FILE
psp-sev.h
File preview with syntax highlighting.
linux-6.19.14/include/linux/psp-sev.h
1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * AMD Secure Encrypted Virtualization (SEV) driver interface 4 * 5 * Copyright (C) 2016-2017 Advanced Micro Devices, Inc. 6 * 7 * Author: Brijesh Singh <brijesh.singh@amd.com> 8 * 9 * SEV API spec is available at https://developer.amd.com/sev 10 */ 11 12#ifndef __PSP_SEV_H__ 13#define __PSP_SEV_H__ 14 15#include <uapi/linux/psp-sev.h> 16 17/* As defined by SEV API, under "Guest Policy". */ 18#define SEV_POLICY_MASK_NODBG BIT(0) 19#define SEV_POLICY_MASK_NOKS BIT(1) 20#define SEV_POLICY_MASK_ES BIT(2) 21#define SEV_POLICY_MASK_NOSEND BIT(3) 22#define SEV_POLICY_MASK_DOMAIN BIT(4) 23#define SEV_POLICY_MASK_SEV BIT(5) 24#define SEV_POLICY_MASK_API_MAJOR GENMASK(23, 16) 25#define SEV_POLICY_MASK_API_MINOR GENMASK(31, 24) 26 27/* As defined by SEV-SNP Firmware ABI, under "Guest Policy". */ 28#define SNP_POLICY_MASK_API_MINOR GENMASK_ULL(7, 0) 29#define SNP_POLICY_MASK_API_MAJOR GENMASK_ULL(15, 8) 30#define SNP_POLICY_MASK_SMT BIT_ULL(16) 31#define SNP_POLICY_MASK_RSVD_MBO BIT_ULL(17) 32#define SNP_POLICY_MASK_MIGRATE_MA BIT_ULL(18) 33#define SNP_POLICY_MASK_DEBUG BIT_ULL(19) 34#define SNP_POLICY_MASK_SINGLE_SOCKET BIT_ULL(20) 35#define SNP_POLICY_MASK_CXL_ALLOW BIT_ULL(21) 36#define SNP_POLICY_MASK_MEM_AES_256_XTS BIT_ULL(22) 37#define SNP_POLICY_MASK_RAPL_DIS BIT_ULL(23) 38#define SNP_POLICY_MASK_CIPHERTEXT_HIDING_DRAM BIT_ULL(24) 39#define SNP_POLICY_MASK_PAGE_SWAP_DISABLE BIT_ULL(25) 40 41/* Base SEV-SNP policy bitmask for minimum supported SEV firmware version */ 42#define SNP_POLICY_MASK_BASE (SNP_POLICY_MASK_API_MINOR | \ 43 SNP_POLICY_MASK_API_MAJOR | \ 44 SNP_POLICY_MASK_SMT | \ 45 SNP_POLICY_MASK_RSVD_MBO | \ 46 SNP_POLICY_MASK_MIGRATE_MA | \ 47 SNP_POLICY_MASK_DEBUG | \ 48 SNP_POLICY_MASK_SINGLE_SOCKET) 49 50#define SEV_FW_BLOB_MAX_SIZE 0x4000 /* 16KB */ 51 52/** 53 * SEV platform state 54 */ 55enum sev_state { 56 SEV_STATE_UNINIT = 0x0, 57 SEV_STATE_INIT = 0x1, 58 SEV_STATE_WORKING = 0x2, 59 60 SEV_STATE_MAX 61}; 62 63/** 64 * SEV platform and guest management commands 65 */ 66enum sev_cmd { 67 /* platform commands */ 68 SEV_CMD_INIT = 0x001, 69 SEV_CMD_SHUTDOWN = 0x002, 70 SEV_CMD_FACTORY_RESET = 0x003, 71 SEV_CMD_PLATFORM_STATUS = 0x004, 72 SEV_CMD_PEK_GEN = 0x005, 73 SEV_CMD_PEK_CSR = 0x006, 74 SEV_CMD_PEK_CERT_IMPORT = 0x007, 75 SEV_CMD_PDH_CERT_EXPORT = 0x008, 76 SEV_CMD_PDH_GEN = 0x009, 77 SEV_CMD_DF_FLUSH = 0x00A, 78 SEV_CMD_DOWNLOAD_FIRMWARE = 0x00B, 79 SEV_CMD_GET_ID = 0x00C, 80 SEV_CMD_INIT_EX = 0x00D, 81 82 /* Guest commands */ 83 SEV_CMD_DECOMMISSION = 0x020, 84 SEV_CMD_ACTIVATE = 0x021, 85 SEV_CMD_DEACTIVATE = 0x022, 86 SEV_CMD_GUEST_STATUS = 0x023, 87 88 /* Guest launch commands */ 89 SEV_CMD_LAUNCH_START = 0x030, 90 SEV_CMD_LAUNCH_UPDATE_DATA = 0x031, 91 SEV_CMD_LAUNCH_UPDATE_VMSA = 0x032, 92 SEV_CMD_LAUNCH_MEASURE = 0x033, 93 SEV_CMD_LAUNCH_UPDATE_SECRET = 0x034, 94 SEV_CMD_LAUNCH_FINISH = 0x035, 95 SEV_CMD_ATTESTATION_REPORT = 0x036, 96 97 /* Guest migration commands (outgoing) */ 98 SEV_CMD_SEND_START = 0x040, 99 SEV_CMD_SEND_UPDATE_DATA = 0x041, 100 SEV_CMD_SEND_UPDATE_VMSA = 0x042, 101 SEV_CMD_SEND_FINISH = 0x043, 102 SEV_CMD_SEND_CANCEL = 0x044, 103 104 /* Guest migration commands (incoming) */ 105 SEV_CMD_RECEIVE_START = 0x050, 106 SEV_CMD_RECEIVE_UPDATE_DATA = 0x051, 107 SEV_CMD_RECEIVE_UPDATE_VMSA = 0x052, 108 SEV_CMD_RECEIVE_FINISH = 0x053, 109 110 /* Guest debug commands */ 111 SEV_CMD_DBG_DECRYPT = 0x060, 112 SEV_CMD_DBG_ENCRYPT = 0x061, 113 114 /* SNP specific commands */ 115 SEV_CMD_SNP_INIT = 0x081, 116 SEV_CMD_SNP_SHUTDOWN = 0x082, 117 SEV_CMD_SNP_PLATFORM_STATUS = 0x083, 118 SEV_CMD_SNP_DF_FLUSH = 0x084, 119 SEV_CMD_SNP_INIT_EX = 0x085, 120 SEV_CMD_SNP_SHUTDOWN_EX = 0x086, 121 SEV_CMD_SNP_DECOMMISSION = 0x090, 122 SEV_CMD_SNP_ACTIVATE = 0x091, 123 SEV_CMD_SNP_GUEST_STATUS = 0x092, 124 SEV_CMD_SNP_GCTX_CREATE = 0x093, 125 SEV_CMD_SNP_GUEST_REQUEST = 0x094, 126 SEV_CMD_SNP_ACTIVATE_EX = 0x095, 127 SEV_CMD_SNP_LAUNCH_START = 0x0A0, 128 SEV_CMD_SNP_LAUNCH_UPDATE = 0x0A1, 129 SEV_CMD_SNP_LAUNCH_FINISH = 0x0A2, 130 SEV_CMD_SNP_DBG_DECRYPT = 0x0B0, 131 SEV_CMD_SNP_DBG_ENCRYPT = 