/* SPDX-License-Identifier: GPL-2.0-only */ /* * AMD Secure Encrypted Virtualization (SEV) driver interface * * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. * * Author: Brijesh Singh <brijesh.singh@amd.com> * * SEV API spec is available at https://developer.amd.com/sev */ #ifndef __PSP_SEV_H__ #define __PSP_SEV_H__ #include <uapi/linux/psp-sev.h> /* As defined by SEV API, under "Guest Policy". */ #define SEV_POLICY_MASK_NODBG BIT(0) #define SEV_POLICY_MASK_NOKS BIT(1) #define SEV_POLICY_MASK_ES BIT(2) #define SEV_POLICY_MASK_NOSEND BIT(3) #define SEV_POLICY_MASK_DOMAIN BIT(4) #define SEV_POLICY_MASK_SEV BIT(5) #define SEV_POLICY_MASK_API_MAJOR GENMASK(23, 16) #define SEV_POLICY_MASK_API_MINOR GENMASK(31, 24) /* As defined by SEV-SNP Firmware ABI, under "Guest Policy". */ #define SNP_POLICY_MASK_API_MINOR GENMASK_ULL(7, 0) #define SNP_POLICY_MASK_API_MAJOR GENMASK_ULL(15, 8) #define SNP_POLICY_MASK_SMT BIT_ULL(16) #define SNP_POLICY_MASK_RSVD_MBO BIT_ULL(17) #define SNP_POLICY_MASK_MIGRATE_MA BIT_ULL(18) #define SNP_POLICY_MASK_DEBUG BIT_ULL(19) #define SNP_POLICY_MASK_SINGLE_SOCKET BIT_ULL(20) #define SNP_POLICY_MASK_CXL_ALLOW BIT_ULL(21) #define SNP_POLICY_MASK_MEM_AES_256_XTS BIT_ULL(22) #define SNP_POLICY_MASK_RAPL_DIS BIT_ULL(23) #define SNP_POLICY_MASK_CIPHERTEXT_HIDING_DRAM BIT_ULL(24) #define SNP_POLICY_MASK_PAGE_SWAP_DISABLE BIT_ULL(25) /* Base SEV-SNP policy bitmask for minimum supported SEV firmware version */ #define SNP_POLICY_MASK_BASE (SNP_POLICY_MASK_API_MINOR | \ SNP_POLICY_MASK_API_MAJOR | \ SNP_POLICY_MASK_SMT | \ SNP_POLICY_MASK_RSVD_MBO | \ SNP_POLICY_MASK_MIGRATE_MA | \ SNP_POLICY_MASK_DEBUG | \ SNP_POLICY_MASK_SINGLE_SOCKET) #define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */ /** * SEV platform state */ enum sev_state { SEV_STATE_UNINIT = 0x0, SEV_STATE_INIT = 0x1, SEV_STATE_WORKING = 0x2, SEV_STATE_MAX }; /** * SEV platform and guest management commands */ enum sev_cmd { /* platform commands */ SEV_CMD_INIT = 0x001, SEV_CMD_SHUTDOWN = 0x002, SEV_CMD_FACTORY_RESET = 0x003, SEV_CMD_PLATFORM_STATUS = 0x004, SEV_CMD_PEK_GEN = 0x005, SEV_CMD_PEK_CSR = 0x006, SEV_CMD_PEK_CERT_IMPORT = 0x007, SEV_CMD_PDH_CERT_EXPORT = 0x008, SEV_CMD_PDH_GEN = 0x009, SEV_CMD_DF_FLUSH = 0x00A, SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B, SEV_CMD_GET_ID = 0x00C, SEV_CMD_INIT_EX = 0x00D, /* Guest commands */ SEV_CMD_DECOMMISSION = 0x020, SEV_CMD_ACTIVATE = 0x021, SEV_CMD_DEACTIVATE = 0x022, SEV_CMD_GUEST_STATUS = 0x023, /* Guest launch commands */ SEV_CMD_LAUNCH_START = 0x030, SEV_CMD_LAUNCH_UPDATE_DATA = 0x031, SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032, SEV_CMD_LAUNCH_MEASURE = 0x033, SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034, SEV_CMD_LAUNCH_FINISH = 0x035, SEV_CMD_ATTESTATION_REPORT = 0x036, /* Guest migration commands (outgoing) */ SEV_CMD_SEND_START = 0x040, SEV_CMD_SEND_UPDATE_DATA = 0x041, SEV_CMD_SEND_UPDATE_VMSA = 0x042, SEV_CMD_SEND_FINISH = 0x043, SEV_CMD_SEND_CANCEL = 0x044, /* Guest migration commands (incoming) */ SEV_CMD_RECEIVE_START = 0x050, SEV_CMD_RECEIVE_UPDATE_DATA = 0x051, SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052, SEV_CMD_RECEIVE_FINISH = 0x053, /* Guest debug commands */ SEV_CMD_DBG_DECRYPT = 0x060, SEV_CMD_DBG_ENCRYPT = 0x061, /* SNP specific commands */ SEV_CMD_SNP_INIT = 0x081, SEV_CMD_SNP_SHUTDOWN = 0x082, SEV_CMD_SNP_PLATFORM_STATUS = 0x083, SEV_CMD_SNP_DF_FLUSH = 0x084, SEV_CMD_SNP_INIT_EX = 0x085, SEV_CMD_SNP_SHUTDOWN_EX = 0x086, SEV_CMD_SNP_DECOMMISSION = 0x090, SEV_CMD_SNP_ACTIVATE = 0x091, SEV_CMD_SNP_GUEST_STATUS = 0x092, SEV_CMD_SNP_GCTX_CREATE = 0x093, SEV_CMD_SNP_GUEST_REQUEST = 0x094, SEV_CMD_SNP_ACTIVATE_EX = 0x095, SEV_CMD_SNP_LAUNCH_START = 0x0A0, SEV_CMD_SNP_LAUNCH_UPDATE = 0x0A1, SEV_CMD_SNP_LAUNCH_FINISH = 0x0A2, SEV_CMD_SNP_DBG_DECRYPT = 0x0B0, SEV_CMD_SNP_DBG_ENCRYPT = 0x0B1, SEV_CMD_SNP_PAGE_SWAP_OUT = 0x0C0, SEV_CMD_SNP_PAGE_SWAP_IN = 0x0C1, SEV_CMD_SNP_PAGE_MOVE = 0x0C2, SEV_CMD_SNP_PAGE_MD_INIT = 0x0C3, SEV_CMD_SNP_PAGE_SET_STATE = 0x0C6, SEV_CMD_SNP_PAGE_RECLAIM = 0x0C7, SEV_CMD_SNP_PAGE_UNSMASH = 0x0C8, SEV_CMD_SNP_CONFIG = 0x0C9, SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX = 0x0CA, SEV_CMD_SNP_COMMIT = 0x0CB, SEV_CMD_SNP_VLEK_LOAD = 0x0CD, SEV_CMD_SNP_FEATURE_INFO = 0x0CE, /* SEV-TIO commands */ SEV_CMD_TIO_STATUS = 0x0D0, SEV_CMD_TIO_INIT = 0x0D1, SEV_CMD_TIO_DEV_CREATE = 0x0D2, SEV_CMD_TIO_DEV_RECLAIM = 0x0D3, SEV_CMD_TIO_DEV_CONNECT = 0x0D4, SEV_CMD_TIO_DEV_DISCONNECT = 0x0D5, SEV_CMD_MAX, }; /** * struct sev_data_init - INIT command parameters * * @flags: processing flags * @tmr_address: system physical address used for SEV-ES * @tmr_len: len of tmr_address */ struct sev_data_init { u32 flags; /* In */ u32 reserved; /* In */ u64 tmr_address; /* In */ u32 tmr_len; /* In */ } __packed; /** * struct sev_data_init_ex - INIT_EX command parameters * * @length: len of the command buffer read by the PSP * @flags: processing flags * @tmr_address: system physical address used for SEV-ES * @tmr_len: len of tmr_address * @nv_address: system physical address used for PSP NV storage * @nv_len: len of nv_address */ struct sev_data_init_ex { u32 length; /* In */ u32 flags; /* In */ u64 tmr_address; /* In */ u32 tmr_len; /* In */ u32 reserved; /* In */ u64 nv_address; /* In/Out */ u32 nv_len; /* In */ } __packed; #define SEV_INIT_FLAGS_SEV_ES 0x01 /** * struct sev_data_pek_csr - PEK_CSR command parameters * * @address: PEK certificate chain * @len: len of certificate */ struct sev_data_pek_csr { u64 address; /* In */ u32 len; /* In/Out */ } __packed; /** * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters * * @pek_address: PEK certificate chain * @pek_len: len of PEK certificate * @oca_address: OCA certificate chain * @oca_len: len of OCA certificate */ struct sev_data_pek_cert_import { u64 pek_cert_address; /* In */ u32 pek_cert_len; /* In */ u32 reserved; /* In */ u64 oca_cert_address; /* In */ u32 oca_cert_len; /* In */ } __packed; /** * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters * * @address: physical address of firmware image * @len: len of the firmware image */ struct sev_data_download_firmware { u64 address; /* In */ u32 len; /* In */ } __packed; /** * struct sev_data_get_id - GET_ID command parameters * * @address: physical address of region to place unique CPU ID(s) * @len: len of the region */ struct sev_data_get_id { u64 address; /* In */ u32 len; /* In/Out */ } __packed; /** * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters * * @pdh_address: PDH certificate address * @pdh_len: len of PDH certificate * @cert_chain_address: PDH certificate chain * @cert_chain_len: len of PDH certificate chain */ struct sev_data_pdh_cert_export { u64 pdh_cert_address; /* In */ u32 pdh_cert_len; /* In/Out */ u32 reserved; /* In */ u64 cert_chain_address; /* In */ u32 cert_chain_len; /* In/Out */ } __packed; /** * struct sev_data_decommission - DECOMMISSION command parameters * * @handle: handle of the VM to decommission */ struct sev_data_decommission { u32 handle; /* In */ } __packed; /** * struct sev_data_activate - ACTIVATE command parameters * * @handle: handle of the VM to activate * @asid: asid assigned to the VM */ struct sev_data_activate { u32 handle; /* In */ u32 asid; /* In */ } __packed; /** * struct sev_data_deactivate - DEACTIVATE command parameters * * @handle: handle of the VM to deactivate */ struct sev_data_deactivate { u32 handle; /* In */ } __packed; /** * struct sev_data_guest_status - SEV GUEST_STATUS command parameters * * @handle: handle of the VM to retrieve status * @policy: policy information for the VM * @asid: current ASID of the VM * @state: current state of the VM */ struct sev_data_guest_status { u32 handle; /* In */ u32 policy; /* Out */ u32 asid; /* Out */ u8 state; /* Out */ } __packed; /** * struct sev_data_launch_start - LAUNCH_START command parameters * * @handle: handle assigned to the VM * @policy: guest launch policy * @dh_cert_address: physical address of DH certificate blob * @dh_cert_len: len of DH certificate blob * @session_address: physical address of session parameters * @session_len: len of session parameters */ struct sev_data_launch_start { u32 handle; /* In/Out */ u32 policy; /* In */ u64 dh_cert_address; /* In */ u32 dh_cert_len; /* In */ u32 reserved; /* In */ u64 session_address; /* In */ u32 session_len; /* In */ } __packed; /** * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter * * @handle: handle of the VM to update * @len: len of memory to be encrypted * @address: physical address of memory region to encrypt */ struct sev_data_launch_update_data { u32 handle; /* In */ u32 reserved; u64 address; /* In */ u32 len; /* In */ } __packed; /** * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command * * @handle: handle of the VM * @address: physical address of memory region to encrypt * @len: len of memory region to encrypt */ struct sev_data_launch_update_vmsa { u32 handle; /* In */ u32 reserved; u64 address; /* In */ u32 len; /* In */ } __packed; /** * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters * * @handle: handle of the VM to process * @address: physical address containing the measurement blob * @len: len of measurement blob */ struct sev_data_launch_measure { u32 handle; /* In */ u32 reserved; u64 address; /* In */ u32 len; /* In/Out */ } __packed; /** * struct sev_data_launch_secret - LAUNCH_SECRET command parameters * * @handle: handle of the VM to process * @hdr_address: physical address containing the packet header * @hdr_len: len of packet header * @guest_address: system physical address of guest memory region * @guest_len: len of guest_paddr * @trans_address: physical address of transport memory buffer * @trans_len: len of transport memory buffer */ struct sev_data_launch_secret { u32 handle; /* In */ u32 reserved1; u64 hdr_address; /* In */ u32 hdr_len; /* In */ u32 reserved2; u64 guest_address; /* In */ u32 guest_len; /* In */ u32 reserved3; u64 trans_address; /* In */ u32 trans_len; /* In */ } __packed; /** * struct sev_data_launch_finish - LAUNCH_FINISH command parameters * * @handle: handle of the VM to process */ struct sev_data_launch_finish { u32 handle; /* In */ } __packed; /** * struct sev_data_send_start - SEND_START command parameters * * @handle: handle of the VM to process * @policy: policy information for the VM * @pdh_cert_address: physical address containing PDH certificate * @pdh_cert_len: len of PDH certificate * @plat_certs_address: physical address containing platform certificate * @plat_certs_len: len of platform certificate * @amd_certs_address: physical address containing AMD certificate * @amd_certs_len: len of AMD certificate * @session_address: physical address containing Session data * @session_len: len of session data */ struct sev_data_send_start { u32 handle; /* In */ u32 policy; /* Out */ u64 pdh_cert_address; /* In */ u32 pdh_cert_len; /* In */ u32 reserved1; u64 plat_certs_address; /* In */ u32 plat_certs_len; /* In */ u32 reserved2; u64 