@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
h 202 lines 4.84 KB
Raw
1 /*
2 * QEMU Secure Encrypted Virutualization (SEV) support
3 *
4 * Copyright: Advanced Micro Devices, 2016-2018
5 *
6 * Authors:
7 * Brijesh Singh <brijesh.singh@amd.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 *
12 */
13
14 #ifndef I386_SEV_H
15 #define I386_SEV_H
16
17 #include "target/i386/svm.h"
18
19 #ifndef CONFIG_USER_ONLY
20 #include CONFIG_DEVICES /* CONFIG_SEV */
21 #endif
22
23 #if !defined(CONFIG_SEV) || defined(CONFIG_USER_ONLY)
24 #define sev_enabled() 0
25 #define sev_es_enabled() 0
26 #define sev_snp_enabled() 0
27 #else
28 bool sev_enabled(void);
29 bool sev_es_enabled(void);
30 bool sev_snp_enabled(void);
31 #endif
32
33 #if !defined(CONFIG_USER_ONLY)
34
35 #define TYPE_SEV_COMMON "sev-common"
36 #define TYPE_SEV_GUEST "sev-guest"
37 #define TYPE_SEV_SNP_GUEST "sev-snp-guest"
38
39 #define SEV_POLICY_NODBG 0x1
40 #define SEV_POLICY_NOKS 0x2
41 #define SEV_POLICY_ES 0x4
42 #define SEV_POLICY_NOSEND 0x8
43 #define SEV_POLICY_DOMAIN 0x10
44 #define SEV_POLICY_SEV 0x20
45
46 #define SEV_SNP_POLICY_SMT 0x10000
47 #define SEV_SNP_POLICY_DBG 0x80000
48
49 #define SVM_SEV_FEAT_SNP_ACTIVE BIT(0)
50 #define SVM_SEV_FEAT_DEBUG_SWAP BIT(5)
51 #define SVM_SEV_FEAT_SECURE_TSC BIT(9)
52
53 typedef struct SevKernelLoaderContext {
54 char *setup_data;
55 size_t setup_size;
56 char *kernel_data;
57 size_t kernel_size;
58 char *initrd_data;
59 size_t initrd_size;
60 char *cmdline_data;
61 size_t cmdline_size;
62 } SevKernelLoaderContext;
63
64 /* Save area definition for SEV-ES and SEV-SNP guests */
65 struct QEMU_PACKED sev_es_save_area {
66 struct vmcb_seg es;
67 struct vmcb_seg cs;
68 struct vmcb_seg ss;
69 struct vmcb_seg ds;
70 struct vmcb_seg fs;
71 struct vmcb_seg gs;
72 struct vmcb_seg gdtr;
73 struct vmcb_seg ldtr;
74 struct vmcb_seg idtr;
75 struct vmcb_seg tr;
76 uint64_t vmpl0_ssp;
77 uint64_t vmpl1_ssp;
78 uint64_t vmpl2_ssp;
79 uint64_t vmpl3_ssp;
80 uint64_t u_cet;
81 uint8_t reserved_0xc8[2];
82 uint8_t vmpl;
83 uint8_t cpl;
84 uint8_t reserved_0xcc[4];
85 uint64_t efer;
86 uint8_t reserved_0xd8[104];
87 uint64_t xss;
88 uint64_t cr4;
89 uint64_t cr3;
90 uint64_t cr0;
91 uint64_t dr7;
92 uint64_t dr6;
93 uint64_t rflags;
94 uint64_t rip;
95 uint64_t dr0;
96 uint64_t dr1;
97 uint64_t dr2;
98 uint64_t dr3;
99 uint64_t dr0_addr_mask;
100 uint64_t dr1_addr_mask;
101 uint64_t dr2_addr_mask;
102 uint64_t dr3_addr_mask;
103 uint8_t reserved_0x1c0[24];
104 uint64_t rsp;
105 uint64_t s_cet;
106 uint64_t ssp;
107 uint64_t isst_addr;
108 uint64_t rax;
109 uint64_t star;
110 uint64_t lstar;
111 uint64_t cstar;
112 uint64_t sfmask;
113 uint64_t kernel_gs_base;
114 uint64_t sysenter_cs;
115 uint64_t sysenter_esp;
116 uint64_t sysenter_eip;
117 uint64_t cr2;
118 uint8_t reserved_0x248[32];
119 uint64_t g_pat;
120 uint64_t dbgctl;
121 uint64_t br_from;
122 uint64_t br_to;
123 uint64_t last_excp_from;
124 uint64_t last_excp_to;
125 uint8_t reserved_0x298[80];
126 uint32_t pkru;
127 uint32_t tsc_aux;
128 uint8_t reserved_0x2f0[24];
129 uint64_t rcx;
130 uint64_t rdx;
131 uint64_t rbx;
132 uint64_t reserved_0x320; /* rsp already available at 0x01d8 */
133 uint64_t rbp;
134 uint64_t rsi;
135 uint64_t rdi;
136 uint64_t r8;
137 uint64_t r9;
138 uint64_t r10;
139 uint64_t r11;
140 uint64_t r12;
141 uint64_t r13;
142 uint64_t r14;
143 uint64_t r15;
144 uint8_t reserved_0x380[16];
145 uint64_t guest_exit_info_1;
146 uint64_t guest_exit_info_2;
147 uint64_t guest_exit_int_info;
148 uint64_t guest_nrip;
149 uint64_t sev_features;
150 uint64_t vintr_ctrl;
151 uint64_t guest_exit_code;
152 uint64_t virtual_tom;
153 uint64_t tlb_id;
154 uint64_t pcpu_id;
155 uint64_t event_inj;
156 uint64_t xcr0;
157 uint8_t reserved_0x3f0[16];
158
159 /* Floating point area */
160 uint64_t x87_dp;
161 uint32_t mxcsr;
162 uint16_t x87_ftw;
163 uint16_t x87_fsw;
164 uint16_t x87_fcw;
165 uint16_t x87_fop;
166 uint16_t x87_ds;
167 uint16_t x87_cs;
168 uint64_t x87_rip;
169 uint8_t fpreg_x87[80];
170 uint8_t fpreg_xmm[256];
171 uint8_t fpreg_ymm[256];
172 };
173
174 struct QEMU_PACKED sev_snp_id_authentication {
175 uint32_t id_key_alg;
176 uint32_t auth_key_algo;
177 uint8_t reserved[56];
178 uint8_t id_block_sig[512];
179 uint8_t id_key[1028];
180 uint8_t reserved2[60];
181 uint8_t id_key_sig[512];
182 uint8_t author_key[1028];
183 uint8_t reserved3[892];
184 };
185
186 bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp);
187
188 int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp);
189 int sev_inject_launch_secret(const char *hdr, const char *secret,
190 uint64_t gpa, Error **errp);
191
192 int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size);
193 void sev_es_set_reset_vector(CPUState *cpu);
194
195 void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size);
196
197 #endif /* !CONFIG_USER_ONLY */
198
199 uint32_t sev_get_cbit_position(void);
200 uint32_t sev_get_reduced_phys_bits(void);
201
202 #endif