Commit ebc59b12 authored by Will Deacon's avatar Will Deacon
Browse files

drivers/virt: pkvm: Hook up mem_encrypt API using pKVM hypercalls 



If we detect the presence of pKVM's SHARE and UNSHARE hypercalls, then
register a backend implementation of the mem_encrypt API so that things
like DMA buffers can be shared appropriately with the host.

Acked-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240830130150.8568-5-will@kernel.org


Signed-off-by: default avatarWill Deacon <will@kernel.org>
parent e7bafbf7

Documentation/virt/kvm/arm/hypercalls.rst

+50 −0
Original line number Diff line number Diff line
@@ -66,3 +66,53 @@ Query the memory protection parameters for a pKVM protected virtual machine. 
| Return Values:      | (int64)  | R0 | ``INVALID_PARAMETER (-3)`` on error, else   |

|                     |          |    | memory protection granule in bytes          |

+---------------------+----------+----+---------------------------------------------+



``ARM_SMCCC_KVM_FUNC_MEM_SHARE``

--------------------------------



Share a region of memory with the KVM host, granting it read, write and execute

permissions. The size of the region is equal to the memory protection granule

advertised by ``ARM_SMCCC_KVM_FUNC_HYP_MEMINFO``.



+---------------------+-------------------------------------------------------------+

| Presence:           | Optional; pKVM protected guests only.                       |

+---------------------+-------------------------------------------------------------+

| Calling convention: | HVC64                                                       |

+---------------------+----------+--------------------------------------------------+

| Function ID:        | (uint32) | 0xC6000003                                       |

+---------------------+----------+----+---------------------------------------------+

| Arguments:          | (uint64) | R1 | Base IPA of memory region to share          |

|                     +----------+----+---------------------------------------------+

|                     | (uint64) | R2 | Reserved / Must be zero                     |

|                     +----------+----+---------------------------------------------+

|                     | (uint64) | R3 | Reserved / Must be zero                     |

+---------------------+----------+----+---------------------------------------------+

| Return Values:      | (int64)  | R0 | ``SUCCESS (0)``                             |

|                     |          |    +---------------------------------------------+

|                     |          |    | ``INVALID_PARAMETER (-3)``                  |

+---------------------+----------+----+---------------------------------------------+



``ARM_SMCCC_KVM_FUNC_MEM_UNSHARE``

----------------------------------



Revoke access permission from the KVM host to a memory region previously shared

with ``ARM_SMCCC_KVM_FUNC_MEM_SHARE``. The size of the region is equal to the

memory protection granule advertised by ``ARM_SMCCC_KVM_FUNC_HYP_MEMINFO``.



+---------------------+-------------------------------------------------------------+

| Presence:           | Optional; pKVM protected guests only.                       |

+---------------------+-------------------------------------------------------------+

| Calling convention: | HVC64                                                       |

+---------------------+----------+--------------------------------------------------+

| Function ID:        | (uint32) | 0xC6000004                                       |

+---------------------+----------+----+---------------------------------------------+

| Arguments:          | (uint64) | R1 | Base IPA of memory region to unshare        |

|                     +----------+----+---------------------------------------------+

|                     | (uint64) | R2 | Reserved / Must be zero                     |

|                     +----------+----+---------------------------------------------+

|                     | (uint64) | R3 | Reserved / Must be zero                     |

+---------------------+----------+----+---------------------------------------------+

| Return Values:      | (int64)  | R0 | ``SUCCESS (0)``                             |

|                     |          |    +---------------------------------------------+

|                     |          |    | ``INVALID_PARAMETER (-3)``                  |

+---------------------+----------+----+---------------------------------------------+

drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c

+55 −0
Original line number Diff line number Diff line
@@ -9,18 +9,72 @@ 


#include <linux/arm-smccc.h>

#include <linux/array_size.h>

#include <linux/mem_encrypt.h>

#include <linux/mm.h>



#include <asm/hypervisor.h>



static size_t pkvm_granule;



static int arm_smccc_do_one_page(u32 func_id, phys_addr_t phys)

