1 /*
2 * QEMU Confidential Guest support
3 * This interface describes the common pieces between various
4 * schemes for protecting guest memory or other state against a
5 * compromised hypervisor. This includes memory encryption (AMD's
6 * SEV and Intel's MKTME) or special protection modes (PEF on POWER,
7 * or PV on s390x).
8 *
9 * Copyright Red Hat.
10 *
11 * Authors:
12 * David Gibson <david@gibson.dropbear.id.au>
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2 or
15 * later. See the COPYING file in the top-level directory.
16 *
17 */
18 #ifndef QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
19 #define QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
20
21 #include "qom/object.h"
22 #include "exec/hwaddr.h"
23
24 #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support"
25 OBJECT_DECLARE_TYPE(ConfidentialGuestSupport,
26 ConfidentialGuestSupportClass,
27 CONFIDENTIAL_GUEST_SUPPORT)
28
29
30 typedef enum ConfidentialGuestPlatformType {
31 CGS_PLATFORM_SEV,
32 CGS_PLATFORM_SEV_ES,
33 CGS_PLATFORM_SEV_SNP,
34 } ConfidentialGuestPlatformType;
35
36 typedef enum ConfidentialGuestMemoryType {
37 CGS_MEM_RAM,
38 CGS_MEM_RESERVED,
39 CGS_MEM_ACPI,
40 CGS_MEM_NVS,
41 CGS_MEM_UNUSABLE,
42 } ConfidentialGuestMemoryType;
43
44 typedef struct ConfidentialGuestMemoryMapEntry {
45 uint64_t gpa;
46 uint64_t size;
47 ConfidentialGuestMemoryType type;
48 } ConfidentialGuestMemoryMapEntry;
49
50 typedef enum ConfidentialGuestPageType {
51 CGS_PAGE_TYPE_NORMAL,
52 CGS_PAGE_TYPE_VMSA,
53 CGS_PAGE_TYPE_ZERO,
54 CGS_PAGE_TYPE_UNMEASURED,
55 CGS_PAGE_TYPE_SECRETS,
56 CGS_PAGE_TYPE_CPUID,
57 CGS_PAGE_TYPE_REQUIRED_MEMORY,
58 } ConfidentialGuestPageType;
59
60 typedef enum ConfidentialGuestPolicyType {
61 GUEST_POLICY_SEV,
62 } ConfidentialGuestPolicyType;
63
64 struct ConfidentialGuestSupport {
65 Object parent;
66
67 /*
68 * True if the machine should use guest_memfd for RAM.
69 */
70 bool require_guest_memfd;
71
72 /*
73 * ready: flag set by CGS initialization code once it's ready to
74 * start executing instructions in a potentially-secure
75 * guest
76 *
77 * The definition here is a bit fuzzy, because this is essentially
78 * part of a self-sanity-check, rather than a strict mechanism.
79 *
80 * It's not feasible to have a single point in the common machine
81 * init path to configure confidential guest support, because
82 * different mechanisms have different interdependencies requiring
83 * initialization in different places, often in arch or machine
84 * type specific code. It's also usually not possible to check
85 * for invalid configurations until that initialization code.
86 * That means it would be very easy to have a bug allowing CGS
87 * init to be bypassed entirely in certain configurations.
88 *
89 * Silently ignoring a requested security feature would be bad, so
90 * to avoid that we check late in init that this 'ready' flag is
91 * set if CGS was requested. If the CGS init hasn't happened, and
92 * so 'ready' is not set, we'll abort.
93 */
94 bool ready;
95 };
96
97 typedef struct ConfidentialGuestSupportClass {
98 ObjectClass parent;
99
100 int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
101 int (*kvm_reset)(ConfidentialGuestSupport *cgs, Error **errp);
102
103 /*
104 * Check to see if this confidential guest supports a particular
105 * platform or configuration.
106 *
107 * Return true if supported or false if not supported.
108 */
109 bool (*check_support)(ConfidentialGuestPlatformType platform,
110 uint16_t platform_version, uint8_t highest_vtl,
111 uint64_t shared_gpa_boundary);
112
113 /*
114 * Configure part of the state of a guest for a particular set of data, page
115 * type and gpa. This can be used for example to pre-populate and measure
116 * guest memory contents, define private ranges or set the initial CPU state
117 * for one or more CPUs.
118 *
119 * If memory_type is CGS_PAGE_TYPE_VMSA then ptr points to the initial CPU
120 * context for a virtual CPU. The format of the data depends on the type of
121 * confidential virtual machine. For example, for SEV-ES ptr will point to a
122 * vmcb_save_area structure that should be copied into guest memory at the
123 * address specified in gpa. The cpu_index parameter contains the index of
124 * the CPU the VMSA applies to.
125 */
126 int (*set_guest_state)(hwaddr gpa, uint8_t *ptr, uint64_t len,
127 ConfidentialGuestPageType memory_type,
128 uint16_t cpu_index, Error **errp);
129
130 /*
131 * Set the guest policy. The policy can be used to configure the
132 * confidential platform, such as if debug is enabled or not and can contain
133 * information about expected launch measurements, signed verification of
134 * guest configuration and other platform data.
135 *
136 * The format of the policy data is specific to each platform. For example,
137 * SEV-SNP uses a policy bitfield in the 'policy' argument and provides an
138 * ID block and ID authentication in the 'policy_data' parameters. The type
139 * of policy data is identified by the 'policy_type' argument.
140 */
141 int (*set_guest_policy)(ConfidentialGuestPolicyType policy_type,
142 uint64_t policy,
143 void *policy_data1, uint32_t policy_data1_size,
144 void *policy_data2, uint32_t policy_data2_size,
145 Error **errp);
146
147 /*
148 * Iterate the system memory map, getting the entry with the given index
149 * that can be populated into guest memory.
150 *
151 * Returns 0 for ok, 1 if the index is out of range and -1 on error.
152 */
153 int (*get_mem_map_entry)(int index, ConfidentialGuestMemoryMapEntry *entry,
154 Error **errp);
155 } ConfidentialGuestSupportClass;
156
confidential_guest_kvm_init(ConfidentialGuestSupport * cgs,Error ** errp)157 static inline int confidential_guest_kvm_init(ConfidentialGuestSupport *cgs,
158 Error **errp)
159 {
160 ConfidentialGuestSupportClass *klass;
161
162 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs);
163 if (klass->kvm_init) {
164 return klass->kvm_init(cgs, errp);
165 }
166
167 return 0;
168 }
169
confidential_guest_kvm_reset(ConfidentialGuestSupport * cgs,Error ** errp)170 static inline int confidential_guest_kvm_reset(ConfidentialGuestSupport *cgs,
171 Error **errp)
172 {
173 ConfidentialGuestSupportClass *klass;
174
175 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs);
176 if (klass->kvm_reset) {
177 return klass->kvm_reset(cgs, errp);
178 }
179
180 return 0;
181 }
182
183 #endif /* QEMU_CONFIDENTIAL_GUEST_SUPPORT_H */
184