| Message ID | 20241216175803.2716565-12-qperret@google.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | KVM: arm64: Non-protected guest stage-2 support for pKVM | expand |
On Mon, 16 Dec 2024 at 17:58, Quentin Perret <qperret@google.com> wrote: > > In preparation for letting the host unmap pages from non-protected > guests, introduce a new hypercall implementing the host-unshare-guest > transition. > > Signed-off-by: Quentin Perret <qperret@google.com> Apart from nit below. Reviewed-by: Fuad Tabba <tabba@google.com> Cheers, /fuad > --- > arch/arm64/include/asm/kvm_asm.h | 1 + > arch/arm64/kvm/hyp/include/nvhe/mem_protect.h | 1 + > arch/arm64/kvm/hyp/include/nvhe/pkvm.h | 6 ++ > arch/arm64/kvm/hyp/nvhe/hyp-main.c | 21 ++++++ > arch/arm64/kvm/hyp/nvhe/mem_protect.c | 67 +++++++++++++++++++ > arch/arm64/kvm/hyp/nvhe/pkvm.c | 12 ++++ > 6 files changed, 108 insertions(+) > > diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h > index 449337f5b2a3..0b6c4d325134 100644 > --- a/arch/arm64/include/asm/kvm_asm.h > +++ b/arch/arm64/include/asm/kvm_asm.h > @@ -66,6 +66,7 @@ enum __kvm_host_smccc_func { > __KVM_HOST_SMCCC_FUNC___pkvm_host_share_hyp, > __KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_hyp, > __KVM_HOST_SMCCC_FUNC___pkvm_host_share_guest, > + __KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_guest, > __KVM_HOST_SMCCC_FUNC___kvm_adjust_pc, > __KVM_HOST_SMCCC_FUNC___kvm_vcpu_run, > __KVM_HOST_SMCCC_FUNC___kvm_flush_vm_context, > diff --git a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h > index a7976e50f556..e528a42ed60e 100644 > --- a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h > +++ b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h > @@ -40,6 +40,7 @@ int __pkvm_hyp_donate_host(u64 pfn, u64 nr_pages); > int __pkvm_host_share_ffa(u64 pfn, u64 nr_pages); > int __pkvm_host_unshare_ffa(u64 pfn, u64 nr_pages); > int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, enum kvm_pgtable_prot prot); > +int __pkvm_host_unshare_guest(u64 gfn, struct pkvm_hyp_vm *hyp_vm); > > bool addr_is_memory(phys_addr_t phys); > int host_stage2_idmap_locked(phys_addr_t addr, u64 size, enum kvm_pgtable_prot prot); > diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h > index be52c5b15e21..0cc2a429f1fb 100644 > --- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h > +++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h > @@ -64,6 +64,11 @@ static inline bool pkvm_hyp_vcpu_is_protected(struct pkvm_hyp_vcpu *hyp_vcpu) > return vcpu_is_protected(&hyp_vcpu->vcpu); > } > > +static inline bool pkvm_hyp_vm_is_protected(struct pkvm_hyp_vm *hyp_vm) > +{ > + return kvm_vm_is_protected(&hyp_vm->kvm); > +} > + > void pkvm_hyp_vm_table_init(void *tbl); > > int __pkvm_init_vm(struct kvm *host_kvm, unsigned long vm_hva, > @@ -78,6 +83,7 @@ void pkvm_put_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu); > struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void); > > struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle); > +struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle); > void put_pkvm_hyp_vm(struct pkvm_hyp_vm *hyp_vm); > > #endif /* __ARM64_KVM_NVHE_PKVM_H__ */ > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c > index d659462fbf5d..3c3a27c985a2 100644 > --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c > @@ -244,6 +244,26 @@ static void handle___pkvm_host_share_guest(struct kvm_cpu_context *host_ctxt) > cpu_reg(host_ctxt, 1) = ret; > } > > +static void handle___pkvm_host_unshare_guest(struct kvm_cpu_context *host_ctxt) > +{ > + DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); > + DECLARE_REG(u64, gfn, host_ctxt, 2); > + struct pkvm_hyp_vm *hyp_vm; > + int ret = -EINVAL; > + > + if (!is_protected_kvm_enabled()) > + goto out; > + > + hyp_vm = get_np_pkvm_hyp_vm(handle); > + if (!hyp_vm) > + goto out; > + > + ret = __pkvm_host_unshare_guest(gfn, hyp_vm); > + put_pkvm_hyp_vm(hyp_vm); > +out: > + cpu_reg(host_ctxt, 1) = ret; > +} > + > static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt) > { > DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1); > @@ -454,6 +474,7 @@ static const hcall_t host_hcall[] = { > HANDLE_FUNC(__pkvm_host_share_hyp), > HANDLE_FUNC(__pkvm_host_unshare_hyp), > HANDLE_FUNC(__pkvm_host_share_guest), > + HANDLE_FUNC(__pkvm_host_unshare_guest), > HANDLE_FUNC(__kvm_adjust_pc), > HANDLE_FUNC(__kvm_vcpu_run), > HANDLE_FUNC(__kvm_flush_vm_context), > diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c > index fb9592e721cf..30243b7922f1 100644 > --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c > +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c > @@ -1421,3 +1421,70 @@ int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, > > return ret; > } > + > +static int __check_host_shared_guest(struct pkvm_hyp_vm *vm, u64 *__phys, u64 ipa) nit: This parameter in this patch, and others, is sometimes hyp_vm, at others just vm. It would be nicer if it was always the same. > +{ > + enum pkvm_page_state state; > + struct hyp_page *page; > + kvm_pte_t pte; > + u64 phys; > + s8 level; > + int ret; > + > + ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level); > + if (ret) > + return ret; > + if (level != KVM_PGTABLE_LAST_LEVEL) > + return -E2BIG; > + if (!kvm_pte_valid(pte)) > + return -ENOENT; > + > + state = guest_get_page_state(pte, ipa); > + if (state != PKVM_PAGE_SHARED_BORROWED) > + return -EPERM; > + > + phys = kvm_pte_to_phys(pte); > + ret = check_range_allowed_memory(phys, phys + PAGE_SIZE); > + if (WARN_ON(ret)) > + return ret; > + > + page = hyp_phys_to_page(phys); > + if (page->host_state != PKVM_PAGE_SHARED_OWNED) > + return -EPERM; > + if (WARN_ON(!page->host_share_guest_count)) > + return -EINVAL; > + > + *__phys = phys; > + > + return 0; > +} > + > +int __pkvm_host_unshare_guest(u64 gfn, struct pkvm_hyp_vm *vm) > +{ > + u64 ipa = hyp_pfn_to_phys(gfn); > + struct hyp_page *page; > + u64 phys; > + int ret; > + > + host_lock_component(); > + guest_lock_component(vm); > + > + ret = __check_host_shared_guest(vm, &phys, ipa); > + if (ret) > + goto unlock; > + > + ret = kvm_pgtable_stage2_unmap(&vm->pgt, ipa, PAGE_SIZE); > + if (ret) > + goto unlock; > + > + page = hyp_phys_to_page(phys); > + page->host_share_guest_count--; > + if (!page->host_share_guest_count) > + WARN_ON(__host_set_page_state_range(phys, PAGE_SIZE, PKVM_PAGE_OWNED)); > + > +unlock: > + guest_unlock_component(vm); > + host_unlock_component(); > + > + return ret; > +} > diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c > index f2e363fe6b84..1b0982fa5ba8 100644 > --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c > +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c > @@ -376,6 +376,18 @@ void put_pkvm_hyp_vm(struct pkvm_hyp_vm *hyp_vm) > hyp_spin_unlock(&vm_table_lock); > } > > +struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle) > +{ > + struct pkvm_hyp_vm *hyp_vm = get_pkvm_hyp_vm(handle); > + > + if (hyp_vm && pkvm_hyp_vm_is_protected(hyp_vm)) { > + put_pkvm_hyp_vm(hyp_vm); > + hyp_vm = NULL; > + } > + > + return hyp_vm; > +} > + > static void pkvm_init_features_from_host(struct pkvm_hyp_vm *hyp_vm, const struct kvm *host_kvm) > { > struct kvm *kvm = &hyp_vm->kvm; > -- > 2.47.1.613.gc27f4b7a9f-goog >
On Mon, 16 Dec 2024 17:57:56 +0000, Quentin Perret <qperret@google.com> wrote: > > In preparation for letting the host unmap pages from non-protected > guests, introduce a new hypercall implementing the host-unshare-guest > transition. > > Signed-off-by: Quentin Perret <qperret@google.com> > --- > arch/arm64/include/asm/kvm_asm.h | 1 + > arch/arm64/kvm/hyp/include/nvhe/mem_protect.h | 1 + > arch/arm64/kvm/hyp/include/nvhe/pkvm.h | 6 ++ > arch/arm64/kvm/hyp/nvhe/hyp-main.c | 21 ++++++ > arch/arm64/kvm/hyp/nvhe/mem_protect.c | 67 +++++++++++++++++++ > arch/arm64/kvm/hyp/nvhe/pkvm.c | 12 ++++ > 6 files changed, 108 insertions(+) > > diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h > index 449337f5b2a3..0b6c4d325134 100644 > --- a/arch/arm64/include/asm/kvm_asm.h > +++ b/arch/arm64/include/asm/kvm_asm.h > @@ -66,6 +66,7 @@ enum __kvm_host_smccc_func { > __KVM_HOST_SMCCC_FUNC___pkvm_host_share_hyp, > __KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_hyp, > __KVM_HOST_SMCCC_FUNC___pkvm_host_share_guest, > + __KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_guest, > __KVM_HOST_SMCCC_FUNC___kvm_adjust_pc, > __KVM_HOST_SMCCC_FUNC___kvm_vcpu_run, > __KVM_HOST_SMCCC_FUNC___kvm_flush_vm_context, > diff --git a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h > index a7976e50f556..e528a42ed60e 100644 > --- a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h > +++ b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h > @@ -40,6 +40,7 @@ int __pkvm_hyp_donate_host(u64 pfn, u64 nr_pages); > int __pkvm_host_share_ffa(u64 pfn, u64 nr_pages); > int __pkvm_host_unshare_ffa(u64 pfn, u64 nr_pages); > int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, enum kvm_pgtable_prot prot); > +int __pkvm_host_unshare_guest(u64 gfn, struct pkvm_hyp_vm *hyp_vm); > > bool addr_is_memory(phys_addr_t phys); > int host_stage2_idmap_locked(phys_addr_t addr, u64 size, enum kvm_pgtable_prot prot); > diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h > index be52c5b15e21..0cc2a429f1fb 100644 > --- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h > +++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h > @@ -64,6 +64,11 @@ static inline bool pkvm_hyp_vcpu_is_protected(struct pkvm_hyp_vcpu *hyp_vcpu) > return vcpu_is_protected(&hyp_vcpu->vcpu); > } > > +static inline bool pkvm_hyp_vm_is_protected(struct pkvm_hyp_vm *hyp_vm) > +{ > + return kvm_vm_is_protected(&hyp_vm->kvm); > +} > + > void pkvm_hyp_vm_table_init(void *tbl); > > int __pkvm_init_vm(struct kvm *host_kvm, unsigned long vm_hva, > @@ -78,6 +83,7 @@ void pkvm_put_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu); > struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void); > > struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle); > +struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle); > void put_pkvm_hyp_vm(struct pkvm_hyp_vm *hyp_vm); > > #endif /* __ARM64_KVM_NVHE_PKVM_H__ */ > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c > index d659462fbf5d..3c3a27c985a2 100644 > --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c > @@ -244,6 +244,26 @@ static void handle___pkvm_host_share_guest(struct kvm_cpu_context *host_ctxt) > cpu_reg(host_ctxt, 1) = ret; > } > > +static void handle___pkvm_host_unshare_guest(struct kvm_cpu_context *host_ctxt) > +{ > + DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); > + DECLARE_REG(u64, gfn, host_ctxt, 2); > + struct pkvm_hyp_vm *hyp_vm; > + int ret = -EINVAL; > + > + if (!is_protected_kvm_enabled()) > + goto out; > + > + hyp_vm = get_np_pkvm_hyp_vm(handle); > + if (!hyp_vm) > + goto out; > + > + ret = __pkvm_host_unshare_guest(gfn, hyp_vm); > + put_pkvm_hyp_vm(hyp_vm); > +out: > + cpu_reg(host_ctxt, 1) = ret; > +} > + > static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt) > { > DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1); > @@ -454,6 +474,7 @@ static const hcall_t host_hcall[] = { > HANDLE_FUNC(__pkvm_host_share_hyp), > HANDLE_FUNC(__pkvm_host_unshare_hyp), > HANDLE_FUNC(__pkvm_host_share_guest), > + HANDLE_FUNC(__pkvm_host_unshare_guest), > HANDLE_FUNC(__kvm_adjust_pc), > HANDLE_FUNC(__kvm_vcpu_run), > HANDLE_FUNC(__kvm_flush_vm_context), > diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c > index fb9592e721cf..30243b7922f1 100644 > --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c > +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c > @@ -1421,3 +1421,70 @@ int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, > > return ret; > } > + > +static int __check_host_shared_guest(struct pkvm_hyp_vm *vm, u64 *__phys, u64 ipa) > +{ > + enum pkvm_page_state state; > + struct hyp_page *page; > + kvm_pte_t pte; > + u64 phys; > + s8 level; > + int ret; > + > + ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level); > + if (ret) > + return ret; > + if (level != KVM_PGTABLE_LAST_LEVEL) So there is still a very strong assumption that a guest is only provided page mappings, and no blocks? Thanks, M.
