From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 93BD71E1C1A; Fri, 25 Apr 2025 11:08:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745579324; cv=none; b=YwshypWb3wOn4LL6cJ19Nr0pDqHMl232a2Q24uw7j4t13CijAyNZxuG3EtPg5LUAIuPJNDxEENFsTim3LOZlrokuPRFevE8EF18MHrBkE69Rbu51liaR7kuSg4Ej9Bx8N5mX/1yHv+42J2d69HKtESUlPcGe0wXrTGf/Xr9pXbE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745579324; c=relaxed/simple; bh=m9oQt6VPLAxFVRIMYXwsR6soKz0BMud64V+MX8cIpw0=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=GlnfPL8fULEvXc0jucmHHGw+WL1k0BNgVZWDE6bKT5dgYCRdlysMFO4/It9rq+TTzM8urjKCTm77DH/A3ME8ZK0X/N+Jua6dTDM146bmUBd94VB3i2FxhhsYmyvDU83JEpiYEIcc/K38oJd6auN5OugVHeNpVT7Mk/F6FXI3Saw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 87BC9106F; Fri, 25 Apr 2025 04:08:35 -0700 (PDT) Received: from [10.57.45.160] (unknown [10.57.45.160]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 709853F59E; Fri, 25 Apr 2025 04:08:37 -0700 (PDT) Message-ID: Date: Fri, 25 Apr 2025 12:08:36 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v8 05/43] arm64: RME: Check for RME support at KVM init Content-Language: en-GB To: Steven Price , kvm@vger.kernel.org, kvmarm@lists.linux.dev Cc: Catalin Marinas , Marc Zyngier , Will Deacon , James Morse , Oliver Upton , Zenghui Yu , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Joey Gouly , Alexandru Elisei , Christoffer Dall , Fuad Tabba , linux-coco@lists.linux.dev, Ganapatrao Kulkarni , Gavin Shan , Shanker Donthineni , Alper Gun , "Aneesh Kumar K . V" References: <20250416134208.383984-1-steven.price@arm.com> <20250416134208.383984-6-steven.price@arm.com> From: Suzuki K Poulose In-Reply-To: <20250416134208.383984-6-steven.price@arm.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 16/04/2025 14:41, Steven Price wrote: > Query the RMI version number and check if it is a compatible version. A > static key is also provided to signal that a supported RMM is available. > > Functions are provided to query if a VM or VCPU is a realm (or rec) > which currently will always return false. > > Later patches make use of struct realm and the states as the ioctls > interfaces are added to support realm and REC creation and destruction. > > Signed-off-by: Steven Price > Reviewed-by: Gavin Shan > --- > Changes since v6: > * Improved message for an unsupported RMI ABI version. > Changes since v5: > * Reword "unsupported" message from "host supports" to "we want" to > clarify that 'we' are the 'host'. > Changes since v2: > * Drop return value from kvm_init_rme(), it was always 0. > * Rely on the RMM return value to identify whether the RSI ABI is > compatible. > --- > arch/arm64/include/asm/kvm_emulate.h | 18 +++++++++ > arch/arm64/include/asm/kvm_host.h | 4 ++ > arch/arm64/include/asm/kvm_rme.h | 56 ++++++++++++++++++++++++++++ > arch/arm64/include/asm/virt.h | 1 + > arch/arm64/kvm/Makefile | 3 +- > arch/arm64/kvm/arm.c | 6 +++ > arch/arm64/kvm/rme.c | 56 ++++++++++++++++++++++++++++ > 7 files changed, 143 insertions(+), 1 deletion(-) > create mode 100644 arch/arm64/include/asm/kvm_rme.h > create mode 100644 arch/arm64/kvm/rme.c > > diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h > index d7cf66573aca..1c43a4fc25dd 100644 > --- a/arch/arm64/include/asm/kvm_emulate.h > +++ b/arch/arm64/include/asm/kvm_emulate.h > @@ -686,4 +686,22 @@ static inline void vcpu_set_hcrx(struct kvm_vcpu *vcpu) > vcpu->arch.hcrx_el2 |= HCRX_EL2_EnFPM; > } > } > + > +static inline bool kvm_is_realm(struct kvm *kvm) > +{ > + if (static_branch_unlikely(&kvm_rme_is_available) && kvm) > + return kvm->arch.is_realm; > + return false; > +} > + > +static inline enum realm_state kvm_realm_state(struct kvm *kvm) > +{ > + return READ_ONCE(kvm->arch.realm.state); > +} > + > +static inline bool vcpu_is_rec(struct kvm_vcpu *vcpu) > +{ > + return false; > +} > + > #endif /* __ARM64_KVM_EMULATE_H__ */ > diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h > index e98cfe7855a6..7bd81b86eab0 100644 > --- a/arch/arm64/include/asm/kvm_host.h > +++ b/arch/arm64/include/asm/kvm_host.h > @@ -27,6 +27,7 @@ > #include > #include > #include > +#include > #include > > #define __KVM_HAVE_ARCH_INTC_INITIALIZED > @@ -394,6 +395,9 @@ struct kvm_arch { > * the associated pKVM instance in the hypervisor. > */ > struct kvm_protected_vm pkvm; > + > + bool is_realm; > + struct realm realm; > }; > > struct kvm_vcpu_fault_info { > diff --git a/arch/arm64/include/asm/kvm_rme.h b/arch/arm64/include/asm/kvm_rme.h > new file mode 100644 > index 000000000000..9c8a0b23e0e4 > --- /dev/null > +++ b/arch/arm64/include/asm/kvm_rme.h > @@ -0,0 +1,56 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Copyright (C) 2023 ARM Ltd. > + */ > + > +#ifndef __ASM_KVM_RME_H > +#define __ASM_KVM_RME_H > + > +/** > + * enum realm_state - State of a Realm > + */ > +enum realm_state { > + /** > + * @REALM_STATE_NONE: > + * Realm has not yet been created. rmi_realm_create() may be > + * called to create the realm. > + */ > + REALM_STATE_NONE, > + /** > + * @REALM_STATE_NEW: > + * Realm is under construction, not eligible for execution. Pages > + * may be populated with rmi_data_create(). > + */ > + REALM_STATE_NEW, > + /** > + * @REALM_STATE_ACTIVE: > + * Realm has been created and is eligible for execution with > + * rmi_rec_enter(). Pages may no longer be populated with > + * rmi_data_create(). > + */ > + REALM_STATE_ACTIVE, > + /** > + * @REALM_STATE_DYING: > + * Realm is in the process of being destroyed or has already been > + * destroyed. > + */ > + REALM_STATE_DYING, > + /** > + * @REALM_STATE_DEAD: > + * Realm has been destroyed. > + */ > + REALM_STATE_DEAD > +}; > + > +/** > + * struct realm - Additional per VM data for a Realm > + * > + * @state: The lifetime state machine for the realm > + */ > +struct realm { > + enum realm_state state; > +}; > + > +void kvm_init_rme(void); > + > +#endif /* __ASM_KVM_RME_H */ > diff --git a/arch/arm64/include/asm/virt.h b/arch/arm64/include/asm/virt.h > index ebf4a9f943ed..e45d47156dcf 100644 > --- a/arch/arm64/include/asm/virt.h > +++ b/arch/arm64/include/asm/virt.h > @@ -81,6 +81,7 @@ void __hyp_reset_vectors(void); > bool is_kvm_arm_initialised(void); > > DECLARE_STATIC_KEY_FALSE(kvm_protected_mode_initialized); > +DECLARE_STATIC_KEY_FALSE(kvm_rme_is_available); > > static inline bool is_pkvm_initialized(void) > { > diff --git a/arch/arm64/kvm/Makefile b/arch/arm64/kvm/Makefile > index 209bc76263f1..2ebc66812d49 100644 > --- a/arch/arm64/kvm/Makefile > +++ b/arch/arm64/kvm/Makefile > @@ -23,7 +23,8 @@ kvm-y += arm.o mmu.o mmio.o psci.o hypercalls.o pvtime.o \ > vgic/vgic-v3.o vgic/vgic-v4.o \ > vgic/vgic-mmio.o vgic/vgic-mmio-v2.o \ > vgic/vgic-mmio-v3.o vgic/vgic-kvm-device.o \ > - vgic/vgic-its.o vgic/vgic-debug.o vgic/vgic-v3-nested.o > + vgic/vgic-its.o vgic/vgic-debug.o vgic/vgic-v3-nested.o \ > + rme.o > > kvm-$(CONFIG_HW_PERF_EVENTS) += pmu-emul.o pmu.o > kvm-$(CONFIG_ARM64_PTR_AUTH) += pauth.o > diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c > index 68fec8c95fee..856a721d41ac 100644 > --- a/arch/arm64/kvm/arm.c > +++ b/arch/arm64/kvm/arm.c > @@ -40,6 +40,7 @@ > #include > #include > #include > +#include > #include > > #include > @@ -59,6 +60,8 @@ enum kvm_wfx_trap_policy { > static enum kvm_wfx_trap_policy kvm_wfi_trap_policy __read_mostly = KVM_WFX_NOTRAP_SINGLE_TASK; > static enum kvm_wfx_trap_policy kvm_wfe_trap_policy __read_mostly = KVM_WFX_NOTRAP_SINGLE_TASK; > > +DEFINE_STATIC_KEY_FALSE(kvm_rme_is_available); > + > DECLARE_KVM_HYP_PER_CPU(unsigned long, kvm_hyp_vector); > > DEFINE_PER_CPU(unsigned long, kvm_arm_hyp_stack_base); > @@ -2819,6 +2822,9 @@ static __init int kvm_arm_init(void) > > in_hyp_mode = is_kernel_in_hyp_mode(); > > + if (in_hyp_mode) > + kvm_init_rme(); > + minor nit: I wondering if this check is necessary. If the host is running under a a hypervisor, it could relay the calls to the RMM. Nothing urgent, but it is a possibility. It doesn't matter to the host as such. The Realm Guest will do its own verification and the host can ignore what lies beneath ? Either ways, Reviewed-by: Suzuki K Poulose