From: Jean-Philippe Brucker <[email protected]> Initialise an @rme_guest object and install a handler to get notified when the Realm is ready to start. That way we can finish reading the Realm once we know everything is in place.
Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> --- target/arm/kvm-rme.c | 50 +++++++++++++++++++++++++++++++++++++++++++ target/arm/kvm-stub.c | 5 +++++ target/arm/kvm.c | 7 +++++- target/arm/kvm_arm.h | 9 ++++++++ 4 files changed, 70 insertions(+), 1 deletion(-) diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c index 42e1d1e7b859..b86b9d6a25cb 100644 --- a/target/arm/kvm-rme.c +++ b/target/arm/kvm-rme.c @@ -13,6 +13,7 @@ #include "kvm_arm.h" #include "migration/blocker.h" #include "qapi/error.h" +#include "qemu/error-report.h" #include "qom/object_interfaces.h" #include "system/confidential-guest-support.h" #include "system/kvm.h" @@ -29,14 +30,63 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, rme_guest, RME_GUEST, CONFIDENTIAL_GUEST_SUPPORT, { TYPE_USER_CREATABLE }, { }) +static RmeGuest *rme_guest; + +static void rme_vm_state_change(void *opaque, bool running, RunState state) +{ + if (!running) { + return; + } + + kvm_mark_guest_state_protected(); +} + static void rme_guest_class_init(ObjectClass *oc, const void *data) { } static void rme_guest_init(Object *obj) { + if (rme_guest) { + error_report("a single instance of RmeGuest is supported"); + exit(1); + } + rme_guest = RME_GUEST(obj); } static void rme_guest_finalize(Object *obj) { } + +int kvm_arm_rme_init(MachineState *ms, KVMState *s) +{ + static Error *rme_mig_blocker; + ConfidentialGuestSupport *cgs = ms->cgs; + + if (!rme_guest) { + return 0; + } + + if (!cgs) { + error_report("missing -machine confidential-guest-support parameter"); + return -EINVAL; + } + + if (!kvm_vm_check_extension(s, KVM_CAP_ARM_RMI)) { + error_report("KVM doesn't support Realms"); + return -ENODEV; + } + + error_setg(&rme_mig_blocker, "RME: migration is not implemented"); + migrate_add_blocker(&rme_mig_blocker, &error_fatal); + + /* + * The realm activation is done last, when the VM starts, after all images + * have been loaded and all vcpus finalized. + */ + qemu_add_vm_change_state_handler(rme_vm_state_change, NULL); + + cgs->require_guest_memfd = true; + cgs->ready = true; + return 0; +} diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c index 88cbe8d85c41..eec1ca3dd2e5 100644 --- a/target/arm/kvm-stub.c +++ b/target/arm/kvm-stub.c @@ -119,3 +119,8 @@ char *kvm_print_register_name(uint64_t regidx) { g_assert_not_reached(); } + +int kvm_arm_rme_init(MachineState *ms, KVMState *s) +{ + g_assert_not_reached(); +} diff --git a/target/arm/kvm.c b/target/arm/kvm.c index ed99be7fd80c..28d5643d6779 100644 --- a/target/arm/kvm.c +++ b/target/arm/kvm.c @@ -660,7 +660,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s) hw_breakpoints = g_array_sized_new(true, true, sizeof(HWBreakpoint), max_hw_bps); - return 0; + ret = kvm_arm_rme_init(ms, s); + if (ret) { + error_report("Failed to enable RME: %s", strerror(-ret)); + } + + return ret; } unsigned long kvm_arch_vcpu_id(CPUState *cpu) diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h index e7c40fb003e4..6d058b0e08a2 100644 --- a/target/arm/kvm_arm.h +++ b/target/arm/kvm_arm.h @@ -240,4 +240,13 @@ void arm_gic_cap_kvm_probe(GICCapability *v2, GICCapability *v3); */ char *kvm_print_register_name(uint64_t regidx); +/** + * kvm_arm_rme_init + * @ms: the machine state + * @s: State of KVM + * + * Prepare the machine to be a Realm, if the user enabled it. + */ +int kvm_arm_rme_init(MachineState *ms, KVMState *s); + #endif -- 2.43.0
