 u64 base;
769 u32 page_count;
770 u32 rsvd;
771 } __packed;
772
773 /**
774 * struct sev_data_range_list - RANGE_LIST structure
775 *
776 * @num_elements: number of elements in RANGE_ARRAY
777 * @rsvd: reserved
778 * @ranges: array of num_elements of type RANGE
779 */
780 struct sev_data_range_list {
781 u32 num_elements;
782 u32 rsvd;
783 struct sev_data_range ranges[];
784 } __packed;
785
786 /**
787 * struct sev_data_snp_shutdown_ex - SNP_SHUTDOWN_EX structure
788 *
789 * @len: length of the command buffer read by the PSP
790 * @iommu_snp_shutdown: Disable enforcement of SNP in the IOMMU
791 * @rsvd1: reserved
792 */
793 struct sev_data_snp_shutdown_ex {
794 u32 len;
795 u32 iommu_snp_shutdown:1;
796 u32 rsvd1:31;
797 } __packed;
798
799 /**
800 * struct sev_platform_init_args
801 *
802 * @error: SEV firmware error code
803 * @probe: True if this is being called as part of CCP module probe, which
804 * will defer SEV_INIT/SEV_INIT_EX firmware initialization until needed
805 * unless psp_init_on_probe module param is set
806 * @max_snp_asid: When non-zero, enable ciphertext hiding and specify the
807 * maximum ASID that can be used for an SEV-SNP guest.
808 */
809 struct sev_platform_init_args {
810 int error;
811 bool probe;
812 unsigned int max_snp_asid;
813 };
814
815 /**
816 * struct sev_data_snp_commit - SNP_COMMIT structure
817 *
818 * @len: length of the command buffer read by the PSP
819 */
820 struct sev_data_snp_commit {
821 u32 len;
822 } __packed;
823
824 /**
825 * struct sev_data_snp_feature_info - SEV_SNP_FEATURE_INFO structure
826 *
827 * @length: len of the command buffer read by the PSP
828 * @ecx_in: subfunction index
829 * @feature_info_paddr : System Physical Address of the FEATURE_INFO structure
830 */
831 struct sev_data_snp_feature_info {
832 u32 length;
833 u32 ecx_in;
834 u64 feature_info_paddr;
835 } __packed;
836
837 /**
838 * struct feature_info - FEATURE_INFO structure
839 *
840 * @eax: output of SNP_FEATURE_INFO command
841 * @ebx: output of SNP_FEATURE_INFO command
842 * @ecx: output of SNP_FEATURE_INFO command
843 * #edx: output of SNP_FEATURE_INFO command
844 */
845 struct snp_feature_info {
846 u32 eax;
847 u32 ebx;
848 u32 ecx;
849 u32 edx;
850 } __packed;
851
852 #define SNP_CIPHER_TEXT_HIDING_SUPPORTED BIT(3)
853
854 #ifdef CONFIG_CRYPTO_DEV_SP_PSP
855
856 /**
857 * sev_module_init - perform PSP SEV module initialization
858 *
859 * Returns:
860 * 0 if the PSP module is successfully initialized
861 * negative value if the PSP module initialization fails
862 */
863 int sev_module_init(void);
864
865 /**
866 * sev_platform_init - perform SEV INIT command
867 *
868 * @args: struct sev_platform_init_args to pass in arguments
869 *
870 * Returns:
871 * 0 if the SEV successfully processed the command
872 * -%ENODEV if the SEV device is not available
873 * -%ENOTSUPP if the SEV does not support SEV
874 * -%ETIMEDOUT if the SEV command timed out
875 * -%EIO if the SEV returned a non-zero return code
876 */
877 int sev_platform_init(struct sev_platform_init_args *args);
878
879 /**
880 * sev_platform_status - perform SEV PLATFORM_STATUS command
881 *
882 * @status: sev_user_data_status structure to be processed
883 * @error: SEV command return code
884 *
885 * Returns:
886 * 0 if the SEV successfully processed the command
887 * -%ENODEV if the SEV device is not available
888 * -%ENOTSUPP if the SEV does not support SEV
889 * -%ETIMEDOUT if the SEV command timed out
890 * -%EIO if the SEV returned a non-zero return code
891 */
892 int sev_platform_status(struct sev_user_data_status *status, int *error);
893
894 /**
895 * sev_issue_cmd_external_user - issue SEV command by other driver with a file
896 * handle.
897 *
898 * This function can be used by other drivers to issue a SEV command on
899 * behalf of userspace. The caller must pass a valid SEV file descriptor
900 * so that we know that it has access to SEV device.