On Tuesday 17 Dec 2024 at 08:53:34 (+0000), Fuad Tabba wrote: > nit: This parameter in this patch, and others, is sometimes hyp_vm, at > others just vm. It would be nicer if it was always the same. Argh, where specifically do you see inconsistencies? All changes to mem_protect.c should use 'vm' consistently in this series now. The code in hyp-main.c does use 'hyp_vm' consistently however, but perhaps that is what you meant? I did that to follow the pattern of the existing code that uses 'hyp_vcpu' in that file. Thanks! Quentin
On Tue, 17 Dec 2024 at 13:14, Quentin Perret <qperret@google.com> wrote: > > On Tuesday 17 Dec 2024 at 08:53:34 (+0000), Fuad Tabba wrote: > > nit: This parameter in this patch, and others, is sometimes hyp_vm, at > > others just vm. It would be nicer if it was always the same. > > Argh, where specifically do you see inconsistencies? All changes to > mem_protect.c should use 'vm' consistently in this series now. > > The code in hyp-main.c does use 'hyp_vm' consistently however, but > perhaps that is what you meant? I did that to follow the pattern of the > existing code that uses 'hyp_vcpu' in that file. You're right, my bad. I was looking at the code in the patch, not in the files. Sorry for the noise. /fuad > Thanks! > Quentin
On Tuesday 17 Dec 2024 at 11:29:03 (+0000), Marc Zyngier wrote: > > +static int __check_host_shared_guest(struct pkvm_hyp_vm *vm, u64 *__phys, u64 ipa) > > +{ > > + enum pkvm_page_state state; > > + struct hyp_page *page; > > + kvm_pte_t pte; > > + u64 phys; > > + s8 level; > > + int ret; > > + > > + ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level); > > + if (ret) > > + return ret; > > + if (level != KVM_PGTABLE_LAST_LEVEL) > > So there is still a very strong assumption that a guest is only > provided page mappings, and no blocks? Yep, very much so. It's one of the main limitations of the series as-is (with the absence of support for mapping anything else than memory in guests). Those limitations were mentioned in the cover letter of v1, but I should have kept that mention in later versions, sorry! The last patch of the series has a tweak to user_mem_abort() to force mappings to PTE level which is trivial to do as we already need to do similar things for dirty logging. And __pkvm_host_share_guest() doesn't take a 'size' parameter in its current form, it assumes it is being passed a single pfn. So all in all this works well, and simplifies the series a lot. Huge-page support should come as a natural extension to this series, but I was hoping it could be done separately as that should have no *functional* impact observable from userspace. I'm slightly more concerned about the lack of support for mapping MMIO, but that too is going to be some work, and I guess you should just turn pKVM off if you want that for now... Happy to address either or both of these limitations as part of this series if we think they're strictly required to land this stuff upstream, this is obviously up for debate. But that's going to be quite a few patches on top :-) Thanks, Quentin
On Tue, 17 Dec 2024 13:33:57 +0000, Quentin Perret <qperret@google.com> wrote: > > On Tuesday 17 Dec 2024 at 11:29:03 (+0000), Marc Zyngier wrote: > > > +static int __check_host_shared_guest(struct pkvm_hyp_vm *vm, u64 *__phys, u64 ipa) > > > +{ > > > + enum pkvm_page_state state; > > > + struct hyp_page *page; > > > + kvm_pte_t pte; > > > + u64 phys; > > > + s8 level; > > > + int ret; > > > + > > > + ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level); > > > + if (ret) > > > + return ret; > > > + if (level != KVM_PGTABLE_LAST_LEVEL) > > > > So there is still a very strong assumption that a guest is only > > provided page mappings, and no blocks? > > Yep, very much so. It's one of the main limitations of the series as-is > (with the absence of