amd_certs_address; /* In */ u32 amd_certs_len; /* In */ u32 reserved3; u64 session_address; /* In */ u32 session_len; /* In/Out */ } __packed; /** * struct sev_data_send_update - SEND_UPDATE_DATA command * * @handle: handle of the VM to process * @hdr_address: physical address containing packet header * @hdr_len: len of packet header * @guest_address: physical address of guest memory region to send * @guest_len: len of guest memory region to send * @trans_address: physical address of host memory region * @trans_len: len of host memory region */ struct sev_data_send_update_data { u32 handle; /* In */ u32 reserved1; u64 hdr_address; /* In */ u32 hdr_len; /* In/Out */ u32 reserved2; u64 guest_address; /* In */ u32 guest_len; /* In */ u32 reserved3; u64 trans_address; /* In */ u32 trans_len; /* In */ } __packed; /** * struct sev_data_send_update - SEND_UPDATE_VMSA command * * @handle: handle of the VM to process * @hdr_address: physical address containing packet header * @hdr_len: len of packet header * @guest_address: physical address of guest memory region to send * @guest_len: len of guest memory region to send * @trans_address: physical address of host memory region * @trans_len: len of host memory region */ struct sev_data_send_update_vmsa { u32 handle; /* In */ u64 hdr_address; /* In */ u32 hdr_len; /* In/Out */ u32 reserved2; u64 guest_address; /* In */ u32 guest_len; /* In */ u32 reserved3; u64 trans_address; /* In */ u32 trans_len; /* In */ } __packed; /** * struct sev_data_send_finish - SEND_FINISH command parameters * * @handle: handle of the VM to process */ struct sev_data_send_finish { u32 handle; /* In */ } __packed; /** * struct sev_data_send_cancel - SEND_CANCEL command parameters * * @handle: handle of the VM to process */ struct sev_data_send_cancel { u32 handle; /* In */ } __packed; /** * struct sev_data_receive_start - RECEIVE_START command parameters * * @handle: handle of the VM to perform receive operation * @pdh_cert_address: system physical address containing PDH certificate blob * @pdh_cert_len: len of PDH certificate blob * @session_address: system physical address containing session blob * @session_len: len of session blob */ struct sev_data_receive_start { u32 handle; /* In/Out */ u32 policy; /* In */ u64 pdh_cert_address; /* In */ u32 pdh_cert_len; /* In */ u32 reserved1; u64 session_address; /* In */ u32 session_len; /* In */ } __packed; /** * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters * * @handle: handle of the VM to update * @hdr_address: physical address containing packet header blob * @hdr_len: len of packet header * @guest_address: system physical address of guest memory region * @guest_len: len of guest memory region * @trans_address: system physical address of transport buffer * @trans_len: len of transport buffer */ struct sev_data_receive_update_data { u32 handle; /* In */ u32 reserved1; u64 hdr_address; /* In */ u32 hdr_len; /* In */ u32 reserved2; u64 guest_address; /* In */ u32 guest_len; /* In */ u32 reserved3; u64 trans_address; /* In */ u32 trans_len; /* In */ } __packed; /** * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters * * @handle: handle of the VM to update * @hdr_address: physical address containing packet header blob * @hdr_len: len of packet header * @guest_address: system physical address of guest memory region * @guest_len: len of guest memory region * @trans_address: system physical address of transport buffer * @trans_len: len of transport buffer */ struct sev_data_receive_update_vmsa { u32 handle; /* In */ u32 reserved1; u64 hdr_address; /* In */ u32 hdr_len; /* In */ u32 reserved2; u64 guest_address; /* In */ u32 guest_len; /* In */ u32 reserved3; u64 trans_address; /* In */ u32 trans_len; /* In */ } __packed; /** * struct sev_data_receive_finish - RECEIVE_FINISH command parameters * * @handle: handle of the VM to finish */ struct sev_data_receive_finish { u32 handle; /* In */ } __packed; /** * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters * * @handle: handle of the VM to perform debug operation * @src_addr: source address of data to operate on * @dst_addr: destination address of data to operate on * @len: len of data to operate on */ struct sev_data_dbg { u32 handle; /* In */ u32 reserved; u64 src_addr; /* In */ u64 dst_addr; /* In */ u32 len; /* In */ } __packed; /** * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters * * @handle: handle of the VM * @mnonce: a random nonce that will be included in the report. * @address: physical address where the report will be copied. * @len: length of the physical buffer. */ struct sev_data_attestation_report { u32 handle; /* In */ u32 reserved; u64 address; /* In */ u8 mnonce[16]; /* In */ u32 len; /* In/Out */ } __packed; /** * struct sev_data_snp_download_firmware - SNP_DOWNLOAD_FIRMWARE command params * * @address: physical address of firmware image * @len: length of the firmware image */ struct sev_data_snp_download_firmware { u64 address; /* In */ u32 len; /* In */ } __packed; /** * struct sev_data_snp_activate - SNP_ACTIVATE command params * * @gctx_paddr: system physical address guest context page * @asid: ASID to bind to the guest */ struct sev_data_snp_activate { u64 gctx_paddr; /* In */ u32 asid; /* In */ } __packed; /** * struct sev_data_snp_addr - generic SNP command params * * @address: physical address of generic data param */ struct sev_data_snp_addr { u64 address; /* In/Out */ } __packed; /** * struct sev_data_snp_launch_start - SNP_LAUNCH_START command params * * @gctx_paddr: system physical address of guest context page * @policy: guest policy * @ma_gctx_paddr: system physical address of migration agent * @ma_en: the guest is associated with a migration agent * @imi_en: launch flow is launching an IMI (Incoming Migration Image) for the * purpose of guest-assisted migration. * @rsvd: reserved * @desired_tsc_khz: hypervisor desired mean TSC freq in kHz of the guest * @gosvw: guest OS-visible workarounds, as defined by hypervisor */ struct sev_data_snp_launch_start { u64 gctx_paddr; /* In */ u64 policy; /* In */ u64 ma_gctx_paddr; /* In */ u32 ma_en:1; /* In */ u32 imi_en:1; /* In */ u32 rsvd:30; u32 desired_tsc_khz; /* In */ u8 gosvw[16]; /* In */ } __packed; /* SNP support page type */ enum { SNP_PAGE_TYPE_NORMAL = 0x1, SNP_PAGE_TYPE_VMSA = 0x2, SNP_PAGE_TYPE_ZERO = 0x3, SNP_PAGE_TYPE_UNMEASURED = 0x4, SNP_PAGE_TYPE_SECRET = 0x5, SNP_PAGE_TYPE_CPUID = 0x6, SNP_PAGE_TYPE_MAX }; /** * struct sev_data_snp_launch_update - SNP_LAUNCH_UPDATE command params * * @gctx_paddr: system physical address of guest context page * @page_size: page size 0 indicates 4K and 1 indicates 2MB page * @page_type: encoded page type * @imi_page: indicates that this page is part of the IMI (Incoming Migration * Image) of the guest * @rsvd: reserved * @rsvd2: reserved * @address: system physical address of destination page to encrypt * @rsvd3: reserved * @vmpl1_perms: VMPL permission mask for VMPL1 * @vmpl2_perms: VMPL permission mask for VMPL2 * @vmpl3_perms: VMPL permission mask for VMPL3 * @rsvd4: reserved */ struct sev_data_snp_launch_update { u64 gctx_paddr; /* In */ u32 page_size:1; /* In */ u32 page_type:3; /* In */ u32 imi_page:1; /* In */ u32 rsvd:27; u32 rsvd2; u64 address; /* In */ u32 rsvd3:8; u32 vmpl1_perms:8; /* In */ u32 vmpl2_perms:8; /* In */ u32 vmpl3_perms:8; /* In */ u32 rsvd4; } __packed; /** * struct sev_data_snp_launch_finish - SNP_LAUNCH_FINISH command params * * @gctx_paddr: system physical address of guest context page * @id_block_paddr: system physical address of ID block * @id_auth_paddr: system physical address of ID block authentication structure * @id_block_en: indicates whether ID block is present * @auth_key_en: indicates whether author key is present in authentication structure * @vcek_disabled: indicates whether use of VCEK is allowed for attestation reports * @rsvd: reserved * @host_data: host-supplied data for guest, not interpreted by firmware */ struct sev_data_snp_launch_finish { u64 gctx_paddr; u64 id_block_paddr; u64 id_auth_paddr; u8 id_block_en:1; u8 auth_key_en:1; u8 vcek_disabled:1; u64 rsvd:61; u8 host_data[32]; } __packed; /** * struct sev_data_snp_guest_status - SNP_GUEST_STATUS command params * * @gctx_paddr: system physical address of guest context page * @address: system physical address of guest status page */ struct sev_data_snp_guest_status { u64 gctx_paddr; u64 address; } __packed; /** * struct sev_data_snp_page_reclaim - SNP_PAGE_RECLAIM command params * * @paddr: system physical address of page to be claimed. The 0th bit in the * address indicates the page size. 0h indicates 4KB and 1h indicates * 2MB page. */ struct sev_data_snp_page_reclaim { u64 paddr; } __packed; /** * struct sev_data_snp_page_unsmash - SNP_PAGE_UNSMASH command params * * @paddr: system physical address of page to be unsmashed. The 0th bit in the * address indicates the page size. 0h indicates 4 KB and 1h indicates * 2 MB page. */ struct sev_data_snp_page_unsmash { u64 paddr; } __packed; /** * struct sev_data_snp_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters * * @gctx_paddr: system physical address of guest context page * @src_addr: source address of data to operate on * @dst_addr: destination address of data to operate on */ struct sev_data_snp_dbg { u64 gctx_paddr; /* In */ u64 src_addr; /* In */ u64 dst_addr; /* In */ } __packed; /** * struct sev_data_snp_guest_request - SNP_GUEST_REQUEST command params * * @gctx_paddr: system physical address of guest context page * @req_paddr: system physical address of request page * @res_paddr: system physical address of response page */ struct sev_data_snp_guest_request { u64 gctx_paddr; /* In */ u64 req_paddr; /* In */ u64 res_paddr; /* In */ } __packed; /** * struct sev_data_snp_init_ex - SNP_INIT_EX structure * * @init_rmp: indicate that the RMP should be initialized. * @list_paddr_en: indicate that list_paddr is valid * @rsvd: reserved * @rsvd1: reserved * @list_paddr: system physical address of range list * @rsvd2: reserved */ struct sev_data_snp_init_ex { u32 init_rmp:1; u32 list_paddr_en:1; u32 rapl_dis:1; u32 ciphertext_hiding_en:1; u32 tio_en:1; u32 rsvd:27; u32 rsvd1; u64 list_paddr; u16 max_snp_asid; u8 rsvd2[46]; } __packed; /** * struct sev_data_range - RANGE structure * * @base: system physical address of first byte of range * @page_count: number of 4KB pages in this range * @rsvd: reserved */ struct sev_data_range { u64 base; u32 page_count; u32 rsvd; } __packed; /** * struct sev_data_range_list - RANGE_LIST structure * * @num_elements: number of elements in RANGE_ARRAY * @rsvd: reserved * @ranges: array of num_elements of type RANGE */ struct sev_data_range_list { u32 num_elements; u32 rsvd; struct sev_data_range ranges[]; } __packed; /** * struct sev_data_snp_shutdown_ex - SNP_SHUTDOWN_EX structure * * @len: length of the command buffer read by the PSP * @iommu_snp_shutdown: Disable enforcement of SNP in the IOMMU * @rsvd1: reserved */ struct sev_data_snp_shutdown_ex { u32 len; u32 