Skip to content

Commit ebc59b1

Browse files
committed
drivers/virt: pkvm: Hook up mem_encrypt API using pKVM hypercalls
If we detect the presence of pKVM's SHARE and UNSHARE hypercalls, then register a backend implementation of the mem_encrypt API so that things like DMA buffers can be shared appropriately with the host. Acked-by: Marc Zyngier <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Will Deacon <[email protected]>
1 parent e7bafbf commit ebc59b1

File tree

3 files changed

+119
-0
lines changed

3 files changed

+119
-0
lines changed

Documentation/virt/kvm/arm/hypercalls.rst

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,3 +66,53 @@ Query the memory protection parameters for a pKVM protected virtual machine.
6666
| Return Values: | (int64) | R0 | ``INVALID_PARAMETER (-3)`` on error, else |
6767
| | | | memory protection granule in bytes |
6868
+---------------------+----------+----+---------------------------------------------+
69+
70+
``ARM_SMCCC_KVM_FUNC_MEM_SHARE``
71+
--------------------------------
72+
73+
Share a region of memory with the KVM host, granting it read, write and execute
74+
permissions. The size of the region is equal to the memory protection granule
75+
advertised by ``ARM_SMCCC_KVM_FUNC_HYP_MEMINFO``.
76+
77+
+---------------------+-------------------------------------------------------------+
78+
| Presence: | Optional; pKVM protected guests only. |
79+
+---------------------+-------------------------------------------------------------+
80+
| Calling convention: | HVC64 |
81+
+---------------------+----------+--------------------------------------------------+
82+
| Function ID: | (uint32) | 0xC6000003 |
83+
+---------------------+----------+----+---------------------------------------------+
84+
| Arguments: | (uint64) | R1 | Base IPA of memory region to share |
85+
| +----------+----+---------------------------------------------+
86+
| | (uint64) | R2 | Reserved / Must be zero |
87+
| +----------+----+---------------------------------------------+
88+
| | (uint64) | R3 | Reserved / Must be zero |
89+
+---------------------+----------+----+---------------------------------------------+
90+
| Return Values: | (int64) | R0 | ``SUCCESS (0)`` |
91+
| | | +---------------------------------------------+
92+
| | | | ``INVALID_PARAMETER (-3)`` |
93+
+---------------------+----------+----+---------------------------------------------+
94+
95+
``ARM_SMCCC_KVM_FUNC_MEM_UNSHARE``
96+
----------------------------------
97+
98+
Revoke access permission from the KVM host to a memory region previously shared
99+
with ``ARM_SMCCC_KVM_FUNC_MEM_SHARE``. The size of the region is equal to the
100+
memory protection granule advertised by ``ARM_SMCCC_KVM_FUNC_HYP_MEMINFO``.
101+
102+
+---------------------+-------------------------------------------------------------+
103+
| Presence: | Optional; pKVM protected guests only. |
104+
+---------------------+-------------------------------------------------------------+
105+
| Calling convention: | HVC64 |
106+
+---------------------+----------+--------------------------------------------------+
107+
| Function ID: | (uint32) | 0xC6000004 |
108+
+---------------------+----------+----+---------------------------------------------+
109+
| Arguments: | (uint64) | R1 | Base IPA of memory region to unshare |
110+
| +----------+----+---------------------------------------------+
111+
| | (uint64) | R2 | Reserved / Must be zero |
112+
| +----------+----+---------------------------------------------+
113+
| | (uint64) | R3 | Reserved / Must be zero |
114+
+---------------------+----------+----+---------------------------------------------+
115+
| Return Values: | (int64) | R0 | ``SUCCESS (0)`` |
116+
| | | +---------------------------------------------+
117+
| | | | ``INVALID_PARAMETER (-3)`` |
118+
+---------------------+----------+----+---------------------------------------------+

drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,72 @@
99

1010
#include <linux/arm-smccc.h>
1111
#include <linux/array_size.h>
12+
#include <linux/mem_encrypt.h>
1213
#include <linux/mm.h>
1314