0x0B1, 132 SEV_CMD_SNP_PAGE_SWAP_OUT = 0x0C0, 133 SEV_CMD_SNP_PAGE_SWAP_IN = 0x0C1, 134 SEV_CMD_SNP_PAGE_MOVE = 0x0C2, 135 SEV_CMD_SNP_PAGE_MD_INIT = 0x0C3, 136 SEV_CMD_SNP_PAGE_SET_STATE = 0x0C6, 137 SEV_CMD_SNP_PAGE_RECLAIM = 0x0C7, 138 SEV_CMD_SNP_PAGE_UNSMASH = 0x0C8, 139 SEV_CMD_SNP_CONFIG = 0x0C9, 140 SEV_CMD_SNP_DOWNLOAD_FIRMWARE_EX = 0x0CA, 141 SEV_CMD_SNP_COMMIT = 0x0CB, 142 SEV_CMD_SNP_VLEK_LOAD = 0x0CD, 143 SEV_CMD_SNP_FEATURE_INFO = 0x0CE, 144 145 /* SEV-TIO commands */ 146 SEV_CMD_TIO_STATUS = 0x0D0, 147 SEV_CMD_TIO_INIT = 0x0D1, 148 SEV_CMD_TIO_DEV_CREATE = 0x0D2, 149 SEV_CMD_TIO_DEV_RECLAIM = 0x0D3, 150 SEV_CMD_TIO_DEV_CONNECT = 0x0D4, 151 SEV_CMD_TIO_DEV_DISCONNECT = 0x0D5, 152 SEV_CMD_MAX, 153}; 154 155/** 156 * struct sev_data_init - INIT command parameters 157 * 158 * @flags: processing flags 159 * @tmr_address: system physical address used for SEV-ES 160 * @tmr_len: len of tmr_address 161 */ 162struct sev_data_init { 163 u32 flags; /* In */ 164 u32 reserved; /* In */ 165 u64 tmr_address; /* In */ 166 u32 tmr_len; /* In */ 167} __packed; 168 169/** 170 * struct sev_data_init_ex - INIT_EX command parameters 171 * 172 * @length: len of the command buffer read by the PSP 173 * @flags: processing flags 174 * @tmr_address: system physical address used for SEV-ES 175 * @tmr_len: len of tmr_address 176 * @nv_address: system physical address used for PSP NV storage 177 * @nv_len: len of nv_address 178 */ 179struct sev_data_init_ex { 180 u32 length; /* In */ 181 u32 flags; /* In */ 182 u64 tmr_address; /* In */ 183 u32 tmr_len; /* In */ 184 u32 reserved; /* In */ 185 u64 nv_address; /* In/Out */ 186 u32 nv_len; /* In */ 187} __packed; 188 189#define SEV_INIT_FLAGS_SEV_ES 0x01 190 191/** 192 * struct sev_data_pek_csr - PEK_CSR command parameters 193 * 194 * @address: PEK certificate chain 195 * @len: len of certificate 196 */ 197struct sev_data_pek_csr { 198 u64 address; /* In */ 199 u32 len; /* In/Out */ 200} __packed; 201 202/** 203 * struct sev_data_cert_import - PEK_CERT_IMPORT command parameters 204 * 205 * @pek_address: PEK certificate chain 206 * @pek_len: len of PEK certificate 207 * @oca_address: OCA certificate chain 208 * @oca_len: len of OCA certificate 209 */ 210struct sev_data_pek_cert_import { 211 u64 pek_cert_address; /* In */ 212 u32 pek_cert_len; /* In */ 213 u32 reserved; /* In */ 214 u64 oca_cert_address; /* In */ 215 u32 oca_cert_len; /* In */ 216} __packed; 217 218/** 219 * struct sev_data_download_firmware - DOWNLOAD_FIRMWARE command parameters 220 * 221 * @address: physical address of firmware image 222 * @len: len of the firmware image 223 */ 224struct sev_data_download_firmware { 225 u64 address; /* In */ 226 u32 len; /* In */ 227} __packed; 228 229/** 230 * struct sev_data_get_id - GET_ID command parameters 231 * 232 * @address: physical address of region to place unique CPU ID(s) 233 * @len: len of the region 234 */ 235struct sev_data_get_id { 236 u64 address; /* In */ 237 u32 len; /* In/Out */ 238} __packed; 239/** 240 * struct sev_data_pdh_cert_export - PDH_CERT_EXPORT command parameters 241 * 242 * @pdh_address: PDH certificate address 243 * @pdh_len: len of PDH certificate 244 * @cert_chain_address: PDH certificate chain 245 * @cert_chain_len: len of PDH certificate chain 246 */ 247struct sev_data_pdh_cert_export { 248 u64 pdh_cert_address; /* In */ 249 u32 pdh_cert_len; /* In/Out */ 250 u32 reserved; /* In */ 251 u64 cert_chain_address; /* In */ 252 u32 cert_chain_len; /* In/Out */ 253} __packed; 254 255/** 256 * struct sev_data_decommission - DECOMMISSION command parameters 257 * 258 * @handle: handle of the VM to decommission 259 */ 260struct sev_data_decommission { 261 u32 handle; /* In */ 262} __packed; 263 264/** 265 * struct sev_data_activate - ACTIVATE command parameters 266 * 267 * @handle: handle of the VM to activate 268 * @asid: asid assigned to the VM 269 */ 270struct sev_data_activate { 271 u32 handle; /* In */ 272 u32 asid; /* In */ 273} __packed; 274 275/** 276 * struct sev_data_deactivate - DEACTIVATE command parameters 277 * 278 * @handle: handle of the VM to deactivate 279 */ 280struct sev_data_deactivate { 281 u32 handle; /* In */ 282} __packed; 283 284/** 285 * struct sev_data_guest_status - SEV