hw/ppc/pef.c

   1 /*
   2  * PEF (Protected Execution Facility) for POWER support
   3  *
   4  * Copyright Red Hat.
   5  *
   6  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   7  * See the COPYING file in the top-level directory.
   8  *
   9  */
  10
  11 #include "qemu/osdep.h"
  12
  13 #include "qapi/error.h"
  14 #include "qom/object_interfaces.h"
  15 #include "sysemu/kvm.h"
  16 #include "migration/blocker.h"
  17 #include "exec/confidential-guest-support.h"
  18 #include "hw/ppc/pef.h"
  19
  20 #define TYPE_PEF_GUEST "pef-guest"
  21 OBJECT_DECLARE_SIMPLE_TYPE(PefGuest, PEF_GUEST)
  22
  23 typedef struct PefGuest PefGuest;
  24 typedef struct PefGuestClass PefGuestClass;
  25
  26 struct PefGuestClass {
  27     ConfidentialGuestSupportClass parent_class;
  28 };
  29
  30 /**
  31  * PefGuest:
  32  *
  33  * The PefGuest object is used for creating and managing a PEF
  34  * guest.
  35  *
  36  * # $QEMU \
  37  *         -object pef-guest,id=pef0 \
  38  *         -machine ...,confidential-guest-support=pef0
  39  */
  40 struct PefGuest {
  41     ConfidentialGuestSupport parent_obj;
  42 };
  43
  44 static int kvmppc_svm_init(Error **errp)
  45 {
  46 #ifdef CONFIG_KVM
  47     static Error *pef_mig_blocker;
  48
  49     if (!kvm_check_extension(kvm_state, KVM_CAP_PPC_SECURE_GUEST)) {
  50         error_setg(errp,
  51                    "KVM implementation does not support Secure VMs (is an ultravisor running?)");
  52         return -1;
  53     } else {
  54         int ret = kvm_vm_enable_cap(kvm_state, KVM_CAP_PPC_SECURE_GUEST, 0, 1);
  55
  56         if (ret < 0) {
  57             error_setg(errp,
  58                        "Error enabling PEF with KVM");
  59             return -1;
  60         }
  61     }
  62
  63     /* add migration blocker */
  64     error_setg(&pef_mig_blocker, "PEF: Migration is not implemented");
  65     /* NB: This can fail if --only-migratable is used */
  66     migrate_add_blocker(pef_mig_blocker, &error_fatal);
  67
  68     return 0;
  69 #else
  70     g_assert_not_reached();
  71 #endif
  72 }
  73
  74 /*
  75  * Don't set error if KVM_PPC_SVM_OFF ioctl is invoked on kernels
  76  * that don't support this ioctl.
  77  */
  78 static int kvmppc_svm_off(Error **errp)
  79 {
  80 #ifdef CONFIG_KVM
  81     int rc;
  82
  83     rc = kvm_vm_ioctl(KVM_STATE(current_accel()), KVM_PPC_SVM_OFF);
  84     if (rc && rc != -ENOTTY) {
  85         error_setg_errno(errp, -rc, "KVM_PPC_SVM_OFF ioctl failed");
  86         return rc;
  87     }
  88     return 0;
  89 #else
  90     g_assert_not_reached();
  91 #endif
  92 }
  93
  94 int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
  95 {
  96     if (!object_dynamic_cast(OBJECT(cgs), TYPE_PEF_GUEST)) {
  97         return 0;
  98     }
  99
 100     if (!kvm_enabled()) {
 101         error_setg(errp, "PEF requires KVM");
 102         return -1;
 103     }
 104
 105     return kvmppc_svm_init(errp);
 106 }
 107
 108 int pef_kvm_reset(ConfidentialGuestSupport *cgs, Error **errp)
 109 {
 110     if (!object_dynamic_cast(OBJECT(cgs), TYPE_PEF_GUEST)) {
 111         return 0;
 112     }
 113
 114     /*
 115      * If we don't have KVM we should never have been able to
 116      * initialize PEF, so we should never get this far
 117      */
 118     assert(kvm_enabled());
 119
 120     return kvmppc_svm_off(errp);
 121 }
 122
 123 OBJECT_DEFINE_TYPE_WITH_INTERFACES(PefGuest,
 124                                    pef_guest,
 125                                    PEF_GUEST,
 126                                    CONFIDENTIAL_GUEST_SUPPORT,
 127                                    { TYPE_USER_CREATABLE },
 128                                    { NULL })
 129
 130 static void pef_guest_class_init(ObjectClass *oc, void *data)
 131 {
 132 }
 133
 134 static void pef_guest_init(Object *obj)
 135 {
 136 }
 137
 138 static void pef_guest_finalize(Object *obj)
 139 {
 140 }