Commit a1ec5c70 authored by Fuad Tabba's avatar Fuad Tabba Committed by Marc Zyngier
Browse files

KVM: arm64: Add infrastructure to create and track pKVM instances at EL2 



Introduce a global table (and lock) to track pKVM instances at EL2, and
provide hypercalls that can be used by the untrusted host to create and
destroy pKVM VMs and their vCPUs. pKVM VM/vCPU state is directly
accessible only by the trusted hypervisor (EL2).

Each pKVM VM is directly associated with an untrusted host KVM instance,
and is referenced by the host using an opaque handle. Future patches
will provide hypercalls to allow the host to initialize/set/get pKVM
VM/vCPU state using the opaque handle.

Tested-by: default avatarVincent Donnefort <vdonnefort@google.com>
Signed-off-by: default avatarFuad Tabba <tabba@google.com>
Co-developed-by: default avatarWill Deacon <will@kernel.org>
Signed-off-by: default avatarWill Deacon <will@kernel.org>
[maz: silence warning on unmap_donated_memory_noclear()]
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20221110190259.26861-13-will@kernel.org
parent 5304002d

arch/arm64/include/asm/kvm_asm.h

+3 −0
Original line number Diff line number Diff line
@@ -76,6 +76,9 @@ enum __kvm_host_smccc_func { 
	__KVM_HOST_SMCCC_FUNC___vgic_v3_save_aprs,

	__KVM_HOST_SMCCC_FUNC___vgic_v3_restore_aprs,

	__KVM_HOST_SMCCC_FUNC___pkvm_vcpu_init_traps,

	__KVM_HOST_SMCCC_FUNC___pkvm_init_vm,

	__KVM_HOST_SMCCC_FUNC___pkvm_init_vcpu,

	__KVM_HOST_SMCCC_FUNC___pkvm_teardown_vm,

};



#define DECLARE_KVM_VHE_SYM(sym)	extern char sym[]

arch/arm64/include/asm/kvm_host.h

+8 −0
Original line number Diff line number Diff line
@@ -115,6 +115,8 @@ struct kvm_smccc_features { 
	unsigned long vendor_hyp_bmap;

};



typedef unsigned int pkvm_handle_t;



struct kvm_arch {

	struct kvm_s2_mmu mmu;
@@ -166,6 +168,12 @@ struct kvm_arch { 


	/* Hypercall features firmware registers' descriptor */

	struct kvm_smccc_features smccc_feat;



	/*

	 * For an untrusted host VM, 'pkvm_handle' is used to lookup

	 * the associated pKVM instance in the hypervisor.

	 */

	pkvm_handle_t pkvm_handle;

};



struct kvm_vcpu_fault_info {

arch/arm64/include/asm/kvm_pgtable.h

+8 −0
Original line number Diff line number Diff line
@@ -296,6 +296,14 @@ u64 kvm_pgtable_hyp_unmap(struct kvm_pgtable *pgt, u64 addr, u64 size); 
 */

u64 kvm_get_vtcr(u64 mmfr0, u64 mmfr1, u32 phys_shift);



/**

 * kvm_pgtable_stage2_pgd_size() - Helper to compute size of a stage-2 PGD

 * @vtcr:	Content of the VTCR register.

 *

 * Return: the size (in bytes) of the stage-2 PGD

 */

size_t kvm_pgtable_stage2_pgd_size(u64 vtcr);



/**

 * __kvm_pgtable_stage2_init() - Initialise a guest stage-2 page-table.

 * @pgt:	Uninitialised page-table structure to initialise.

arch/arm64/include/asm/kvm_pkvm.h

+8 −0
Original line number Diff line number Diff line
@@ -9,6 +9,9 @@ 
#include <linux/memblock.h>

#include <asm/kvm_pgtable.h>



/* Maximum number of VMs that can co-exist under pKVM. */

#define KVM_MAX_PVMS 255



#define HYP_MEMBLOCK_REGIONS 128



extern struct memblock_region kvm_nvhe_sym(hyp_memory)[];
@@ -40,6 +43,11 @@ static inline unsigned long hyp_vmemmap_pages(size_t vmemmap_entry_size) 
	return res >> PAGE_SHIFT;

}



static inline unsigned long hyp_vm_table_pages(void)

{

	return PAGE_ALIGN(KVM_MAX_PVMS * sizeof(void *)) >> PAGE_SHIFT;

}



static inline unsigned long __hyp_pgtable_max_pages(unsigned long nr_pages)

{

	unsigned long total = 0, i;

arch/arm64/kvm/hyp/include/nvhe/mem_protect.h

+3 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <asm/kvm_mmu.h>

#include <asm/kvm_pgtable.h>

#include <asm/virt.h>

#include <nvhe/pkvm.h>

#include <nvhe/spinlock.h>



/*
@@ -68,10 +69,12 @@ bool addr_is_memory(phys_addr_t phys); 
int host_stage2_idmap_locked(phys_addr_t addr, u64 size, enum kvm_pgtable_prot prot);

int host_stage2_set_owner_locked(phys_addr_t addr, u64 size, u8 owner_id);

int kvm_host_prepare_stage2(void *pgt_pool_base);

int kvm_guest_prepare_stage2(struct pkvm_hyp_vm *vm, void *pgd);

void handle_host_mem_abort(struct kvm_cpu_context *host_ctxt);



int hyp_pin_shared_mem(void *from, void *to);

void hyp_unpin_shared_mem(void *from, void *to);

void reclaim_guest_pages(struct pkvm_hyp_vm *vm);



static __always_inline void __load_host_stage2(void)

{