]>
Commit | Line | Data |
---|---|---|
6c8ebe30 DG |
1 | /* |
2 | * PEF (Protected Execution Facility) for POWER support | |
3 | * | |
4 | * Copyright Red Hat. | |
5 | * | |
6 | * This work is licensed under the terms of the GNU GPL, version 2 or later. | |
7 | * See the COPYING file in the top-level directory. | |
8 | * | |
9 | */ | |
10 | ||
11 | #include "qemu/osdep.h" | |
12 | ||
13 | #include "qapi/error.h" | |
14 | #include "qom/object_interfaces.h" | |
15 | #include "sysemu/kvm.h" | |
16 | #include "migration/blocker.h" | |
17 | #include "exec/confidential-guest-support.h" | |
18 | #include "hw/ppc/pef.h" | |
19 | ||
20 | #define TYPE_PEF_GUEST "pef-guest" | |
21 | OBJECT_DECLARE_SIMPLE_TYPE(PefGuest, PEF_GUEST) | |
22 | ||
23 | typedef struct PefGuest PefGuest; | |
24 | typedef struct PefGuestClass PefGuestClass; | |
25 | ||
26 | struct PefGuestClass { | |
27 | ConfidentialGuestSupportClass parent_class; | |
28 | }; | |
29 | ||
30 | /** | |
31 | * PefGuest: | |
32 | * | |
33 | * The PefGuest object is used for creating and managing a PEF | |
34 | * guest. | |
35 | * | |
36 | * # $QEMU \ | |
37 | * -object pef-guest,id=pef0 \ | |
38 | * -machine ...,confidential-guest-support=pef0 | |
39 | */ | |
40 | struct PefGuest { | |
41 | ConfidentialGuestSupport parent_obj; | |
42 | }; | |
43 | ||
44 | static int kvmppc_svm_init(Error **errp) | |
45 | { | |
46 | #ifdef CONFIG_KVM | |
6742eefc DG |
47 | static Error *pef_mig_blocker; |
48 | ||
6c8ebe30 DG |
49 | if (!kvm_check_extension(kvm_state, KVM_CAP_PPC_SECURE_GUEST)) { |
50 | error_setg(errp, | |
51 | "KVM implementation does not support Secure VMs (is an ultravisor running?)"); | |
52 | return -1; | |
53 | } else { | |
54 | int ret = kvm_vm_enable_cap(kvm_state, KVM_CAP_PPC_SECURE_GUEST, 0, 1); | |
55 | ||
56 | if (ret < 0) { | |
57 | error_setg(errp, | |
58 | "Error enabling PEF with KVM"); | |
59 | return -1; | |
60 | } | |
61 | } | |
62 | ||
6742eefc DG |
63 | /* add migration blocker */ |
64 | error_setg(&pef_mig_blocker, "PEF: Migration is not implemented"); | |
65 | /* NB: This can fail if --only-migratable is used */ | |
66 | migrate_add_blocker(pef_mig_blocker, &error_fatal); | |
67 | ||
6c8ebe30 DG |
68 | return 0; |
69 | #else | |
70 | g_assert_not_reached(); | |
71 | #endif | |
72 | } | |
73 | ||
74 | /* | |
75 | * Don't set error if KVM_PPC_SVM_OFF ioctl is invoked on kernels | |
76 | * that don't support this ioctl. | |
77 | */ | |
78 | static int kvmppc_svm_off(Error **errp) | |
79 | { | |
80 | #ifdef CONFIG_KVM | |
81 | int rc; | |
82 | ||
83 | rc = kvm_vm_ioctl(KVM_STATE(current_accel()), KVM_PPC_SVM_OFF); | |
84 | if (rc && rc != -ENOTTY) { | |
85 | error_setg_errno(errp, -rc, "KVM_PPC_SVM_OFF ioctl failed"); | |
86 | return rc; | |
87 | } | |
88 | return 0; | |
89 | #else | |
90 | g_assert_not_reached(); | |
91 | #endif | |
92 | } | |
93 | ||
94 | int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) | |
95 | { | |
96 | if (!object_dynamic_cast(OBJECT(cgs), TYPE_PEF_GUEST)) { | |
97 | return 0; | |
98 | } | |
99 | ||
100 | if (!kvm_enabled()) { | |
101 | error_setg(errp, "PEF requires KVM"); | |
102 | return -1; | |
103 | } | |
104 | ||
105 | return kvmppc_svm_init(errp); | |
106 | } | |
107 | ||
108 | int pef_kvm_reset(ConfidentialGuestSupport *cgs, Error **errp) | |
109 | { | |
110 | if (!object_dynamic_cast(OBJECT(cgs), TYPE_PEF_GUEST)) { | |
111 | return 0; | |
112 | } | |
113 | ||
114 | /* | |
115 | * If we don't have KVM we should never have been able to | |
116 | * initialize PEF, so we should never get this far | |
117 | */ | |
118 | assert(kvm_enabled()); | |
119 | ||
120 | return kvmppc_svm_off(errp); | |
121 | } | |
122 | ||
123 | OBJECT_DEFINE_TYPE_WITH_INTERFACES(PefGuest, | |
124 | pef_guest, | |
125 | PEF_GUEST, | |
126 | CONFIDENTIAL_GUEST_SUPPORT, | |
127 | { TYPE_USER_CREATABLE }, | |
128 | { NULL }) | |
129 | ||
130 | static void pef_guest_class_init(ObjectClass *oc, void *data) | |
131 | { | |
132 | } | |
133 | ||
134 | static void pef_guest_init(Object *obj) | |
135 | { | |
136 | } | |
137 | ||
138 | static void pef_guest_finalize(Object *obj) | |
139 | { | |
140 | } |