GUEST_STATUS command parameters 286 * 287 * @handle: handle of the VM to retrieve status 288 * @policy: policy information for the VM 289 * @asid: current ASID of the VM 290 * @state: current state of the VM 291 */ 292struct sev_data_guest_status { 293 u32 handle; /* In */ 294 u32 policy; /* Out */ 295 u32 asid; /* Out */ 296 u8 state; /* Out */ 297} __packed; 298 299/** 300 * struct sev_data_launch_start - LAUNCH_START command parameters 301 * 302 * @handle: handle assigned to the VM 303 * @policy: guest launch policy 304 * @dh_cert_address: physical address of DH certificate blob 305 * @dh_cert_len: len of DH certificate blob 306 * @session_address: physical address of session parameters 307 * @session_len: len of session parameters 308 */ 309struct sev_data_launch_start { 310 u32 handle; /* In/Out */ 311 u32 policy; /* In */ 312 u64 dh_cert_address; /* In */ 313 u32 dh_cert_len; /* In */ 314 u32 reserved; /* In */ 315 u64 session_address; /* In */ 316 u32 session_len; /* In */ 317} __packed; 318 319/** 320 * struct sev_data_launch_update_data - LAUNCH_UPDATE_DATA command parameter 321 * 322 * @handle: handle of the VM to update 323 * @len: len of memory to be encrypted 324 * @address: physical address of memory region to encrypt 325 */ 326struct sev_data_launch_update_data { 327 u32 handle; /* In */ 328 u32 reserved; 329 u64 address; /* In */ 330 u32 len; /* In */ 331} __packed; 332 333/** 334 * struct sev_data_launch_update_vmsa - LAUNCH_UPDATE_VMSA command 335 * 336 * @handle: handle of the VM 337 * @address: physical address of memory region to encrypt 338 * @len: len of memory region to encrypt 339 */ 340struct sev_data_launch_update_vmsa { 341 u32 handle; /* In */ 342 u32 reserved; 343 u64 address; /* In */ 344 u32 len; /* In */ 345} __packed; 346 347/** 348 * struct sev_data_launch_measure - LAUNCH_MEASURE command parameters 349 * 350 * @handle: handle of the VM to process 351 * @address: physical address containing the measurement blob 352 * @len: len of measurement blob 353 */ 354struct sev_data_launch_measure { 355 u32 handle; /* In */ 356 u32 reserved; 357 u64 address; /* In */ 358 u32 len; /* In/Out */ 359} __packed; 360 361/** 362 * struct sev_data_launch_secret - LAUNCH_SECRET command parameters 363 * 364 * @handle: handle of the VM to process 365 * @hdr_address: physical address containing the packet header 366 * @hdr_len: len of packet header 367 * @guest_address: system physical address of guest memory region 368 * @guest_len: len of guest_paddr 369 * @trans_address: physical address of transport memory buffer 370 * @trans_len: len of transport memory buffer 371 */ 372struct sev_data_launch_secret { 373 u32 handle; /* In */ 374 u32 reserved1; 375 u64 hdr_address; /* In */ 376 u32 hdr_len; /* In */ 377 u32 reserved2; 378 u64 guest_address; /* In */ 379 u32 guest_len; /* In */ 380 u32 reserved3; 381 u64 trans_address; /* In */ 382 u32 trans_len; /* In */ 383} __packed; 384 385/** 386 * struct sev_data_launch_finish - LAUNCH_FINISH command parameters 387 * 388 * @handle: handle of the VM to process 389 */ 390struct sev_data_launch_finish { 391 u32 handle; /* In */ 392} __packed; 393 394/** 395 * struct sev_data_send_start - SEND_START command parameters 396 * 397 * @handle: handle of the VM to process 398 * @policy: policy information for the VM 399 * @pdh_cert_address: physical address containing PDH certificate 400 * @pdh_cert_len: len of PDH certificate 401 * @plat_certs_address: physical address containing platform certificate 402 * @plat_certs_len: len of platform certificate 403 * @amd_certs_address: physical address containing AMD certificate 404 * @amd_certs_len: len of AMD certificate 405 * @session_address: physical address containing Session data 406 * @session_len: len of session data 407 */ 408struct sev_data_send_start { 409 u32 handle; /* In */ 410 u32 policy; /* Out */ 411 u64 pdh_cert_address; /* In */ 412 u32 pdh_cert_len; /* In */ 413 u32 reserved1; 414 u64 plat_certs_address; /* In */ 415 u32 plat_certs_len; /* In */ 416 u32 reserved2; 417 u64 amd_certs_address; /* In */ 418 u32 amd_certs_len; /* In */ 419 u32 reserved3; 420 u64 session_address; /* In */ 421 u32 session_len; /* In/Out */ 422} __packed; 423 424/** 425 * struct sev_data_send_update - SEND_UPDATE_DATA command 426 * 427 * @handle: handle of the VM to process 428 * @hdr_address: physical address containing packet header 429 * @hdr_len: len of packet header 430 * @guest_address: physical address of guest memory region to send 431 * @guest_len: len of guest memory region to send 432 * @trans_address: physical address of host memory region 433 * @trans_len: len of host memory region 434 */ 435struct sev_data_send_update_data { 436 u32 handle; /* In */ 437 u32 reserved1; 438 u64 hdr_address; /* In */ 439 u32 hdr_len; /* In/Out */ 440 u32 reserved2; 441 u64 guest_address; /* In */ 442 u32 guest_len; /* In */ 443 u32 reserved3; 444 u64 trans_address; /* In */ 445 u32 trans_len; /* In */ 446} __packed; 447 448/** 449 * struct sev_data_send_update - SEND_UPDATE_VMSA command 450 * 451 * @handle: handle of the VM to process 452 * @hdr_address: physical address containing packet header 453 * @hdr_len: len of packet header 454 * @guest_address: physical address of guest memory region to send 455 * @guest_len: len of guest memory region to send 456 * @trans_address: physical address of host memory region 457 * @trans_len: len of host memory region 458 */ 459struct sev_data_send_update_vmsa { 460 u32 handle; /* In */ 461 u64 hdr_address; /* In */ 462 u32 hdr_len; /* In/Out */ 463 u32 reserved2; 464 u64 guest_address; /* In */ 465 u32 guest_len; /* In */ 466 u32 reserved3; 467 u64 trans_address; /* In */ 468 u32 trans_len; /* In */ 469} __packed; 470 471/** 472 * struct sev_data_send_finish - SEND_FINISH command parameters 473 * 474 * @handle: handle of the VM to process 475 */ 476struct sev_data_send_finish { 477 u32 handle; /* In */ 478} __packed; 479 480/** 481 * struct sev_data_send_cancel - SEND_CANCEL command parameters 482 * 483 * @handle: handle of the VM to process 484 */ 485struct sev_data_send_cancel { 486 u32 handle; /* In */ 487} __packed; 488 489/** 490 * struct sev_data_receive_start - RECEIVE_START command parameters 491 * 492 * @handle: handle of the VM to perform receive operation 493 * @pdh_cert_address: system physical address containing PDH certificate blob 494 * @pdh_cert_len: len of PDH certificate blob 495 * @session_address: system physical address containing session blob 496 * @session_len: len of session blob 497 */ 498struct sev_data_receive_start { 499 u32 handle; /* In/Out */ 500 u32 policy; /* In */ 501 u64 pdh_cert_address; /* In */ 502 u32 pdh_cert_len; /* In */ 503 u32 reserved1; 504 u64 session_address; /* In */ 505 u32 session_len; /* In */ 506} __packed; 507 508/** 509 * struct sev_data_receive_update_data - RECEIVE_UPDATE_DATA command parameters 510 * 511 * @handle: handle of the VM to update 512 * @hdr_address: physical address containing packet header blob 513 * @hdr_len: len of packet header 514 * @guest_address: system physical address of guest memory region 515 * @guest_len: len of guest memory region 516 * @trans_address: system physical address of transport buffer 517 * @trans_len: len of transport buffer 518 */ 519struct sev_data_receive_update_data { 520 u32 handle; /* In */ 521 u32 reserved1; 522 u64 hdr_address; /* In */ 523 u32 hdr_len; /* In */ 524 u32 reserved2; 525 u64 guest_address; /* In */ 526 u32 guest_len; /* In */ 527 u32 reserved3; 528 u64 trans_address; /* In */ 529 u32 trans_len; /* In */ 530} __packed; 531 532/** 533 * struct sev_data_receive_update_vmsa - RECEIVE_UPDATE_VMSA command parameters 534 * 535 * @handle: handle of the VM to update 536 * @hdr_address: physical address containing packet header blob 537 * @hdr_len: len of packet header 538 * @guest_address: system physical address of guest memory region 539 * @guest_len: len of guest memory region 540 * @trans_address: system physical address of transport buffer 541 * @trans_len: len of transport buffer 542 */ 543struct sev_data_receive_update_vmsa { 544 u32 handle; /* In */ 545 u32 reserved1; 546 u64 hdr_address; /* In */ 547 u32 hdr_len; /* In */ 548 u32 reserved2; 549 u64 guest_address; /* In */ 550 u32 guest_len; /* In */ 551 u32 reserved3; 552 u64 trans_address; /* In */ 553 u32 trans_len; /* In */ 554} __packed; 555 556/** 557 * struct sev_data_receive_finish - RECEIVE_FINISH command parameters 