2 * Protected Virtualization functions
4 * Copyright IBM Corp. 2020
6 * Janosch Frank <frankja@linux.ibm.com>
8 * This work is licensed under the terms of the GNU GPL, version 2 or (at
9 * your option) any later version. See the COPYING file in the top-level
12 #include "qemu/osdep.h"
14 #include <linux/kvm.h>
16 #include "qapi/error.h"
17 #include "qemu/error-report.h"
18 #include "sysemu/kvm.h"
19 #include "qom/object_interfaces.h"
20 #include "exec/confidential-guest-support.h"
21 #include "hw/s390x/ipl.h"
22 #include "hw/s390x/pv.h"
23 #include "hw/s390x/sclp.h"
24 #include "target/s390x/kvm/kvm_s390x.h"
26 static bool info_valid
;
27 static struct kvm_s390_pv_info_vm info_vm
;
28 static struct kvm_s390_pv_info_dump info_dump
;
30 static int __s390_pv_cmd(uint32_t cmd
, const char *cmdname
, void *data
)
32 struct kvm_pv_cmd pv_cmd
= {
34 .data
= (uint64_t)data
,
39 rc
= kvm_vm_ioctl(kvm_state
, KVM_S390_PV_COMMAND
, &pv_cmd
);
40 } while (rc
== -EINTR
);
43 error_report("KVM PV command %d (%s) failed: header rc %x rrc %x "
44 "IOCTL rc: %d", cmd
, cmdname
, pv_cmd
.rc
, pv_cmd
.rrc
,
51 * This macro lets us pass the command as a string to the function so
52 * we can print it on an error.
54 #define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data)
55 #define s390_pv_cmd_exit(cmd, data) \
59 rc = __s390_pv_cmd(cmd, #cmd, data);\
65 int s390_pv_query_info(void)
67 struct kvm_s390_pv_info info
= {
68 .header
.id
= KVM_PV_INFO_VM
,
69 .header
.len_max
= sizeof(info
.header
) + sizeof(info
.vm
),
73 /* Info API's first user is dump so they are bundled */
74 if (!kvm_s390_get_protected_dump()) {
78 rc
= s390_pv_cmd(KVM_PV_INFO
, &info
);
80 error_report("KVM PV INFO cmd %x failed: %s",
81 info
.header
.id
, strerror(-rc
));
84 memcpy(&info_vm
, &info
.vm
, sizeof(info
.vm
));
86 info
.header
.id
= KVM_PV_INFO_DUMP
;
87 info
.header
.len_max
= sizeof(info
.header
) + sizeof(info
.dump
);
88 rc
= s390_pv_cmd(KVM_PV_INFO
, &info
);
90 error_report("KVM PV INFO cmd %x failed: %s",
91 info
.header
.id
, strerror(-rc
));
95 memcpy(&info_dump
, &info
.dump
, sizeof(info
.dump
));
101 int s390_pv_vm_enable(void)
103 return s390_pv_cmd(KVM_PV_ENABLE
, NULL
);
106 void s390_pv_vm_disable(void)
108 s390_pv_cmd_exit(KVM_PV_DISABLE
, NULL
);
111 int s390_pv_set_sec_parms(uint64_t origin
, uint64_t length
)
113 struct kvm_s390_pv_sec_parm args
= {
118 return s390_pv_cmd(KVM_PV_SET_SEC_PARMS
, &args
);
122 * Called for each component in the SE type IPL parameter block 0.