iommu_snp_shutdown:1; u32 rsvd1:31; } __packed; /** * struct sev_platform_init_args * * @error: SEV firmware error code * @probe: True if this is being called as part of CCP module probe, which * will defer SEV_INIT/SEV_INIT_EX firmware initialization until needed * unless psp_init_on_probe module param is set * @max_snp_asid: When non-zero, enable ciphertext hiding and specify the * maximum ASID that can be used for an SEV-SNP guest. */ struct sev_platform_init_args { int error; bool probe; unsigned int max_snp_asid; }; /** * struct sev_data_snp_commit - SNP_COMMIT structure * * @len: length of the command buffer read by the PSP */ struct sev_data_snp_commit { u32 len; } __packed; /** * struct sev_data_snp_feature_info - SEV_SNP_FEATURE_INFO structure * * @length: len of the command buffer read by the PSP * @ecx_in: subfunction index * @feature_info_paddr : System Physical Address of the FEATURE_INFO structure */ struct sev_data_snp_feature_info { u32 length; u32 ecx_in; u64 feature_info_paddr; } __packed; /** * struct feature_info - FEATURE_INFO structure * * @eax: output of SNP_FEATURE_INFO command * @ebx: output of SNP_FEATURE_INFO command * @ecx: output of SNP_FEATURE_INFO command * #edx: output of SNP_FEATURE_INFO command */ struct snp_feature_info { u32 eax; u32 ebx; u32 ecx; u32 edx; } __packed; /* Feature bits in ECX */ #define SNP_RAPL_DISABLE_SUPPORTED BIT(2) #define SNP_CIPHER_TEXT_HIDING_SUPPORTED BIT(3) #define SNP_AES_256_XTS_POLICY_SUPPORTED BIT(4) #define SNP_CXL_ALLOW_POLICY_SUPPORTED BIT(5) /* Feature bits in EBX */ #define SNP_SEV_TIO_SUPPORTED BIT(1) #ifdef CONFIG_CRYPTO_DEV_SP_PSP /** * sev_module_init - perform PSP SEV module initialization * * Returns: * 0 if the PSP module is successfully initialized * negative value if the PSP module initialization fails */ int sev_module_init(void); /** * sev_platform_init - perform SEV INIT command * * @args: struct sev_platform_init_args to pass in arguments * * Returns: * 0 if the SEV successfully processed the command * -%ENODEV if the SEV device is not available * -%ENOTSUPP if the SEV does not support SEV * -%ETIMEDOUT if the SEV command timed out * -%EIO if the SEV returned a non-zero return code */ int sev_platform_init(struct sev_platform_init_args *args); /** * sev_platform_status - perform SEV PLATFORM_STATUS command * * @status: sev_user_data_status structure to be processed * @error: SEV command return code * * Returns: * 0 if the SEV successfully processed the command * -%ENODEV if the SEV device is not available * -%ENOTSUPP if the SEV does not support SEV * -%ETIMEDOUT if the SEV command timed out * -%EIO if the SEV returned a non-zero return code */ int sev_platform_status(struct sev_user_data_status *status, int *error); /** * sev_issue_cmd_external_user - issue SEV command by other driver with a file * handle. * * This function can be used by other drivers to issue a SEV command on * behalf of userspace. The caller must pass a valid SEV file descriptor * so that we know that it has access to SEV device. * * @filep - SEV device file pointer * @cmd - command to issue * @data - command buffer * @error: SEV command return code * * Returns: * 0 if the SEV successfully processed the command * -%ENODEV if the SEV device is not available * -%ENOTSUPP if the SEV does not support SEV * -%ETIMEDOUT if the SEV command timed out * -%EIO if the SEV returned a non-zero return code * -%EINVAL if the SEV file descriptor is not valid */ int sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error); /** * sev_guest_deactivate - perform SEV DEACTIVATE command * * @deactivate: sev_data_deactivate structure to be processed * @sev_ret: sev command