1 /* 2 * QEMU Confidential Guest support 3 * This interface describes the common pieces between various 4 * schemes for protecting guest memory or other state against a 5 * compromised hypervisor. This includes memory encryption (AMD's 6 * SEV and Intel's MKTME) or special protection modes (PEF on POWER, 7 * or PV on s390x). 8 * 9 * Copyright Red Hat. 10 * 11 * Authors: 12 * David Gibson <david@gibson.dropbear.id.au> 13 * 14 * This work is licensed under the terms of the GNU GPL, version 2 or 15 * later. See the COPYING file in the top-level directory. 16 * 17 */ 18 #ifndef QEMU_CONFIDENTIAL_GUEST_SUPPORT_H 19 #define QEMU_CONFIDENTIAL_GUEST_SUPPORT_H 20 21 #include "qom/object.h" 22 #include "exec/hwaddr.h" 23 24 #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support" 25 OBJECT_DECLARE_TYPE(ConfidentialGuestSupport, 26 ConfidentialGuestSupportClass, 27 CONFIDENTIAL_GUEST_SUPPORT) 28 29 30 typedef enum ConfidentialGuestPlatformType { 31 CGS_PLATFORM_SEV, 32 CGS_PLATFORM_SEV_ES, 33 CGS_PLATFORM_SEV_SNP, 34 } ConfidentialGuestPlatformType; 35 36 typedef enum ConfidentialGuestMemoryType { 37 CGS_MEM_RAM, 38 CGS_MEM_RESERVED, 39 CGS_MEM_ACPI, 40 CGS_MEM_NVS, 41 CGS_MEM_UNUSABLE, 42 } ConfidentialGuestMemoryType; 43 44 typedef struct ConfidentialGuestMemoryMapEntry { 45 uint64_t gpa; 46 uint64_t size; 47 ConfidentialGuestMemoryType type; 48 } ConfidentialGuestMemoryMapEntry; 49 50 typedef enum ConfidentialGuestPageType { 51 CGS_PAGE_TYPE_NORMAL, 52 CGS_PAGE_TYPE_VMSA, 53 CGS_PAGE_TYPE_ZERO, 54 CGS_PAGE_TYPE_UNMEASURED, 55 CGS_PAGE_TYPE_SECRETS, 56 CGS_PAGE_TYPE_CPUID, 57 CGS_PAGE_TYPE_REQUIRED_MEMORY, 58 } ConfidentialGuestPageType; 59 60 struct ConfidentialGuestSupport { 61 Object parent; 62 63 /* 64 * True if the machine should use guest_memfd for RAM. 65 */ 66 bool require_guest_memfd; 67 68 /* 69 * ready: flag set by CGS initialization code once it's ready to 70 * start executing instructions in a potentially-secure 71 * guest 72 * 73 * The definition here is a bit fuzzy, because this is essentially 74 * part of a self-sanity-check, rather than a strict mechanism. 75 * 76 * It's not feasible to have a single point in the common machine 77 * init path to configure confidential guest support, because 78 * different mechanisms have different interdependencies requiring 79 * initialization in different places, often in arch or machine 80 * type specific code. It's also usually not possible to check 81 * for invalid configurations until that initialization code. 82 * That means it would be very easy to have a bug allowing CGS 83 * init to be bypassed entirely in certain configurations. 84 * 85 * Silently ignoring a requested security feature would be bad, so 86 * to avoid that we check late in init that this 'ready' flag is 87 * set if CGS was requested. If the CGS init hasn't happened, and 88 * so 'ready' is not set, we'll abort. 89 */ 90 bool ready; 91 }; 92 93 typedef struct ConfidentialGuestSupportClass { 94 ObjectClass parent; 95 96 int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp); 97 int (*kvm_reset)(ConfidentialGuestSupport *cgs, Error **errp); 98 99 /* 100 * Check to see if this confidential guest supports a particular 101 * platform or configuration. 102 * 103 * Return true if supported or false if not supported. 104 */ 105 bool (*check_support)(ConfidentialGuestPlatformType platform, 106 uint16_t platform_version, uint8_t highest_vtl, 107 uint64_t shared_gpa_boundary); 108 109 /* 110 * Configure part of the state of a guest for a particular set of data, page 111 * type and gpa. This can be used for example to pre-populate and measure 112 * guest memory contents, define private ranges or set the initial CPU state 113 * for one or more CPUs. 114 * 115 * If memory_type is CGS_PAGE_TYPE_VMSA then ptr points to the initial CPU 116 * context for a virtual CPU. The format of the data depends on the type of 117 * confidential virtual machine. For example, for SEV-ES ptr will point to a 118 * vmcb_save_area structure that should be copied into guest memory at the 119 * address specified in gpa. The cpu_index parameter contains the index of 120 * the CPU the VMSA applies to. 121 */ 122 int (*set_guest_state)(hwaddr gpa, uint8_t *ptr, uint64_t len, 123 ConfidentialGuestPageType memory_type, 124 uint16_t cpu_index, Error **errp); 125 126 /* 127 * Iterate the system memory map, getting the entry with the given index 128 * that can be populated into guest memory. 129 * 130 * Returns 0 for ok, 1 if the index is out of range and -1 on error. 131 */ 132 int (*get_mem_map_entry)(int index, ConfidentialGuestMemoryMapEntry *entry, 133 Error **errp); 134 } ConfidentialGuestSupportClass; 135 136 static inline int confidential_guest_kvm_init(ConfidentialGuestSupport *cgs, 137 Error **errp) 138 { 139 ConfidentialGuestSupportClass *klass; 140 141 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs); 142 if (klass->kvm_init) { 143 return klass->kvm_init(cgs, errp); 144 } 145 146 return 0; 147 } 148 149 static inline int confidential_guest_kvm_reset(ConfidentialGuestSupport *cgs, 150 Error **errp) 151 { 152 ConfidentialGuestSupportClass *klass; 153 154 klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs); 155 if (klass->kvm_reset) { 156 return klass->kvm_reset(cgs, errp); 157 } 158 159 return 0; 160 } 161 162 #endif /* QEMU_CONFIDENTIAL_GUEST_SUPPORT_H */ 163