Alexandru Elisei authored Oct 04, 2022 and Suzuki Poulose committed Aug 08, 2023

We have everything in place to create a realm, allow the user to do so.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Joey Gouly authored Oct 14, 2022 and Suzuki Poulose committed Aug 08, 2023

For Realms, inject a synchronous external abort, instead of ignoring unknown
MMIO accesses.

Signed-off-by: Joey Gouly <joey.gouly@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Joey Gouly authored Oct 04, 2022 and Suzuki Poulose committed Aug 08, 2023

Add a hook that allows an architecture to run some code on an
unhandled MMIO access.

Signed-off-by: Joey Gouly <joey.gouly@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

For realms, force the F_ACCESS_PLATFORM flag to ensure DMA-APIs
are triggered for virtio in Linux

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Add callbacks for archs to provide virtio host flags.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Add a wrapper to the vdev->ops->get_host_features() to allow
setting platform specific flags outside the device

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

The Realm's IPA space is divided into 2 halves. Protected
(lower half) and Unprotected (upper half). KVM implements
aliasing of the IPA, where the unprotected IPA is alias of
the corresponding protected ipa. Thus we must double the
IPA space required for a given VM.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Alexandru Elisei authored Oct 29, 2021 and Suzuki Poulose committed Aug 08, 2023

Don't read the register values for a running realm, because they don't
reflect the actual hardware state of a realm. And don't try to read realm
memory, because that will promptly lead to kvmtool being killed.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Christoffer Dall authored Mar 06, 2020 and Suzuki Poulose committed Aug 08, 2023

This lets the VM use the RMM implementation for PSCI.

Signed-off-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Alexandru Elisei authored Oct 04, 2022 and Suzuki Poulose committed Aug 08, 2023

Before KVM can run a VCPU belong to a realm, the realm be activated.
Activating a realm prevents the adding of new object and seals the
cryptographic measurement of that realm. The VCPU state is part of the
measurement, which means that realm activation must be performed after
all VCPUs have been reset.

Current RMM implementation can only create RECs in the order of their
MPIDRs. VCPUs get assigned MPIDRs by KVM based on their VCPU id. Reset the
VCPUs in the order they were created from the main thread instead of doing
it from their own thread, which doesn't guarantee any ordering.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Alexandru Elisei authored Sep 18, 2020 and Suzuki Poulose committed Aug 08, 2023

Add a last_init macro for constructor functions that will be executed last
in the initialization process. Add a symmetrical macro, last_exit, for
destructor functions that will be the last to be executed when kvmtool
exits.

The list priority for the late_{init, exit} macros has been bumped down a
spot, but their relative priority remains unchanged, to keep the same size
for the init_lists and exit_lists.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Alexandru Elisei authored Oct 21, 2021 and Suzuki Poulose committed Aug 08, 2023

In order to run a VCPU belonging to a realm, that VCPU must be in the
finalized state. Finalize the CPU after reset, since kvmtool won't be
touching the VCPU state afterwards.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Christoffer Dall authored Jul 06, 2021 and Suzuki Poulose committed Aug 08, 2023

RME doesn't allow setting the PSTATE but resets it to an architectural
value, and KVM also does not allow setting this register from user
space, so stop trying to do that.

Signed-off-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Populate the realm memory with the initial contents, which include
the device tree blob, the kernel image, and initrd, if specified,
or the firmware image.

Populating an image in the realm involves two steps:
 a) Mark the IPA area as RAM - INIT_IPA_REALM
 b) Load the contents into the IPA - POPULATE_REALM

Wherever we know the actual size of an image in memory, we make
sure the "memory area" is initialised to RAM.
e.g., Linux kernel image size from the header which includes the bss etc.
The "file size" on disk for the Linux image is much smaller.
We mark the region of size Image.header.size as RAM (a), from the kernel
load address. And load the Image file into the memory (b) above.
At the moment we only detect the Arm64 Linux Image header format.

Also make sure that the images are not overlapping in 4K page, by aligning
the image base / end accordingly.