return code * * Returns: * 0 if the sev successfully processed the command * -%ENODEV if the sev device is not available * -%ENOTSUPP if the sev does not support SEV * -%ETIMEDOUT if the sev command timed out * -%EIO if the sev returned a non-zero return code */ int sev_guest_deactivate(struct sev_data_deactivate *data, int *error); /** * sev_guest_activate - perform SEV ACTIVATE command * * @activate: sev_data_activate structure to be processed * @sev_ret: sev command return code * * Returns: * 0 if the sev successfully processed the command * -%ENODEV if the sev device is not available * -%ENOTSUPP if the sev does not support SEV * -%ETIMEDOUT if the sev command timed out * -%EIO if the sev returned a non-zero return code */ int sev_guest_activate(struct sev_data_activate *data, int *error); /** * sev_guest_df_flush - perform SEV DF_FLUSH command * * @sev_ret: sev command return code * * Returns: * 0 if the sev successfully processed the command * -%ENODEV if the sev device is not available * -%ENOTSUPP if the sev does not support SEV * -%ETIMEDOUT if the sev command timed out * -%EIO if the sev returned a non-zero return code */ int sev_guest_df_flush(int *error); /** * sev_guest_decommission - perform SEV DECOMMISSION command * * @decommission: sev_data_decommission structure to be processed * @sev_ret: sev command return code * * Returns: * 0 if the sev successfully processed the command * -%ENODEV if the sev device is not available * -%ENOTSUPP if the sev does not support SEV * -%ETIMEDOUT if the sev command timed out * -%EIO if the sev returned a non-zero return code */ int sev_guest_decommission(struct sev_data_decommission *data, int *error); /** * sev_do_cmd - issue an SEV or an SEV-SNP command * * @cmd: SEV or SEV-SNP firmware command to issue * @data: arguments for firmware command * @psp_ret: SEV command return code * * Returns: * 0 if the SEV device successfully processed the command * -%ENODEV if the PSP device is not available * -%ENOTSUPP if PSP device does not support SEV * -%ETIMEDOUT if the SEV command timed out * -%EIO if PSP device returned a non-zero return code */ int sev_do_cmd(int cmd, void *data, int *psp_ret); void *psp_copy_user_blob(u64 uaddr, u32 len); void *snp_alloc_firmware_page(gfp_t mask); int snp_reclaim_pages(unsigned long paddr, unsigned int npages, bool locked); void snp_free_firmware_page(void *addr); void sev_platform_shutdown(void); bool sev_is_snp_ciphertext_hiding_supported(void); u64 sev_get_snp_policy_bits(void); #else /* !CONFIG_CRYPTO_DEV_SP_PSP */ static inline int sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; } static inline int sev_platform_init(struct sev_platform_init_args *args) { return -ENODEV; } static inline int sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; } static inline int sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; } static inline int sev_do_cmd(int cmd, void *data, int *psp_ret) { return -ENODEV; } static inline int sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; } static inline int sev_guest_df_flush(int *error) { return -ENODEV; } static inline int sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; } static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); } static inline void *snp_alloc_firmware_page(gfp_t mask) { return NULL; } static inline int snp_reclaim_pages(unsigned long paddr, unsigned int npages, bool locked) { return -ENODEV; } static inline void snp_free_firmware_page(void *addr) { } static inline void sev_platform_shutdown(void) { } static inline bool sev_is_snp_ciphertext_hiding_supported(void) { return false; } #endif /* CONFIG_CRYPTO_DEV_SP_PSP */ #endif /* __PSP_SEV_H__ */