{

	phys_addr_t end = phys + PAGE_SIZE;



	while (phys < end) {

		struct arm_smccc_res res;



		arm_smccc_1_1_invoke(func_id, phys, 0, 0, &res);

		if (res.a0 != SMCCC_RET_SUCCESS)

			return -EPERM;



		phys += pkvm_granule;

	}



	return 0;

}



static int __set_memory_range(u32 func_id, unsigned long start, int numpages)

{

	void *addr = (void *)start, *end = addr + numpages * PAGE_SIZE;



	while (addr < end) {

		int err;



		err = arm_smccc_do_one_page(func_id, virt_to_phys(addr));

		if (err)

			return err;



		addr += PAGE_SIZE;

	}



	return 0;

}



static int pkvm_set_memory_encrypted(unsigned long addr, int numpages)

{

	return __set_memory_range(ARM_SMCCC_VENDOR_HYP_KVM_MEM_UNSHARE_FUNC_ID,

				  addr, numpages);

}



static int pkvm_set_memory_decrypted(unsigned long addr, int numpages)

{

	return __set_memory_range(ARM_SMCCC_VENDOR_HYP_KVM_MEM_SHARE_FUNC_ID,

				  addr, numpages);

}



static const struct arm64_mem_crypt_ops pkvm_crypt_ops = {

	.encrypt	= pkvm_set_memory_encrypted,

	.decrypt	= pkvm_set_memory_decrypted,

};



void pkvm_init_hyp_services(void)

{

	int i;

	struct arm_smccc_res res;

	const u32 funcs[] = {

		ARM_SMCCC_KVM_FUNC_HYP_MEMINFO,

		ARM_SMCCC_KVM_FUNC_MEM_SHARE,

		ARM_SMCCC_KVM_FUNC_MEM_UNSHARE,

	};



	for (i = 0; i < ARRAY_SIZE(funcs); ++i) {
@@ -34,4 +88,5 @@ void pkvm_init_hyp_services(void) 
		return;



	pkvm_granule = res.a0;

	arm64_mem_crypt_ops_register(&pkvm_crypt_ops);

}

include/linux/arm-smccc.h

+14 −0
Original line number Diff line number Diff line
@@ -116,6 +116,8 @@ 
#define ARM_SMCCC_KVM_FUNC_FEATURES		0

#define ARM_SMCCC_KVM_FUNC_PTP			1

#define ARM_SMCCC_KVM_FUNC_HYP_MEMINFO		2

#define ARM_SMCCC_KVM_FUNC_MEM_SHARE		3

#define ARM_SMCCC_KVM_FUNC_MEM_UNSHARE		4

#define ARM_SMCCC_KVM_FUNC_FEATURES_2		127

#define ARM_SMCCC_KVM_NUM_FUNCS			128
@@ -144,6 +146,18 @@ 
			   ARM_SMCCC_OWNER_VENDOR_HYP,			\

			   ARM_SMCCC_KVM_FUNC_HYP_MEMINFO)



#define ARM_SMCCC_VENDOR_HYP_KVM_MEM_SHARE_FUNC_ID			\

	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,				\

			   ARM_SMCCC_SMC_64,				\

			   ARM_SMCCC_OWNER_VENDOR_HYP,			\

			   ARM_SMCCC_KVM_FUNC_MEM_SHARE)



#define ARM_SMCCC_VENDOR_HYP_KVM_MEM_UNSHARE_FUNC_ID			\

	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,				\

			   ARM_SMCCC_SMC_64,				\

			   ARM_SMCCC_OWNER_VENDOR_HYP,			\

			   ARM_SMCCC_KVM_FUNC_MEM_UNSHARE)



/* ptp_kvm counter type ID */

#define KVM_PTP_VIRT_COUNTER			0

#define KVM_PTP_PHYS_COUNTER			1