558 * 559 * @handle: handle of the VM to finish 560 */ 561struct sev_data_receive_finish { 562 u32 handle; /* In */ 563} __packed; 564 565/** 566 * struct sev_data_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters 567 * 568 * @handle: handle of the VM to perform debug operation 569 * @src_addr: source address of data to operate on 570 * @dst_addr: destination address of data to operate on 571 * @len: len of data to operate on 572 */ 573struct sev_data_dbg { 574 u32 handle; /* In */ 575 u32 reserved; 576 u64 src_addr; /* In */ 577 u64 dst_addr; /* In */ 578 u32 len; /* In */ 579} __packed; 580 581/** 582 * struct sev_data_attestation_report - SEV_ATTESTATION_REPORT command parameters 583 * 584 * @handle: handle of the VM 585 * @mnonce: a random nonce that will be included in the report. 586 * @address: physical address where the report will be copied. 587 * @len: length of the physical buffer. 588 */ 589struct sev_data_attestation_report { 590 u32 handle; /* In */ 591 u32 reserved; 592 u64 address; /* In */ 593 u8 mnonce[16]; /* In */ 594 u32 len; /* In/Out */ 595} __packed; 596 597/** 598 * struct sev_data_snp_download_firmware - SNP_DOWNLOAD_FIRMWARE command params 599 * 600 * @address: physical address of firmware image 601 * @len: length of the firmware image 602 */ 603struct sev_data_snp_download_firmware { 604 u64 address; /* In */ 605 u32 len; /* In */ 606} __packed; 607 608/** 609 * struct sev_data_snp_activate - SNP_ACTIVATE command params 610 * 611 * @gctx_paddr: system physical address guest context page 612 * @asid: ASID to bind to the guest 613 */ 614struct sev_data_snp_activate { 615 u64 gctx_paddr; /* In */ 616 u32 asid; /* In */ 617} __packed; 618 619/** 620 * struct sev_data_snp_addr - generic SNP command params 621 * 622 * @address: physical address of generic data param 623 */ 624struct sev_data_snp_addr { 625 u64 address; /* In/Out */ 626} __packed; 627 628/** 629 * struct sev_data_snp_launch_start - SNP_LAUNCH_START command params 630 * 631 * @gctx_paddr: system physical address of guest context page 632 * @policy: guest policy 633 * @ma_gctx_paddr: system physical address of migration agent 634 * @ma_en: the guest is associated with a migration agent 635 * @imi_en: launch flow is launching an IMI (Incoming Migration Image) for the 636 * purpose of guest-assisted migration. 637 * @rsvd: reserved 638 * @desired_tsc_khz: hypervisor desired mean TSC freq in kHz of the guest 639 * @gosvw: guest OS-visible workarounds, as defined by hypervisor 640 */ 641struct sev_data_snp_launch_start { 642 u64 gctx_paddr; /* In */ 643 u64 policy; /* In */ 644 u64 ma_gctx_paddr; /* In */ 645 u32 ma_en:1; /* In */ 646 u32 imi_en:1; /* In */ 647 u32 rsvd:30; 648 u32 desired_tsc_khz; /* In */ 649 u8 gosvw[16]; /* In */ 650} __packed; 651 652/* SNP support page type */ 653enum { 654 SNP_PAGE_TYPE_NORMAL = 0x1, 655 SNP_PAGE_TYPE_VMSA = 0x2, 656 SNP_PAGE_TYPE_ZERO = 0x3, 657 SNP_PAGE_TYPE_UNMEASURED = 0x4, 658 SNP_PAGE_TYPE_SECRET = 0x5, 659 SNP_PAGE_TYPE_CPUID = 0x6, 660 661 SNP_PAGE_TYPE_MAX 662}; 663 664/** 665 * struct sev_data_snp_launch_update - SNP_LAUNCH_UPDATE command params 666 * 667 * @gctx_paddr: system physical address of guest context page 668 * @page_size: page size 0 indicates 4K and 1 indicates 2MB page 669 * @page_type: encoded page type 670 * @imi_page: indicates that this page is part of the IMI (Incoming Migration 671 * Image) of the guest 672 * @rsvd: reserved 673 * @rsvd2: reserved 674 * @address: system physical address of destination page to encrypt 675 * @rsvd3: reserved 676 * @vmpl1_perms: VMPL permission mask for VMPL1 677 * @vmpl2_perms: VMPL permission mask for VMPL2 678 * @vmpl3_perms: VMPL permission mask for VMPL3 679 * @rsvd4: reserved 680 */ 681struct sev_data_snp_launch_update { 682 u64 gctx_paddr; /* In */ 683 u32 page_size:1; /* In */ 684 u32 page_type:3; /* In */ 685 u32 imi_page:1; /* In */ 686 u32 rsvd:27; 687 u32 rsvd2; 688 u64 address; /* In */ 689 u32 rsvd3:8; 690 u32 vmpl1_perms:8; /* In */ 691 u32 vmpl2_perms:8; /* In */ 692 u32 vmpl3_perms:8; /* In */ 693 u32 rsvd4; 694} __packed; 695 696/** 697 * struct sev_data_snp_launch_finish - SNP_LAUNCH_FINISH command params 698 * 699 * @gctx_paddr: system physical