1 /* 2 * QEMU Confidential Guest support 3 * This interface describes the common pieces between various 4 * schemes for protecting guest memory or other state against a 5 * compromised hypervisor. This includes memory encryption (AMD's 6 * SEV and Intel's MKTME) or special protection modes (PEF on POWER, 7 * or PV on s390x). 8 * 9 * Copyright Red Hat. 10 * 11 * Authors: 12 * David Gibson <david@gibson.dropbear.id.au> 13 * 14 * This work is licensed under the terms of the GNU GPL, version 2 or 15 * later. See the COPYING file in the top-level directory. 16 * 17 */ 18 #ifndef QEMU_CONFIDENTIAL_GUEST_SUPPORT_H 19 #define QEMU_CONFIDENTIAL_GUEST_SUPPORT_H 20 21 #include "qom/object.h" 22 #include "exec/hwaddr.h" 23 24 #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support" 25 OBJECT_DECLARE_TYPE(ConfidentialGuestSupport, 26 ConfidentialGuestSupportClass, 27 CONFIDENTIAL_GUEST_SUPPORT) 28 29 30 typedef enum ConfidentialGuestPlatformType { 31 CGS_PLATFORM_SEV, 32 CGS_PLATFORM_SEV_ES, 33 CGS_PLATFORM_SEV_SNP, 34 } ConfidentialGuestPlatformType; 35 36 typedef enum ConfidentialGuestMemoryType { 37 CGS_MEM_RAM, 38 CGS_MEM_RESERVED, 39 CGS_MEM_ACPI, 40 CGS_MEM_NVS, 41 CGS_MEM_UNUSABLE, 42 } ConfidentialGuestMemoryType; 43 44 typedef struct ConfidentialGuestMemoryMapEntry { 45 uint64_t gpa; 46 uint64_t size; 47 ConfidentialGuestMemoryType type; 48 } ConfidentialGuestMemoryMapEntry; 49 50 typedef enum ConfidentialGuestPageType { 51 CGS_PAGE_TYPE_NORMAL, 52 CGS_PAGE_TYPE_VMSA, 53 CGS_PAGE_TYPE_ZERO, 54 CGS_PAGE_TYPE_UNMEASURED, 55 CGS_PAGE_TYPE_SECRETS, 56 CGS_PAGE_TYPE_CPUID, 57 CGS_PAGE_TYPE_REQUIRED_MEMORY, 58 } ConfidentialGuestPageType; 59 60 typedef enum ConfidentialGuestPolicyType { 61 GUEST_POLICY_SEV, 62 } ConfidentialGuestPolicyType; 63 64 struct ConfidentialGuestSupport { 65 Object parent; 66 67 /* 68 * True if the machine should use guest_memfd for RAM. 69 */ 70 bool require_guest_memfd; 71 72 /* 73 * ready: flag set by CGS initialization code once it's ready to 74 * start executing instructions in a potentially-secure 75 * guest 76 * 77 * The definition here is a bit fuzzy, because this is essentially 78 * part of a self-sanity-check, rather than a strict mechanism. 79 * 80 * It's not feasible to have a single point in the common machine 81 * init path to configure confidential guest support, because 82 * different mechanisms have different interdependencies requiring 83 * initialization in different places, often in arch or machine 84 * type specific code. It's also usually not possible to check 85 * for invalid configurations until that initialization code. 86 * That means it would be very easy to have a bug allowing CGS 87 * init to be bypassed entirely in certain configurations. 88 * 89 * Silently ignoring a requested security feature would be bad, so 90 * to avoid that we check late in init that this 'ready' flag is 91 * set if CGS was requested. If the CGS init hasn't happened, and 92 * so 'ready' is not set, we'll abort. 93 */ 94 bool ready; 95 }; 96 97 typedef struct ConfidentialGuestSupportClass { 98 ObjectClass parent; 99 100 int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp); 101 int (*kvm_reset)(ConfidentialGuestSupport *cgs, Error **errp); 102 103 /* 104 * Check to see if this confidential guest supports a particular 105 * platform or configuration. 106 * 107 * Return true if supported or false if not supported. 108 */ 109 bool (*check_support)(ConfidentialGuestPlatformType platform, 110 uint16_t platform_version, uint8_t highest_vtl, 111 uint64_t shared_gpa_boundary); 112 113 /* 114 * Configure part of the state of a guest for a particular set of data, page 115 * type and gpa. This can be used for example to pre-populate and measure 116 * guest memory contents, define private ranges or set the initial CPU state 117 * for one or more CPUs. 118 * 119 * If memory_type is CGS_PAGE_TYPE_VMSA then ptr points to the initial CPU 120 * context for a virtual CPU. The format of the data depends on the type of 121 * confidential virtual machine. For example, for SEV-ES ptr will point to a 122 * vmcb_save_area structure that should be copied into guest memory at the 123 * address specified in gpa. The cpu_index parameter contains the index of 124 * the CPU the VMSA applies to. 125 */ 126 int (*set_guest_state)(hwaddr gpa, uint8_t *ptr, uint64_t len, 127 ConfidentialGuestPageType memory_type, 128 uint16_t cpu_index, Error **errp); 129 130 /* 131 * Set the guest policy. The policy can be used to configure the 132 * confidential platform, such as if debug is enabled or not and can contain 133 * information about expected launch measurements, signed verification of 134 * guest configuration and other platform data. 135 * 136 * The format of the policy data is specific to each platform. For example, 137 * SEV-SNP uses a policy bitfield in the 'policy' argument and provides an 138 * ID block and ID authentication in the 'policy_data' parameters. The type 139 * of policy data is identified by the 'policy_type' argument. 140 */ 141 int (*set_guest_policy)(ConfidentialGuestPolicyType policy_type, 142 uint64_t policy, 143 void *policy_data1, uint32_t policy_data1_size, 144 void *policy_data2, uint32_t policy_data2_size, 145 Error **errp); 146 147 /* 148 * Iterate the system memory map, getting the entry with the given index 149 * that can be populated into guest memory. 150 * 151 * Returns 0 for ok, 1 if the index is out of range and -1 on error. 152 */ 153 int (*get_mem_map_entry)(int index, ConfidentialGuestMemoryMapEntry *entry, 154 Error **errp); 155 } ConfidentialGuestSupportClass; 156 157 static inline int confidential_guest_kvm_init(ConfidentialGuestSupport *cgs, 158 Error **errp) 159 { 160 ConfidentialGuestSupportClass *klass; 161 162 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs); 163 if (klass->kvm_init) { 164 return klass->kvm_init(cgs, errp); 165 } 166 167 return 0; 168 } 169 170 static inline int confidential_guest_kvm_reset(ConfidentialGuestSupport *cgs, 171 Error **errp) 172 { 173 ConfidentialGuestSupportClass *klass; 174 175 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs); 176 if (klass->kvm_reset) { 177 return klass->kvm_reset(cgs, errp); 178 } 179 180 return 0; 181 } 182 183 #endif /* QEMU_CONFIDENTIAL_GUEST_SUPPORT_H */ 184