1415
#include <asm/hypervisor.h>
1516

1617
static size_t pkvm_granule;
1718

19+
static int arm_smccc_do_one_page(u32 func_id, phys_addr_t phys)
20+
{
21+
phys_addr_t end = phys + PAGE_SIZE;
22+
23+
while (phys < end) {
24+
struct arm_smccc_res res;
25+
26+
arm_smccc_1_1_invoke(func_id, phys, 0, 0, &res);
27+
if (res.a0 != SMCCC_RET_SUCCESS)
28+
return -EPERM;
29+
30+
phys += pkvm_granule;
31+
}
32+
33+
return 0;
34+
}
35+
36+
static int __set_memory_range(u32 func_id, unsigned long start, int numpages)
37+
{
38+
void *addr = (void *)start, *end = addr + numpages * PAGE_SIZE;
39+
40+
while (addr < end) {
41+
int err;
42+
43+
err = arm_smccc_do_one_page(func_id, virt_to_phys(addr));
44+
if (err)
45+
return err;
46+
47+
addr += PAGE_SIZE;
48+
}
49+
50+
return 0;
51+
}
52+
53+
static int pkvm_set_memory_encrypted(unsigned long addr, int numpages)
54+
{
55+
return __set_memory_range(ARM_SMCCC_VENDOR_HYP_KVM_MEM_UNSHARE_FUNC_ID,
56+
addr, numpages);
57+
}
58+
59+
static int pkvm_set_memory_decrypted(unsigned long addr, int numpages)
60+
{
61+
return __set_memory_range(ARM_SMCCC_VENDOR_HYP_KVM_MEM_SHARE_FUNC_ID,
62+
addr, numpages);
63+
}
64+
65+
static const struct arm64_mem_crypt_ops pkvm_crypt_ops = {
66+
.encrypt = pkvm_set_memory_encrypted,
67+
.decrypt = pkvm_set_memory_decrypted,
68+
};
69+
1870
void pkvm_init_hyp_services(void)
1971
{
2072
int i;
2173
struct arm_smccc_res res;
2274
const u32 funcs[] = {
2375
ARM_SMCCC_KVM_FUNC_HYP_MEMINFO,
76+
ARM_SMCCC_KVM_FUNC_MEM_SHARE,
77+
ARM_SMCCC_KVM_FUNC_MEM_UNSHARE,
2478
};
2579

2680
for (i = 0; i < ARRAY_SIZE(funcs); ++i) {
@@ -34,4 +88,5 @@ void pkvm_init_hyp_services(void)
3488
return;
3589

3690
pkvm_granule = res.a0;
91+
arm64_mem_crypt_ops_register(&pkvm_crypt_ops);
3792
}

include/linux/arm-smccc.h

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,8 @@
116116
#define ARM_SMCCC_KVM_FUNC_FEATURES 0
117117
#define ARM_SMCCC_KVM_FUNC_PTP 1
118118
#define ARM_SMCCC_KVM_FUNC_HYP_MEMINFO 2
119+
#define ARM_SMCCC_KVM_FUNC_MEM_SHARE 3
120+
#define ARM_SMCCC_KVM_FUNC_MEM_UNSHARE 4
119121
#define ARM_SMCCC_KVM_FUNC_FEATURES_2 127
120122
#define ARM_SMCCC_KVM_NUM_FUNCS 128
121123

@@ -144,6 +146,18 @@
144146
ARM_SMCCC_OWNER_VENDOR_HYP, \
145147
ARM_SMCCC_KVM_FUNC_HYP_MEMINFO)
146148

149+
#define ARM_SMCCC_VENDOR_HYP_KVM_MEM_SHARE_FUNC_ID \
150+
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
151+
ARM_SMCCC_SMC_64, \
152+
ARM_SMCCC_OWNER_VENDOR_HYP, \
153+
ARM_SMCCC_KVM_FUNC_MEM_SHARE)
154+
155+
#define ARM_SMCCC_VENDOR_HYP_KVM_MEM_UNSHARE_FUNC_ID \
156+
ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
157+
ARM_SMCCC_SMC_64, \
158+
ARM_SMCCC_OWNER_VENDOR_HYP, \
159+
ARM_SMCCC_KVM_FUNC_MEM_UNSHARE)
160+
147161
/* ptp_kvm counter type ID */
148162
#define KVM_PTP_VIRT_COUNTER 0
149163
#define KVM_PTP_PHYS_COUNTER 1

0 commit comments

Comments
 (0)