NVIDIA: arm64: add Arm CCA Realm and RME-DA support - #37
Closed
ianm-nv wants to merge 54 commits into
Closed
Conversation
This is a temporary patch intended for testing purposes only. It provides definitions related to supporting Realms by the QEMU-VMM. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 623769c2333199187c383c0866a383dfe6803724) Signed-off-by: Ian May <[email protected]>
Returning an error to kvm_init() is fatal anyway, no need to continue the initialization. Leave the `ret` variable in the function scope because it will be reused when adding RME support. Signed-off-by: Jean-Philippe Brucker <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 16b7980b7de5d6ad2ba9360f86424a6bba93d026) Signed-off-by: Ian May <[email protected]>
Add a new RmeGuest object, inheriting from ConfidentialGuestSupport, to support the Arm Realm Management Extension (RME). It is instantiated by passing on the command-line: -M virt,confidential-guest-support=<id> -object rme-guest,id=<id> This is only the skeleton. Support will be added in following patches. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 58c26e898c764b281ef864f225080d327bfa90e9) Signed-off-by: Ian May <[email protected]>
Initialise an @rme_guest object and install a handler to get notified when the Realm is ready to start. That way we can finish reading the Realm once we know everything is in place. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 018ef4e1c3e7c7f3c5f9329971dfbda75b407d51) Signed-off-by: Ian May <[email protected]>
For a Realm, KVM is much more restrictive on the registers a VMM can initialize. To prepare for Realm VM initialization, split the get/put register functions for a non-secure VM in their own function. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit a9e68b595993669cd069d3b8293a6971fc816eaa) Signed-off-by: Ian May <[email protected]>
The target code calls kvm_arm_vcpu_init() to mark the vCPU as part of a Realm. For a Realm vCPU, only x0-x7 can be set at runtime. Before boot, the PC can also be set, and is ignored at runtime. KVM also accepts a few system register changes during initial configuration, as returned by KVM_GET_REG_LIST. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 72ed91d5a5b197c81b928c540d736046ea3dc2a4) Signed-off-by: Ian May <[email protected]>
When a Realm is requested, create a scratch Realm VM by setting bit 8 of the argument given to the KVM_CREATE_VM ioctl(). Bit 7-0 are reserved for the guest PA size. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 960868f65cbd8cb72104b9d4ea33333e70a8058f) Signed-off-by: Ian May <[email protected]>
The Arm KVM code can return different values from KVM_CHECK_EXTENSION depending on the VM type. Use kvm_vm_check_extension() where necessary to ensure we get the right response from KVM. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 906c5e54bdd6fb2480a6badaf15218881e88e417) Signed-off-by: Ian May <[email protected]>
Add a function to register a notifier that is invoked when ROMs get loaded into guest memory. It will be used by Arm confidential guest support, in order to register all blobs loaded into memory with KVM, so that their content is moved into Realm state and measured into the initial VM state. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit e5ce212b35a5305d697a2b4942b20e08f2145574) Signed-off-by: Ian May <[email protected]>
Add a Rom notifier to keep track of binary blobs loaded in Realm memory. That way we can deterministically calculate the Realm Initial Measurement (RIM). Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 9eb61bad66cb444edb4eb68b81f66fc9ba6f4877) Signed-off-by: Ian May <[email protected]>
Once the Realm descriptor has been created, tell KVM to transfer runtime images (kernel, DT, and rootfs) from guest memory to Realm memory. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit e7fd0efe94c8b519a6f7b146bf32ac5163af35a4) Signed-off-by: Ian May <[email protected]>
Add "num-breakpoints" and "num-watchpoints" CPU parameters to configure the debug features that KVM presents to the guest. The KVM vCPU configuration is modified by calling SET_ONE_REG on the ID register. This is needed for Realm VMs, whose parameters include breakpoints and watchpoints, and influence the Realm Initial Measurement. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit d936b45fce80e7ab959fc8e5c237321269b30cf1) Signed-off-by: Ian May <[email protected]>
