1 /*
2 * QEMU Confidential Guest support
3 * This interface describes the common pieces between various
4 * schemes for protecting guest memory or other state against a
5 * compromised hypervisor. This includes memory encryption (AMD's
6 * SEV and Intel's MKTME) or special protection modes (PEF on POWER,
7 * or PV on s390x).
8 *
9 * Copyright Red Hat.
10 *
11 * Authors:
12 * David Gibson <david@gibson.dropbear.id.au>
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2 or
15 * later. See the COPYING file in the top-level directory.
16 *
17 */
18 #ifndef QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
19 #define QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
20
21 #ifdef CONFIG_USER_ONLY
22 #error Cannot include system/confidential-guest-support.h from user emulation
23 #endif
24
25 #include "qom/object.h"
26
27 #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support"
28 OBJECT_DECLARE_TYPE(ConfidentialGuestSupport,
29 ConfidentialGuestSupportClass,
30 CONFIDENTIAL_GUEST_SUPPORT)
31
32
33 struct ConfidentialGuestSupport {
34 Object parent;
35
36 /*
37 * True if the machine should use guest_memfd for RAM.
38 */
39 bool require_guest_memfd;
40
41 /*
42 * ready: flag set by CGS initialization code once it's ready to
43 * start executing instructions in a potentially-secure
44 * guest
45 *
46 * The definition here is a bit fuzzy, because this is essentially
47 * part of a self-sanity-check, rather than a strict mechanism.
48 *
49 * It's not feasible to have a single point in the common machine
50 * init path to configure confidential guest support, because
51 * different mechanisms have different interdependencies requiring
52 * initialization in different places, often in arch or machine
53 * type specific code. It's also usually not possible to check
54 * for invalid configurations until that initialization code.
55 * That means it would be very easy to have a bug allowing CGS
56 * init to be bypassed entirely in certain configurations.
57 *
58 * Silently ignoring a requested security feature would be bad, so
59 * to avoid that we check late in init that this 'ready' flag is
60 * set if CGS was requested. If the CGS init hasn't happened, and
61 * so 'ready' is not set, we'll abort.
62 */
63 bool ready;
64 };
65
66 typedef struct ConfidentialGuestSupportClass {
67 ObjectClass parent;
68
69 int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
70 int (*kvm_reset)(ConfidentialGuestSupport *cgs, Error **errp);
71 } ConfidentialGuestSupportClass;
72
confidential_guest_kvm_init(ConfidentialGuestSupport * cgs,Error ** errp)73 static inline int confidential_guest_kvm_init(ConfidentialGuestSupport *cgs,
74 Error **errp)
75 {
76 ConfidentialGuestSupportClass *klass;
77
78 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs);
79 if (klass->kvm_init) {
80 return klass->kvm_init(cgs, errp);
81 }
82
83 return 0;
84 }
85
confidential_guest_kvm_reset(ConfidentialGuestSupport * cgs,Error ** errp)86 static inline int confidential_guest_kvm_reset(ConfidentialGuestSupport *cgs,
87 Error **errp)
88 {
89 ConfidentialGuestSupportClass *klass;
90
91 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs);
92 if (klass->kvm_reset) {
93 return klass->kvm_reset(cgs, errp);
94 }
95
96 return 0;
97 }
98
99 #endif /* QEMU_CONFIDENTIAL_GUEST_SUPPORT_H */
100