Since we're already touching the code that copies the
initrd in guest memory, let's do a bit of cleaning and remove a
useless local variable.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
[ Make sure the Linux kernel image area is marked as RAM
  Ensure images do not overlap at 4K page boundaries explicitly
]
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Configure the default number of Debug HW registers for the Realm.
A user option could be specified if necessary.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Add an option to specify the number of PMU counters for a Realm VM.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Add option to specify SVE vector length for realms.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Add option to specify Realm personalisation value

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Realm must be configured before it is created. Add the
step to specify the parameters for the Realm.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Add the command line option to specify the algorithm that will be used
to create the cryptographic measurement of the realm. Valid options are
"sha256" and "sha512". The final measurement will be a hash using the
selected algorithm

Signed-off-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Create the Realm Descriptor using the measurement algorithm set
with --measurement-algo.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Alexandru Elisei authored Oct 08, 2021 and Suzuki Poulose committed Jul 27, 2023

RMM doesn't yet support paging protected memory pages. Thus the VMM
must pin the entire VM memory.

Use mlock2 to keep the realm pages pinned in memory once they are faulted
in. Use the MLOCK_ONFAULT flag to prevent pre-mapping the pages and
maintain some semblance of on demand-paging for a realm VM.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Christoffer Dall authored Oct 07, 2021 and Suzuki Poulose committed Jul 27, 2023

Set the machine type to realm when creating a VM via the KVM_CREATE_VM
ioctl.

Signed-off-by: Christoffer Dall <christoffer.dall@arm.com>
[ Alex E: Reworked patch, split the command line option into a different
          patch ]
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
[ Suzuki: Exit early if Realm support is not available ]
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Alexandru Elisei authored Oct 04, 2022 and Suzuki Poulose committed Jul 27, 2023

Add the --realm command line option which causes kvmtool to exit with an
error if specified, but which will be enabled once realms are fully
supported by kvmtool.

Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Update the RME specific ABI bits from the kernel headers.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

kvmtool enables SVE whenever it is supported by the KVM.
However, Realm VMs may want controlled features, which gets
measured during the creation. Thus, provide an option to disable
the SVE, to preserve the current behavior of SVE on by default.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Similar to PVtime, check the SVE capability on the VM instance
to account for the different VM types and the corresponding support.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

KVM_CAP_STEAL_TIME can be checked against a VM instance.
To allow controlling the feature depending on the VM type,
use the cap against the VM.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

The arm64 kernel image header (also used by EDK2 UEFI) provides the
actual size of the kernel image in memory, including the bss and any
other reserved pages for early boot. This is not accounted for in the
file size, and we could potentially place other images at this
"uninitialized" area of the kernel (e.g., initrd), which may get
overwritten during the early boot. Use the actual memory size of the
image, when available, to place the images safely.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Handle failures in creating the memory maps and back in
transitioning the CFI flash. e.g., with MTE enabled, CFI
flash emulation breaks with the map operation, silently.
And we later hit unhandled aborts in the guest.

To avoid such issues, let us make sure we catch the error
and handle it right at source.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

CFI Flash file image cannot be mapped into the memory of the
guest if MTE is enabled. Thus disable MTE if flash emulation
is requested.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Currently, we ensure that guest RAM alloc size is at least 2M for
THP which works well for RV64 but breaks hugepage support for RV32.
To fix this, we use 4M as hugepage size for RV32.

Fixes: 867159a7 ("riscv: Implement Guest/VM arch functions")
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-10-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

When the Ssaia extension is available expose it to the guest.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-9-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

When the Zicboz extension is available expose it to the guest.
Also provide the guest the size of the cache block through DT.

Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-8-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

The zbb extension allows software to use basic bitmanip instructions.
Let us add the zbb extension to the Guest device tree whenever it is
supported by the host.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-7-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

Let us follow alphabetical order for listing ISA extensions in
the isa_info_arr[] array.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-6-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

We add "--disable-sbi-<xyz>" options to disable various SBI extensions
visible to the Guest. This allows users to disable deprecated/redundant
SBI extensions.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-5-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

We add command-line parameter to set custom mvendorid, marchid, and
mimpid so that users can show fake CPU type to Guest/VM which does
not match underlying Host CPU.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-4-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>

We sync-up Linux headers to get latest KVM RISC-V headers having
SBI extension enable/disable, Zbb, Zicboz, and Ssaia support.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Link: https://lore.kernel.org/r/20230712163501.1769737-3-apatel@ventanamicro.com


Signed-off-by: Will Deacon <will@kernel.org>