Add a "num-pmu-counters" CPU parameter to configure the number of counters that KVM presents to the guest. This is needed for Realm VMs, whose parameters include the number of PMU counters and influence the Realm Initial Measurement. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 23b2e1552b3a5eb839eecacc05af41cdc9d19ce9) Signed-off-by: Ian May <[email protected]>
The host cannot access registers of a Realm. Instead of showing all registers as zero in "info registers", display a message about this restriction. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 6128158ccfd1f6999e5decb055edf783e9580a4f) Signed-off-by: Ian May <[email protected]>
The HVC conduit for PSCI is not supported for Realms, so default to SMC. Signed-off-by: Jean-Philippe Brucker <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit ac4d5a4efa330b752b188ce7ff99b21084151bb2) Signed-off-by: Ian May <[email protected]>
Set the Ream VM bit in the IPA address space size when needed. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 5240a5d3e37301963b23961d1f78a863fd7e7d31) Signed-off-by: Ian May <[email protected]>
When RME is enabled, the upper GPA bit is used to distinguish protected from unprotected addresses. Reserve it when setting up the guest memory map. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit dbc7b2562b58593c65a08fa49a90cca41fafdb67) Signed-off-by: Ian May <[email protected]>
The dtb-randomness feature, which adds random seeds to the DTB, isn't really compatible with confidential VMs since it randomizes the Realm Initial Measurement. Enabling it is not an error, but it prevents attestation. It also isn't useful to a Realm, which doesn't trust host input. Currently the feature is automatically enabled, unless the user disables it on the command-line. Change it to OnOffAuto, and automatically disable it for confidential VMs, unless the user explicitly enables it. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 77523055d10908fb13713ac3a95fe15b13a78153) Signed-off-by: Ian May <[email protected]>
For confidential VMs we'll want to skip flash device creation. Unfortunately, in virt_instance_init() the machine->cgs member has not yet been initialized, so we cannot check whether confidential guest is enabled. Move virt_flash_create() to machvirt_init(), where we can access the machine->cgs member. Signed-off-by: Jean-Philippe Brucker <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 2ca91d63c89fb5d5d1ed3933a4251b88f696b454) Signed-off-by: Ian May <[email protected]>
Use RAM instead of flash to store firmware image and boot information, including UEFI variables. That way the firmware can be measured and included in the Realm's initial measurements. It also prevents variable stored in flash and modified as part of the boot process to be leaked outside the Realm. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 768b9877a9392fbc2908506cc6599243f77b44c7) Signed-off-by: Ian May <[email protected]>
In Arm CCA, the guest-physical address space is split in half. The top half represents memory shared between guest and host, and the bottom half is private to the guest. From QEMU's point of view, the two halves are merged into a single region, and pages within this region are either shared or private. Virtual devices implemented by the host are only allowed to access the top half. For emulated MMIO, KVM strips the GPA before returning to QEMU, so the GPA already belongs to QEMU's merged view of guest memory. However DMA addresses cannot be stripped this way and need special handling by the VMM. When emulating DMA the VMM needs to translate the addresses into its merged view. Add an IOMMU memory region on the top half, that retargets DMA accesses to the merged sysmem. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 853503808328ce96a18094b52929ba4a3c31614f) Signed-off-by: Ian May <[email protected]>
Some distributions provide packages continaing firmware to be run under QEMU, such as "qemu-efi-aarch64" or "edk2-aarch64". Those packages also contain descriptors in /usr/share/qemu/firmware/*.json listing the firmware features, so that environments like libvirt can figure out which firmware they can load. Define an optional feature for arm64 firmware to indicate that a firmware supports running in a Realm. Firmware implementations need extra support for running in a Realm, in particular to distinguish shared from private guest memory. Signed-off-by: Jean-Philippe Brucker <[email protected]> Acked-by: Markus Armbruster <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 9fef70b2db6f218912329128a31371943513c4b4) Signed-off-by: Ian May <[email protected]>