901 *
902 * @filep - SEV device file pointer
903 * @cmd - command to issue
904 * @data - command buffer
905 * @error: SEV command return code
906 *
907 * Returns:
908 * 0 if the SEV successfully processed the command
909 * -%ENODEV if the SEV device is not available
910 * -%ENOTSUPP if the SEV does not support SEV
911 * -%ETIMEDOUT if the SEV command timed out
912 * -%EIO if the SEV returned a non-zero return code
913 * -%EINVAL if the SEV file descriptor is not valid
914 */
915 int sev_issue_cmd_external_user(struct file *filep, unsigned int id,
916 void *data, int *error);
917
918 /**
919 * sev_guest_deactivate - perform SEV DEACTIVATE command
920 *
921 * @deactivate: sev_data_deactivate structure to be processed
922 * @sev_ret: sev command return code
923 *
924 * Returns:
925 * 0 if the sev successfully processed the command
926 * -%ENODEV if the sev device is not available
927 * -%ENOTSUPP if the sev does not support SEV
928 * -%ETIMEDOUT if the sev command timed out
929 * -%EIO if the sev returned a non-zero return code
930 */
931 int sev_guest_deactivate(struct sev_data_deactivate *data, int *error);
932
933 /**
934 * sev_guest_activate - perform SEV ACTIVATE command
935 *
936 * @activate: sev_data_activate structure to be processed
937 * @sev_ret: sev command return code
938 *
939 * Returns:
940 * 0 if the sev successfully processed the command
941 * -%ENODEV if the sev device is not available
942 * -%ENOTSUPP if the sev does not support SEV
943 * -%ETIMEDOUT if the sev command timed out
944 * -%EIO if the sev returned a non-zero return code
945 */
946 int sev_guest_activate(struct sev_data_activate *data, int *error);
947
948 /**
949 * sev_guest_df_flush - perform SEV DF_FLUSH command
950 *
951 * @sev_ret: sev command return code
952 *
953 * Returns:
954 * 0 if the sev successfully processed the command
955 * -%ENODEV if the sev device is not available
956 * -%ENOTSUPP if the sev does not support SEV
957 * -%ETIMEDOUT if the sev command timed out
958 * -%EIO if the sev returned a non-zero return code
959 */
960 int sev_guest_df_flush(int *error);
961
962 /**
963 * sev_guest_decommission - perform SEV DECOMMISSION command
964 *
965 * @decommission: sev_data_decommission structure to be processed
966 * @sev_ret: sev command return code
967 *
968 * Returns:
969 * 0 if the sev successfully processed the command
970 * -%ENODEV if the sev device is not available
971 * -%ENOTSUPP if the sev does not support SEV
972 * -%ETIMEDOUT if the sev command timed out
973 * -%EIO if the sev returned a non-zero return code
974 */
975 int sev_guest_decommission(struct sev_data_decommission *data, int *error);
976
977 /**
978 * sev_do_cmd - issue an SEV or an SEV-SNP command
979 *
980 * @cmd: SEV or SEV-SNP firmware command to issue
981 * @data: arguments for firmware command
982 * @psp_ret: SEV command return code
983 *
984 * Returns:
985 * 0 if the SEV device successfully processed the command
986 * -%ENODEV if the PSP device is not available
987 * -%ENOTSUPP if PSP device does not support SEV
988 * -%ETIMEDOUT if the SEV command timed out
989 * -%EIO if PSP device returned a non-zero return code
990 */
991 int sev_do_cmd(int cmd, void *data, int *psp_ret);
992
993 void *psp_copy_user_blob(u64 uaddr, u32 len);
994 void *snp_alloc_firmware_page(gfp_t mask);
995 void snp_free_firmware_page(void *addr);
996 void sev_platform_shutdown(void);
997 bool sev_is_snp_ciphertext_hiding_supported(void);
998
999 #else /* !CONFIG_CRYPTO_DEV_SP_PSP */
1000
1001 static inline int
sev_platform_status(struct sev_user_data_status * status,int * error)1002 sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; }
1003
sev_platform_init(struct sev_platform_init_args * args)1004 static inline int sev_platform_init(struct sev_platform_init_args *args) { return -ENODEV; }
1005
1006 static inline int
sev_guest_deactivate(struct sev_data_deactivate * data,int * error)1007 sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; }
1008
1009 static inline int
sev_guest_decommission(struct sev_data_decommission * data,int * error)1010 sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; }
1011
1012 static inline int
sev_do_cmd(int cmd,void * data,int * psp_ret)1013 sev_do_cmd(int cmd, void *data, int *psp_ret) { return -ENODEV; }
1014
1015 static inline int
sev_guest_activate(struct sev_data_activate * data,int * error)1016 sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; }
1017
sev_guest_df_flush(int * error)1018 static inline int sev_guest_df_flush(int *error) { return -ENODEV; }
1019
1020 static inline int
sev_issue_cmd_external_user(struct file * filep,unsigned int id,void * data,int * error)1021 sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; }
1022
psp_copy_user_blob(u64 __user uaddr,u32 len)1023 static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); }
1024
snp_alloc_firmware_page(gfp_t mask)1025 static inline void *snp_alloc_firmware_page(gfp_t mask)
1026 {
1027 return NULL;
1028 }
1029
snp_free_firmware_page(void * addr)1030 static inline void snp_free_firmware_page(void *addr) { }
1031
sev_platform_shutdown(void)1032 static inline void sev_platform_shutdown(void) { }
1033
sev_is_snp_ciphertext_hiding_supported(void)1034 static inline bool sev_is_snp_ciphertext_hiding_supported(void) { return false; }
1035
1036 #endif /* CONFIG_CRYPTO_DEV_SP_PSP */
1037
1038 #endif /* __PSP_SEV_H__ */
1039