address of guest context page 700 * @id_block_paddr: system physical address of ID block 701 * @id_auth_paddr: system physical address of ID block authentication structure 702 * @id_block_en: indicates whether ID block is present 703 * @auth_key_en: indicates whether author key is present in authentication structure 704 * @vcek_disabled: indicates whether use of VCEK is allowed for attestation reports 705 * @rsvd: reserved 706 * @host_data: host-supplied data for guest, not interpreted by firmware 707 */ 708struct sev_data_snp_launch_finish { 709 u64 gctx_paddr; 710 u64 id_block_paddr; 711 u64 id_auth_paddr; 712 u8 id_block_en:1; 713 u8 auth_key_en:1; 714 u8 vcek_disabled:1; 715 u64 rsvd:61; 716 u8 host_data[32]; 717} __packed; 718 719/** 720 * struct sev_data_snp_guest_status - SNP_GUEST_STATUS command params 721 * 722 * @gctx_paddr: system physical address of guest context page 723 * @address: system physical address of guest status page 724 */ 725struct sev_data_snp_guest_status { 726 u64 gctx_paddr; 727 u64 address; 728} __packed; 729 730/** 731 * struct sev_data_snp_page_reclaim - SNP_PAGE_RECLAIM command params 732 * 733 * @paddr: system physical address of page to be claimed. The 0th bit in the 734 * address indicates the page size. 0h indicates 4KB and 1h indicates 735 * 2MB page. 736 */ 737struct sev_data_snp_page_reclaim { 738 u64 paddr; 739} __packed; 740 741/** 742 * struct sev_data_snp_page_unsmash - SNP_PAGE_UNSMASH command params 743 * 744 * @paddr: system physical address of page to be unsmashed. The 0th bit in the 745 * address indicates the page size. 0h indicates 4 KB and 1h indicates 746 * 2 MB page. 747 */ 748struct sev_data_snp_page_unsmash { 749 u64 paddr; 750} __packed; 751 752/** 753 * struct sev_data_snp_dbg - DBG_ENCRYPT/DBG_DECRYPT command parameters 754 * 755 * @gctx_paddr: system physical address of guest context page 756 * @src_addr: source address of data to operate on 757 * @dst_addr: destination address of data to operate on 758 */ 759struct sev_data_snp_dbg { 760 u64 gctx_paddr; /* In */ 761 u64 src_addr; /* In */ 762 u64 dst_addr; /* In */ 763} __packed; 764 765/** 766 * struct sev_data_snp_guest_request - SNP_GUEST_REQUEST command params 767 * 768 * @gctx_paddr: system physical address of guest context page 769 * @req_paddr: system physical address of request page 770 * @res_paddr: system physical address of response page 771 */ 772struct sev_data_snp_guest_request { 773 u64 gctx_paddr; /* In */ 774 u64 req_paddr; /* In */ 775 u64 res_paddr; /* In */ 776} __packed; 777 778/** 779 * struct sev_data_snp_init_ex - SNP_INIT_EX structure 780 * 781 * @init_rmp: indicate that the RMP should be initialized. 782 * @list_paddr_en: indicate that list_paddr is valid 783 * @rsvd: reserved 784 * @rsvd1: reserved 785 * @list_paddr: system physical address of range list 786 * @rsvd2: reserved 787 */ 788struct sev_data_snp_init_ex { 789 u32 init_rmp:1; 790 u32 list_paddr_en:1; 791 u32 rapl_dis:1; 792 u32 ciphertext_hiding_en:1; 793 u32 tio_en:1; 794 u32 rsvd:27; 795 u32 rsvd1; 796 u64 list_paddr; 797 u16 max_snp_asid; 798 u8 rsvd2[46]; 799} __packed; 800 801/** 802 * struct sev_data_range - RANGE structure 803 * 804 * @base: system physical address of first byte of range 805 * @page_count: number of 4KB pages in this range 806 * @rsvd: reserved 807 */ 808struct sev_data_range { 809 u64 base; 810 u32 page_count; 811 u32 rsvd; 812} __packed; 813 814/** 815 * struct sev_data_range_list - RANGE_LIST structure 816 * 817 * @num_elements: number of elements in RANGE_ARRAY 818 * @rsvd: reserved 819 * @ranges: array of num_elements of type RANGE 820 */ 821struct sev_data_range_list { 822 u32 num_elements; 823 u32 rsvd; 824 struct sev_data_range ranges[]; 825} __packed; 826 827/** 828 * struct sev_data_snp_shutdown_ex - SNP_SHUTDOWN_EX structure 829 * 830 * @len: length of the command buffer read by the PSP 831 * @iommu_snp_shutdown: Disable enforcement of SNP in the IOMMU 832 * @rsvd1: reserved 833 */ 834struct sev_data_snp_shutdown_ex { 835 u32 len; 836 u32 iommu_snp_shutdown:1; 837 u32 rsvd1:31; 838} __packed; 839 840/** 841 * struct sev_platform_init_args 842 * 843 * @error: SEV firmware error code 844 * @probe: True if this is being called as part of CCP module probe, which 845 * will defer SEV_INIT/SEV_INIT_EX firmware initialization until needed 846 * unless psp_init_on_probe module param is set 847 * @max_snp_asid: When non-zero, enable ciphertext hiding and specify the 848 * maximum ASID that can be used for an SEV-SNP guest. 