support for mapping anything else than memory in > guests). Those limitations were mentioned in the cover letter of v1, but > I should have kept that mention in later versions, sorry! > > The last patch of the series has a tweak to user_mem_abort() to force > mappings to PTE level which is trivial to do as we already need to do > similar things for dirty logging. And __pkvm_host_share_guest() doesn't > take a 'size' parameter in its current form, it assumes it is being > passed a single pfn. So all in all this works well, and simplifies the > series a lot. > > Huge-page support should come as a natural extension to this series, but > I was hoping it could be done separately as that should have no > *functional* impact observable from userspace. I'm slightly more > concerned about the lack of support for mapping MMIO, but that too is > going to be some work, and I guess you should just turn pKVM off if > you want that for now... > > Happy to address either or both of these limitations as part of this > series if we think they're strictly required to land this stuff > upstream, this is obviously up for debate. But that's going to be quite > a few patches on top :-) No, I just wanted to make sure I did have the correct interpretation of what this does. 'd rather have something that works first, and then add large mapping support. You can even sell it as a performance improvement! :) Thanks, M.
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h index 449337f5b2a3..0b6c4d325134 100644 --- a/arch/arm64/include/asm/kvm_asm.h +++ b/arch/arm64/include/asm/kvm_asm.h @@ -66,6 +66,7 @@ enum __kvm_host_smccc_func { __KVM_HOST_SMCCC_FUNC___pkvm_host_share_hyp, __KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_hyp, __KVM_HOST_SMCCC_FUNC___pkvm_host_share_guest, + __KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_guest, __KVM_HOST_SMCCC_FUNC___kvm_adjust_pc, __KVM_HOST_SMCCC_FUNC___kvm_vcpu_run, __KVM_HOST_SMCCC_FUNC___kvm_flush_vm_context, diff --git a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h index a7976e50f556..e528a42ed60e 100644 --- a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h +++ b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h @@ -40,6 +40,7 @@ int __pkvm_hyp_donate_host(u64 pfn, u64 nr_pages); int __pkvm_host_share_ffa(u64 pfn, u64 nr_pages); int __pkvm_host_unshare_ffa(u64 pfn, u64 nr_pages); int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, enum kvm_pgtable_prot prot); +int __pkvm_host_unshare_guest(u64 gfn, struct pkvm_hyp_vm *hyp_vm); bool addr_is_memory(phys_addr_t phys); int host_stage2_idmap_locked(phys_addr_t addr, u64 size, enum kvm_pgtable_prot prot); diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h index be52c5b15e21..0cc2a429f1fb 100644 --- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h +++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h @@ -64,6 +64,11 @@ static inline bool pkvm_hyp_vcpu_is_protected(struct pkvm_hyp_vcpu *hyp_vcpu) return vcpu_is_protected(&hyp_vcpu->vcpu); } +static inline bool pkvm_hyp_vm_is_protected(struct pkvm_hyp_vm *hyp_vm) +{ + return kvm_vm_is_protected(&hyp_vm->kvm); +} + void pkvm_hyp_vm_table_init(void *tbl); int __pkvm_init_vm(struct kvm *host_kvm, unsigned long vm_hva, @@ -78,6 +83,7 @@ void pkvm_put_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu); struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void); struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle); +struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle); void put_pkvm_hyp_vm(struct pkvm_hyp_vm *hyp_vm); #endif /* __ARM64_KVM_NVHE_PKVM_H__ */ diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c index d659462fbf5d..3c3a27c985a2 100644 --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c @@ -244,6 +244,26 @@ static void handle___pkvm_host_share_guest(struct