Load DTB without modifications when provided. That way it is possible for a verification entity to reconstruct the Realm's initial measurement. Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit 65c43413064928ba0ffba01ff29adde0623b743f) Signed-off-by: Ian May <[email protected]>
An independent verifier needs to reconstruct the content of guest memory in order to attest that it is running trusted code. To avoid having to reconstruct the bootloader generated by QEMU, skip this step and jump directly to the kernel, with the DTB address in x0 as specified by the Linux boot protocol [1]. [1] https://docs.kernel.org/arch/arm64/booting.html Signed-off-by: Jean-Philippe Brucker <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> (cherry picked from commit eddc40b4b87bd74f411753e59d6f1946d4f33d75) Signed-off-by: Ian May <[email protected]>
The RFC series takes KVM_CAP_ARM_RMI from linux-headers, but the capability number is not stable: it shifts whenever other KVM capabilities land ahead of it, so the header value only matches hosts built from the same snapshot. NVIDIA kernels export the live value as a module parameter, so prefer that and fall back to the compile-time constant. Rebased onto the RFC v2 series, which moved the check to kvm_vm_check_extension() inside the ConfidentialGuestSupportClass kvm_init hook. Signed-off-by: Ian May <[email protected]>
KVM_CAP_ARM_NISV_TO_USER is not on the realm-ext-allowed list, so KVM_ENABLE_CAP returns -EINVAL for a realm VM and QEMU prints a spurious 'Failed to enable KVM_CAP_ARM_NISV_TO_USER cap' error. The cap has no effect on realms -- their faults go through the RMM path -- so skip it. Rebased onto RFC v2, which removed kvm_arm_rme_vm_type(); use ms->cgs, the same realm test the series itself uses for the VM type. Signed-off-by: Ian May <[email protected]>
The RFC series defines KVM_VM_TYPE_ARM_REALM as a standalone flag bit (1UL << 30). Our kernel instead carves a 4-bit VM-type field out of bits[11:8] and defines REALM as KVM_VM_TYPE_ARM(1) == 0x100. With the upstream encoding, KVM_CREATE_VM passes bit 30, which our kernel reads as VM type 0 (normal) with a stray reserved bit, so the realm is silently created as a normal VM and every subsequent RMI call fails. Realign the header with include/uapi/linux/kvm.h. Only REALM and NORMAL are referenced by QEMU (target/arm/kvm.c, hw/arm/virt.c), so no code change is needed. KVM_VM_TYPE_ARM_MASK gains the type field in place of the single REALM bit; PROTECTED is bit 31 in both encodings. Signed-off-by: Ian May <[email protected]>
Introduce address_space_range_is_ram(), a helper to determine whether a guest physical address range within an AddressSpace resolves entirely to RAM-backed MemoryRegions. The range is walked using address_space_translate() so contiguous RAM-only ranges return true even when they cross multiple MemoryRegion boundaries; any byte backed by non-RAM (MMIO, ROM device, hole) returns false. Signed-off-by: Shameer Kolothum <[email protected]> (backported from: https://lore.kernel.org/all/[email protected]/) Signed-off-by: Jiandi An <[email protected]> Acked-by: Matthew R. Ochs <[email protected]> Acked-by: Nathan Chen <[email protected]> Signed-off-by: Matthew R. Ochs <[email protected]> (cherry picked from commit df8afae) Signed-off-by: Ian May <[email protected]>
KVM_ARM_RMI_POPULATE requires page-aligned guest and userspace addresses, but the ROM notifier records byte-granular regions and the population code maps from the unaligned address. It also ignores failed or short address_space_map() results, and overlapping ROM blobs can cause the same page to be populated twice. Align and coalesce the notified ranges, map each direct RAM extent separately, validate the mapping, and detect a successful ioctl that made no progress. Include the zero-filled portion of ELF segments so BSS pages are populated and measured. Treat any population failure as fatal because vCPUs must never run after a partially populated Realm. Signed-off-by: Ian May <[email protected]>
Realm KVM restricts SET_ONE_REG to registers that form part of the Realm creation interface. The v2 QEMU series nevertheless sets PMCR_EL0 directly for the num-pmu-counters property, which the matching v2 kernel rejects. Use KVM_ARM_VCPU_PMU_V3_SET_NR_COUNTERS when the kernel exposes it, retaining SET_ONE_REG as a fallback for older kernels. Also make explicit debug and PMU configuration failures fatal: continuing would create a Realm whose measured parameters differ from the requested CPU configuration. Signed-off-by: Ian May <[email protected]>