849 */ 850struct sev_platform_init_args { 851 int error; 852 bool probe; 853 unsigned int max_snp_asid; 854}; 855 856/** 857 * struct sev_data_snp_commit - SNP_COMMIT structure 858 * 859 * @len: length of the command buffer read by the PSP 860 */ 861struct sev_data_snp_commit { 862 u32 len; 863} __packed; 864 865/** 866 * struct sev_data_snp_feature_info - SEV_SNP_FEATURE_INFO structure 867 * 868 * @length: len of the command buffer read by the PSP 869 * @ecx_in: subfunction index 870 * @feature_info_paddr : System Physical Address of the FEATURE_INFO structure 871 */ 872struct sev_data_snp_feature_info { 873 u32 length; 874 u32 ecx_in; 875 u64 feature_info_paddr; 876} __packed; 877 878/** 879 * struct feature_info - FEATURE_INFO structure 880 * 881 * @eax: output of SNP_FEATURE_INFO command 882 * @ebx: output of SNP_FEATURE_INFO command 883 * @ecx: output of SNP_FEATURE_INFO command 884 * #edx: output of SNP_FEATURE_INFO command 885 */ 886struct snp_feature_info { 887 u32 eax; 888 u32 ebx; 889 u32 ecx; 890 u32 edx; 891} __packed; 892 893/* Feature bits in ECX */ 894#define SNP_RAPL_DISABLE_SUPPORTED BIT(2) 895#define SNP_CIPHER_TEXT_HIDING_SUPPORTED BIT(3) 896#define SNP_AES_256_XTS_POLICY_SUPPORTED BIT(4) 897#define SNP_CXL_ALLOW_POLICY_SUPPORTED BIT(5) 898 899/* Feature bits in EBX */ 900#define SNP_SEV_TIO_SUPPORTED BIT(1) 901 902#ifdef CONFIG_CRYPTO_DEV_SP_PSP 903 904/** 905 * sev_module_init - perform PSP SEV module initialization 906 * 907 * Returns: 908 * 0 if the PSP module is successfully initialized 909 * negative value if the PSP module initialization fails 910 */ 911int sev_module_init(void); 912 913/** 914 * sev_platform_init - perform SEV INIT command 915 * 916 * @args: struct sev_platform_init_args to pass in arguments 917 * 918 * Returns: 919 * 0 if the SEV successfully processed the command 920 * -%ENODEV if the SEV device is not available 921 * -%ENOTSUPP if the SEV does not support SEV 922 * -%ETIMEDOUT if the SEV command timed out 923 * -%EIO if the SEV returned a non-zero return code 924 */ 925int sev_platform_init(struct sev_platform_init_args *args); 926 927/** 928 * sev_platform_status - perform SEV PLATFORM_STATUS command 929 * 930 * @status: sev_user_data_status structure to be processed 931 * @error: SEV command return code 932 * 933 * Returns: 934 * 0 if the SEV successfully processed the command 935 * -%ENODEV if the SEV device is not available 936 * -%ENOTSUPP if the SEV does not support SEV 937 * -%ETIMEDOUT if the SEV command timed out 938 * -%EIO if the SEV returned a non-zero return code 939 */ 940int sev_platform_status(struct sev_user_data_status *status, int *error); 941 942/** 943 * sev_issue_cmd_external_user - issue SEV command by other driver with a file 944 * handle. 945 * 946 * This function can be used by other drivers to issue a SEV command on 947 * behalf of userspace. The caller must pass a valid SEV file descriptor 948 * so that we know that it has access to SEV device. 949 * 950 * @filep - SEV device file pointer 951 * @cmd - command to issue 952 * @data - command buffer 953 * @error: SEV command return code 954 * 955 * Returns: 956 * 0 if the SEV successfully processed the command 957 * -%ENODEV if the SEV device is not available 958 * -%ENOTSUPP if the SEV does not support SEV 959 * -%ETIMEDOUT if the SEV command timed out 960 * -%EIO if the SEV returned a non-zero return code 961 * -%EINVAL if the SEV file descriptor is not valid 962 */ 963int sev_issue_cmd_external_user(struct file *filep, unsigned int id, 964 void *data, int *error); 965 966/** 967 * sev_guest_deactivate - perform SEV DEACTIVATE command 968 * 969 * @deactivate: sev_data_deactivate structure to be processed 970 * @sev_ret: sev command return code 971 * 972 * Returns: 973 * 0 if the sev successfully processed the command 974 * -%ENODEV if the sev device is not available 975 * -%ENOTSUPP if the sev does not support SEV 976 * -%ETIMEDOUT if the