kvm_cpu_context *host_ctxt) cpu_reg(host_ctxt, 1) = ret; } +static void handle___pkvm_host_unshare_guest(struct kvm_cpu_context *host_ctxt) +{ + DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); + DECLARE_REG(u64, gfn, host_ctxt, 2); + struct pkvm_hyp_vm *hyp_vm; + int ret = -EINVAL; + + if (!is_protected_kvm_enabled()) + goto out; + + hyp_vm = get_np_pkvm_hyp_vm(handle); + if (!hyp_vm) + goto out; + + ret = __pkvm_host_unshare_guest(gfn, hyp_vm); + put_pkvm_hyp_vm(hyp_vm); +out: + cpu_reg(host_ctxt, 1) = ret; +} + static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt) { DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1); @@ -454,6 +474,7 @@ static const hcall_t host_hcall[] = { HANDLE_FUNC(__pkvm_host_share_hyp), HANDLE_FUNC(__pkvm_host_unshare_hyp), HANDLE_FUNC(__pkvm_host_share_guest), + HANDLE_FUNC(__pkvm_host_unshare_guest), HANDLE_FUNC(__kvm_adjust_pc), HANDLE_FUNC(__kvm_vcpu_run), HANDLE_FUNC(__kvm_flush_vm_context), diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c index fb9592e721cf..30243b7922f1 100644 --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c @@ -1421,3 +1421,70 @@ int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, return ret; } + +static int __check_host_shared_guest(struct pkvm_hyp_vm *vm, u64 *__phys, u64 ipa) +{ + enum pkvm_page_state state; + struct hyp_page *page; + kvm_pte_t pte; + u64 phys; + s8 level; + int ret; + + ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level); + if (ret) + return ret; + if (level != KVM_PGTABLE_LAST_LEVEL) + return -E2BIG; + if (!kvm_pte_valid(pte)) + return -ENOENT; + + state = guest_get_page_state(pte, ipa); + if (state != PKVM_PAGE_SHARED_BORROWED) + return -EPERM; + + phys = kvm_pte_to_phys(pte); + ret = check_range_allowed_memory(phys, phys + PAGE_SIZE); + if (WARN_ON(ret)) + return ret; + + page = hyp_phys_to_page(phys); + if (page->host_state != PKVM_PAGE_SHARED_OWNED) + return -EPERM; + if (WARN_ON(!page->host_share_guest_count)) + return -EINVAL; + + *__phys = phys; + + return 0; +} + +int __pkvm_host_unshare_guest(u64 gfn, struct pkvm_hyp_vm *vm) +{ + u64 ipa = hyp_pfn_to_phys(gfn); + struct hyp_page *page; + u64 phys; + int ret; + + host_lock_component(); + guest_lock_component(vm); + + ret = __check_host_shared_guest(vm, &phys, ipa); + if (ret) + goto unlock; + + ret = kvm_pgtable_stage2_unmap(&vm->pgt, ipa, PAGE_SIZE); + if (ret) + goto unlock; + + page = hyp_phys_to_page(phys); + page->host_share_guest_count--; + if (!page->host_share_guest_count) + WARN_ON(__host_set_page_state_range(phys, PAGE_SIZE, PKVM_PAGE_OWNED)); + +unlock: + guest_unlock_component(vm); + host_unlock_component(); + + return ret; +} diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c index f2e363fe6b84..1b0982fa5ba8 100644 --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c @@ -376,6 +376,18 @@ void put_pkvm_hyp_vm(struct pkvm_hyp_vm *hyp_vm) hyp_spin_unlock(&vm_table_lock); } +struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle) +{ + struct pkvm_hyp_vm *hyp_vm = get_pkvm_hyp_vm(handle); + + if (hyp_vm && pkvm_hyp_vm_is_protected(hyp_vm)) { + put_pkvm_hyp_vm(hyp_vm); + hyp_vm = NULL; + } + + return hyp_vm; +} + static void pkvm_init_features_from_host(struct pkvm_hyp_vm *hyp_vm, const struct kvm *host_kvm) { struct kvm *kvm = &hyp_vm->kvm;
In preparation for letting the host unmap pages from non-protected guests, introduce a new hypercall implementing the host-unshare-guest transition. Signed-off-by: Quentin Perret <qperret@google.com> --- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/kvm/hyp/include/nvhe/mem_protect.h | 1 + arch/arm64/kvm/hyp/include/nvhe/pkvm.h | 6 ++ arch/arm64/kvm/hyp/nvhe/hyp-main.c | 21 ++++++ arch/arm64/kvm/hyp/nvhe/mem_protect.c | 67 +++++++++++++++++++ arch/arm64/kvm/hyp/nvhe/pkvm.c | 12 ++++ 6 files changed, 108 insertions(+)