The Realm PCI DMA remapper currently grants read/write access to both halves of the IPA space even though only addresses carrying the shared bit are host-accessible. Reject private-half DMA instead of silently redirecting it into QEMU RAM. A guest-visible SMMUv3 or virtio-IOMMU also replaces, or is replaced by, the Realm remapper because PCIBus supports only one IOMMU operation set. Until the translations can be composed, reject that configuration explicitly rather than exposing a non-functional IOMMU to the guest. Signed-off-by: Ian May <[email protected]>
The global rme_guest pointer treats merely creating an rme-guest object as enabling Realm behavior. An object that is not linked to the machine therefore changes vCPU initialization and DMA setup for an otherwise normal VM, and deleting it leaves a stale global pointer. Resolve Realm state from MachineState::cgs, use the cgs passed to the KVM initializer, and pass the owning object through callbacks and PCI IOMMU opaque data. Track and remove the ROM and VM-state notifiers at object finalization. This permits harmless orphan objects without affecting the selected VM type. Signed-off-by: Ian May <[email protected]>
Arm KVM can report different capabilities for a Realm VM than for the system as a whole. The scratch Realm CPU probe currently uses a mix of system and VM checks, which can request features such as SVE or EL2 that the Realm VM does not support. Use VM-scoped checks consistently for optional vCPU features. Also retain the Realm VM-type bits when running on a legacy fixed-IPA host; only the explicit IPA-size field must be omitted in that case. Signed-off-by: Ian May <[email protected]>
The confidential firmware path checks the filename returned by qemu_find_file() but then passes the unresolved command-line name to the loader. Firmware found through QEMU's data search path therefore fails to load, and the resolved string is leaked. Load the resolved path and release it automatically. Signed-off-by: Ian May <[email protected]>
Signed-off-by: Ian May <[email protected]>
Signed-off-by: Ian May <[email protected]>
Signed-off-by: Ian May <[email protected]>
Signed-off-by: Ian May <[email protected]>
Signed-off-by: Ian May <[email protected]>
The RME series installs its shared-IPA DMA translation only on the PCI bus. Platform virtio-mmio devices therefore continue to use address_space_memory, allowing private IPAs to bypass the Realm DMA policy. The same issue affects fw_cfg DMA. Teach virtio-mmio transports to provide a machine-selected DMA address space, connect Arm virt Realm transports and fw_cfg to the RME address space, and force Realm virtio-mmio transports to the modern interface so they can negotiate VIRTIO_F_IOMMU_PLATFORM. This preserves the existing behavior for non-Realm machines while ensuring device DMA can reach only IPAs carrying the Realm shared bit. Signed-off-by: Ian May <[email protected]>
The generic Arm VM-state callback reads CNTVCT_EL0 when a VM is stopped and writes it back when the VM resumes. Realm register state is inaccessible after activation, and the target kernel rejects the SET_ONE_REG used on resume. As a result, QMP stop followed by cont aborts QEMU with a failed timer-register write. Expose the existing KVM protected-state flag and skip Arm virtual-time synchronization once guest state is protected. The RMM remains authoritative for Realm virtual time. Signed-off-by: Ian May <[email protected]>
AAVMF uses canonical lower-half DMA addresses for buffers that it has made shared with the RMM, while Linux DMA addresses include the Realm shared bit. Both forms must resolve to the host-visible RAM alias. Keep stripping the shared bit during translation, but grant access to both address forms. Retain the explicit rejection of guest IOMMUs, whose translations still cannot be composed with the Realm remapper. Signed-off-by: Ian May <[email protected]>
When a Realm VM does not expose PMU support, its maximum counter count is zero and num-pmu-counters=0 is a valid explicit configuration. There is no PMU device attribute in that case, and falling back to PMCR_EL0 SET_ONE_REG is rejected by the Realm ABI. Treat the already-satisfied zero-counter request as a no-op when the vCPU has no PMU. Signed-off-by: Ian May <[email protected]>
Import the kernel definitions required for Arm RME device assignment
(RME-DA):
- linux/tsm.h: TSM guest-request scopes, RHI device-assignment
status/state codes, and request payload structures.
- linux/arm-smccc.h: Standard Hypervisor RHI device-assignment SMCCC
function IDs and feature bits.
- linux/iommufd.h: VIOMMU/VDEVICE allocation and VDEVICE TSM
operations.