sev command timed out 977 * -%EIO if the sev returned a non-zero return code 978 */ 979int sev_guest_deactivate(struct sev_data_deactivate *data, int *error); 980 981/** 982 * sev_guest_activate - perform SEV ACTIVATE command 983 * 984 * @activate: sev_data_activate structure to be processed 985 * @sev_ret: sev command return code 986 * 987 * Returns: 988 * 0 if the sev successfully processed the command 989 * -%ENODEV if the sev device is not available 990 * -%ENOTSUPP if the sev does not support SEV 991 * -%ETIMEDOUT if the sev command timed out 992 * -%EIO if the sev returned a non-zero return code 993 */ 994int sev_guest_activate(struct sev_data_activate *data, int *error); 995 996/** 997 * sev_guest_df_flush - perform SEV DF_FLUSH command 998 * 999 * @sev_ret: sev command return code 1000 * 1001 * Returns: 1002 * 0 if the sev successfully processed the command 1003 * -%ENODEV if the sev device is not available 1004 * -%ENOTSUPP if the sev does not support SEV 1005 * -%ETIMEDOUT if the sev command timed out 1006 * -%EIO if the sev returned a non-zero return code 1007 */ 1008int sev_guest_df_flush(int *error); 1009 1010/** 1011 * sev_guest_decommission - perform SEV DECOMMISSION command 1012 * 1013 * @decommission: sev_data_decommission structure to be processed 1014 * @sev_ret: sev command return code 1015 * 1016 * Returns: 1017 * 0 if the sev successfully processed the command 1018 * -%ENODEV if the sev device is not available 1019 * -%ENOTSUPP if the sev does not support SEV 1020 * -%ETIMEDOUT if the sev command timed out 1021 * -%EIO if the sev returned a non-zero return code 1022 */ 1023int sev_guest_decommission(struct sev_data_decommission *data, int *error); 1024 1025/** 1026 * sev_do_cmd - issue an SEV or an SEV-SNP command 1027 * 1028 * @cmd: SEV or SEV-SNP firmware command to issue 1029 * @data: arguments for firmware command 1030 * @psp_ret: SEV command return code 1031 * 1032 * Returns: 1033 * 0 if the SEV device successfully processed the command 1034 * -%ENODEV if the PSP device is not available 1035 * -%ENOTSUPP if PSP device does not support SEV 1036 * -%ETIMEDOUT if the SEV command timed out 1037 * -%EIO if PSP device returned a non-zero return code 1038 */ 1039int sev_do_cmd(int cmd, void *data, int *psp_ret); 1040 1041void *psp_copy_user_blob(u64 uaddr, u32 len); 1042void *snp_alloc_firmware_page(gfp_t mask); 1043int snp_reclaim_pages(unsigned long paddr, unsigned int npages, bool locked); 1044void snp_free_firmware_page(void *addr); 1045void sev_platform_shutdown(void); 1046bool sev_is_snp_ciphertext_hiding_supported(void); 1047u64 sev_get_snp_policy_bits(void); 1048 1049#else /* !CONFIG_CRYPTO_DEV_SP_PSP */ 1050 1051static inline int 1052sev_platform_status(struct sev_user_data_status *status, int *error) { return -ENODEV; } 1053 1054static inline int sev_platform_init(struct sev_platform_init_args *args) { return -ENODEV; } 1055 1056static inline int 1057sev_guest_deactivate(struct sev_data_deactivate *data, int *error) { return -ENODEV; } 1058 1059static inline int 1060sev_guest_decommission(struct sev_data_decommission *data, int *error) { return -ENODEV; } 1061 1062static inline int 1063sev_do_cmd(int cmd, void *data, int *psp_ret) { return -ENODEV; } 1064 1065static inline int 1066sev_guest_activate(struct sev_data_activate *data, int *error) { return -ENODEV; } 1067 1068static inline int sev_guest_df_flush(int *error) { return -ENODEV; } 1069 1070static inline int 1071sev_issue_cmd_external_user(struct file *filep, unsigned int id, void *data, int *error) { return -ENODEV; } 1072 1073static inline void *psp_copy_user_blob(u64 __user uaddr, u32 len) { return ERR_PTR(-EINVAL); } 1074 1075static inline void *snp_alloc_firmware_page(gfp_t mask) 1076{ 1077 return NULL; 1078} 1079 1080static inline int snp_reclaim_pages(unsigned long paddr, unsigned int npages, bool locked) 1081{ 1082 return -ENODEV; 1083} 1084 1085static inline void snp_free_firmware_page(void *addr) { } 1086 1087static inline void sev_platform_shutdown(void) { } 1088 1089static inline bool sev_is_snp_ciphertext_hiding_supported(void) { return false; } 1090 1091#endif /* CONFIG_CRYPTO_DEV_SP_PSP */ 1092 1093#endif /* __PSP_SEV_H__ */
~/
Read-only file preview.