124 int s390_pv_unpack(uint64_t addr
, uint64_t size
, uint64_t tweak
)
126 struct kvm_s390_pv_unp args
= {
132 return s390_pv_cmd(KVM_PV_UNPACK
, &args
);
135 void s390_pv_prep_reset(void)
137 s390_pv_cmd_exit(KVM_PV_PREP_RESET
, NULL
);
140 int s390_pv_verify(void)
142 return s390_pv_cmd(KVM_PV_VERIFY
, NULL
);
145 void s390_pv_unshare(void)
147 s390_pv_cmd_exit(KVM_PV_UNSHARE_ALL
, NULL
);
150 void s390_pv_inject_reset_error(CPUState
*cs
)
152 int r1
= (cs
->kvm_run
->s390_sieic
.ipa
& 0x00f0) >> 4;
153 CPUS390XState
*env
= &S390_CPU(cs
)->env
;
155 /* Report that we are unable to enter protected mode */
156 env
->regs
[r1
+ 1] = DIAG_308_RC_INVAL_FOR_PV
;
159 uint64_t kvm_s390_pv_dmp_get_size_cpu(void)
161 return info_dump
.dump_cpu_buffer_len
;
164 uint64_t kvm_s390_pv_dmp_get_size_completion_data(void)
166 return info_dump
.dump_config_finalize_len
;
169 uint64_t kvm_s390_pv_dmp_get_size_mem_state(void)
171 return info_dump
.dump_config_mem_buffer_per_1m
;
174 bool kvm_s390_pv_info_basic_valid(void)
179 static int s390_pv_dump_cmd(uint64_t subcmd
, uint64_t uaddr
, uint64_t gaddr
,
182 struct kvm_s390_pv_dmp dmp
= {
190 ret
= s390_pv_cmd(KVM_PV_DUMP
, (void *)&dmp
);
192 error_report("KVM DUMP command %ld failed", subcmd
);
197 int kvm_s390_dump_cpu(S390CPU
*cpu
, void *buff
)
199 struct kvm_s390_pv_dmp dmp
= {
200 .subcmd
= KVM_PV_DUMP_CPU
,
201 .buff_addr
= (uint64_t)buff
,
203 .buff_len
= info_dump
.dump_cpu_buffer_len
,
205 struct kvm_pv_cmd pv
= {
207 .data
= (uint64_t)&dmp
,
210 return kvm_vcpu_ioctl(CPU(cpu
), KVM_S390_PV_CPU_COMMAND
, &pv
);
213 int kvm_s390_dump_init(void)
215 return s390_pv_dump_cmd(KVM_PV_DUMP_INIT
, 0, 0, 0);
218 int kvm_s390_dump_mem_state(uint64_t gaddr
, size_t len
, void *dest
)
220 return s390_pv_dump_cmd(KVM_PV_DUMP_CONFIG_STOR_STATE
, (uint64_t)dest
,
224 int kvm_s390_dump_completion_data(void *buff
)
226 return s390_pv_dump_cmd(KVM_PV_DUMP_COMPLETE
, (uint64_t)buff
, 0,
227 info_dump
.dump_config_finalize_len
);
230 #define TYPE_S390_PV_GUEST "s390-pv-guest"
231 OBJECT_DECLARE_SIMPLE_TYPE(S390PVGuest
, S390_PV_GUEST
)
236 * The S390PVGuest object is basically a dummy used to tell the
237 * confidential guest support system to use s390's PV mechanism.
240 * -object s390-pv-guest,id=pv0 \
241 * -machine ...,confidential-guest-support=pv0
244 ConfidentialGuestSupport parent_obj
;
247 typedef struct S390PVGuestClass S390PVGuestClass
;
249 struct S390PVGuestClass
{
250 ConfidentialGuestSupportClass parent_class
;
254 * If protected virtualization is enabled, the amount of data that the
255 * Read SCP Info Service Call can use is limited to one page. The
256 * available space also depends on the Extended-Length SCCB (ELS)
257 * feature which can take more buffer space to store feature
258 * information. This impacts the maximum number of CPUs supported in
261 static uint32_t s390_pv_get_max_cpus(void)
263 int offset_cpu
= s390_has_feat(S390_FEAT_EXTENDED_LENGTH_SCCB
) ?
264 offsetof(ReadInfo
, entries
) : SCLP_READ_SCP_INFO_FIXED_CPU_OFFSET
;
266 return (TARGET_PAGE_SIZE
- offset_cpu
) / sizeof(CPUEntry
);
269 static bool s390_pv_check_cpus(Error
**errp
)
271 MachineState
*ms
= MACHINE(qdev_get_machine());
272 uint32_t pv_max_cpus
= s390_pv_get_max_cpus();
274 if (ms
->smp
.max_cpus
> pv_max_cpus
) {
275 error_setg(errp
, "Protected VMs support a maximum of %d CPUs",
283 static bool s390_pv_guest_check(ConfidentialGuestSupport
*cgs
, Error
**errp
)
285 return s390_pv_check_cpus(errp
);
288 int s390_pv_kvm_init(ConfidentialGuestSupport
*cgs
, Error
**errp
)
290 if (!object_dynamic_cast(OBJECT(cgs
), TYPE_S390_PV_GUEST
)) {
294 if (!s390_has_feat(S390_FEAT_UNPACK
)) {
296 "CPU model does not support Protected Virtualization");
300 if (!s390_pv_guest_check(cgs
, errp
)) {
309 OBJECT_DEFINE_TYPE_WITH_INTERFACES(S390PVGuest
,
312 CONFIDENTIAL_GUEST_SUPPORT
,
313 { TYPE_USER_CREATABLE
},
316 static void s390_pv_guest_class_init(ObjectClass
*oc
, void *data
)
320 static void s390_pv_guest_init(Object
*obj
)
324 static void s390_pv_guest_finalize(Object
*obj
)