- linux/kvm.h: KVM_EXIT_ARM64_TIO and its kvm_run CCA payload.
- asm-arm64/kvm.h: the RMI_EXIT_VDEV_MAP TIO reason.
linux/arm-smccc.h is a locally modified copy of a non-UAPI kernel
header. linux/tsm.h is maintained by hand and mirrors
arch/arm64/include/uapi/asm/rmi-da.h. Mark both clearly because
scripts/update-linux-headers.sh does not refresh them, and add the
required SPDX identifier to linux/tsm.h.
Both files should eventually be replaced by proper kernel UAPI imports,
with QEMU-local SMCCC definitions moved outside linux-headers/.
Signed-off-by: Arto Merilainen <[email protected]>
(cherry picked from commit ee368a1)
[ianm: kept KVM_EXIT_ARM_SEA (=41), added KVM_EXIT_ARM64_TIO in the free
slot at 44, and retained both arm_sea and cca_exit union members]
Signed-off-by: Ian May <[email protected]>
A realm marks device MMIO ranges private when a device is bound to it
and shared again when the mapping is released. Honour those requests on
the KVM memory-attribute path:
- Allow converting ram_device (VFIO BAR) regions to shared rather than
silently ignoring the request, clearing the PRIVATE attribute so the
kernel tears down the stale ASSIGNED-DEV stage-2 mapping.
- Clear any VDEV-installed PRIVATE attributes when a device memory
slot
is removed, so a recycled gfn range does not inherit stale state.
Add kvm_set_memory_attributes_{private,shared}() stubs for the non-KVM
build.
Signed-off-by: Arto Merilainen <[email protected]>
(cherry picked from commit bee139e)
Signed-off-by: Ian May <[email protected]>
Add the IOMMUFD plumbing for assigning a VFIO-PCI device to an Arm CCA
Realm:
- Register the device with IOMMUFD VIOMMU/VDEVICE objects so the
kernel learns its guest-visible BDF. Gate this with an
iommufd-vdevice property and wait until the virtual BDF is stable.
- Build a stage-2 nesting-parent HWPT, VIOMMU, and stage-1 bypass HWPT
without changing the legacy single-HWPT path.
- Tear down the VDEVICE, VIOMMU, and nested HWPT in UAPI order.
- Implement bind, unbind, guest-request, measurement, TDI state, and
VDEV_MAP handling, including private attributes for assigned memory.
- Report registration failures through Error ** and unwind partially
allocated VDEVICE state.
This directly implements the VDEVICE interface and omits the superseded
VFIO_DEVICE_SET_DEV_INFO transition.
Signed-off-by: Arto Merilainen <[email protected]>
(cherry picked from commit 20de0d3)
[ianm: integrated the final IOMMUFD/VDEVICE implementation directly on
QEMU 11.0]
Signed-off-by: Ian May <[email protected]>
Forward the RHI device-assignment hypercalls, which live in the SMCCC Standard Hypervisor range, to userspace via a KVM SMCCC filter and dispatch them on KVM_EXIT_HYPERCALL to the IOMMUFD TSM helpers (features, object size/read, interface report, measurements, TDI state change). Handle KVM_EXIT_ARM64_TIO for the VDEV_MAP device-memory validation exit. The SMCCC filter is only installed for realms (it is inert for other guests and bails out if the kernel lacks filter support), and the GP-register sync needed to exchange SMCCC arguments and results is confined to the hypercall path rather than run on every exit. Guest buffers mapped for object reads and measurements are released after use. Signed-off-by: Arto Merilainen <[email protected]> (cherry picked from commit 8c02f54) Signed-off-by: Ian May <[email protected]>
Review of the RME-DA exit handling and Realm vCPU setup found several correctness and validation problems. Bound object reads to the mapped guest window, require complete Realm DMA mappings, and validate measurement structures before dereferencing them. Reject Routing IDs, object types, and TIO vDevice IDs that would be truncated from guest-provided 64-bit values. Keep SMCCC input and output registers in separate storage, initialize the result registers, and preserve KVM register-access failures. Return SMCCC_RET_NOT_SUPPORTED for unknown forwarded functions and make the TIO device-memory response polarity explicit. Do not reapply one-shot breakpoint, watchpoint, and PMU configuration after a vCPU has run. Record successful setup and report genuine first-time failures as configuration errors. Signed-off-by: Ian May <[email protected]>
Keep Realm vDevices out of ordinary reusable HWPTs and fully unwind the parent attachment, VIOMMU, and HWPT when nested-topology construction fails. Provide non-IOMMUFD stubs for the Arm KVM callers. Use uint32_t for the guest-visible Routing ID, consolidate bind and unbind handling, and fully initialize kernel request structures. Reject invalid response residues and empty or reversed device-memory ranges. Validate positive guest-request results even for request-only operations, where any unconsumed input is an error. Use trace events for guest-triggerable diagnostics so a guest cannot repeatedly fill the host log. Signed-off-by: Ian May <[email protected]>
CONFIG_VFIO_PCI can be enabled for targets that do not select CONFIG_IOMMUFD. Guard the RME registration calls and VM-state notifier lifecycle so all-target builds do not acquire an unresolved dependency on the IOMMUFD backend. The shared teardown path is also used by TYPE_VFIO_USER_PCI, which does not install the notifier. Check the pointer before removing it and clear it so realize failure and repeated teardown remain safe. Registration can run from PCI configuration-space accessors. Latch a failure so every later access does not retry and report the same error. Signed-off-by: Ian May <[email protected]>
Bound the value read from the kvm_cap_arm_rmi module parameter. A negative or garbage value would otherwise become an invalid KVM_CHECK_EXTENSION argument. Warn and fall back to the compile-time constant instead. Mark the sysfs probe as a downstream-only workaround that must be removed before this code is posted upstream. Signed-off-by: Ian May <[email protected]>
virt_kvm_type() gated reserved-GPA-bit handling on the numerical VM type. That works only because KVM_VM_TYPE_ARM_NORMAL happens to be zero. Test the machine's confidential-guest object instead, as the other Realm checks do. The dtb-randomness getter returned the effective value instead of the value stored by its setter, so the property did not round-trip on a confidential VM. Return the stored value and leave virt_dtb_randomness_enabled() to decide whether randomness is emitted. Signed-off-by: Ian May <[email protected]>
kvm_arch_handle_exit() runs with the BQL released, but the RHI and TIO handlers look up devices in vfio_device_list and keep using the returned pointer. VFIO device insertion, removal, and lifetime are protected by the BQL, so a concurrent hot-unplug could race these paths and leave a stale VFIODevice pointer. Hold the BQL across RHI and TIO dispatch, and assert the locking contract in vfio_find_bdf(). This also serializes device-assignment requests from multiple vCPUs with other device-model activity. Signed-off-by: Ian May <[email protected]>
An unrecognized KVM_EXIT_ARM64_TIO operation currently returns success without updating the response. If QEMU and KVM disagree about the TIO ABI, KVM can resume the Realm as though userspace handled an operation it never recognized. Fail closed with a diagnostic instead of re-entering the Realm with stale exit data. Signed-off-by: Ian May <[email protected]>
Boro watcher review skippedThe PR watcher skips automatic boro reviews for changes with more than 50 commits. This change currently has 54 commits. To run the review anyway, ask Head: This comment is maintained by BaseOS Reviewer. It is updated when the watcher sees a newer head. |
Collaborator
Author
|
Opened prematurely during branch preparation; closing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nvidia_unstable-11.0at29e60cad77(1:11.0.0+nvidia-unstable8-1)KVM_CAP_ARM_RMIdiscovery needed by production kernelsaddress_space_range_is_ram()prerequisite that was present on the former development base but absent from unstable8NVIDIA: SAUCE:and adding Ian May sign-offsValidation
scripts/checkpatch.plpass with no errors; remaining warnings are limited to imported Linux header and MAINTAINERS expectationsaarch64-softmmubuild7.0.0-3f8dc0153+, with runtimeKVM_CAP_ARM_RMI=248dpkg-buildpackage -b -uc -us -j64), including all system and user targetsRemaining hardware coverage
RME device-assignment runtime coverage is not included yet. The available Vera host has no device currently bound to
vfio-pciand no designated sacrificial BDF; detaching a production GPU, NVMe device, or NIC was intentionally avoided. The RME-DA code is covered by the real Arm KVM build and the full package build.