Message-ID: <20250212171411.951874-1-suzuki.poulose@arm.com>
Date: Wed, 12 Feb 2025 17:14:10 +0000
From: Suzuki K Poulose <suzuki.poulose@....com>
To: will@...nel.org,
	maz@...nel.org,
	catalin.marinas@....com
Cc: linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org,
	gregkh@...uxfoundation.org,
	aneesh.kumar@...nel.org,
	steven.price@....com,
	suzuki.poulose@....com,
	Jean-Philippe Brucker <jean-philippe@...aro.org>,
	Robin Murphy <robin.murphy@....com>,
	Christoph Hellwig <hch@....de>,
	Tom Lendacky <thomas.lendacky@....com>
Subject: [PATCH 0/1] arm64: realm: Fix DMA address for devices

Linux can be run as a Confidential Guest in Arm CCA from Linux v6.13. The address
space (GPA or IPA) of a Realm VM is split into two halves, with private bottom
half and shared top half. In Linux we treat the "top" bit of the IPA space as
an attribute, to indicate whether it is shared or not (MSB == 1 implies shared).
Stage2 (GPA to PA) translations used by the CPU accesses, cover the full IPA space,
and are managed by RMM. The "top" bit as attribute is only a software construct.

At present any device passed through to a Realm is treated as untrusted and the
Realm uses bounce buffering for any DMA, using the "decrypted" (shared) DMA
buffers (i.e., IPA with top bit set). In Linux, we only send the "DMA" address
masking the "top" bit. In Arm CCA, SMMU for untrusted devices are managed by the
non-secure Host and thus it can be confusing for the host/device when an unmasked
address is provided. Given there could be other hypervisors than Linux/KVM
running Arm CCA guests, the Realm Guest must adhere to a single convention for
the DMA address. This gets further complicated when we add support for trusted
devices, which can DMA into the full Realm memory space, once accepted. Thus,
a DMA masked address (with "top" bit lost) will prevent a trusted device from
accessing a shared buffer.

Thus Arm has decided to standardise the DMA address used by the Realm to include
the full IPA address bits (including the "top" bit, which Linux uses as as attribute).

This patch implements this in Linux by hooking into the phys_to_dma and vice versa
for providing the appropriate address. This also implies that the VMMs must
take care to :
 1. Create the S2-SMMU mappings for VFIO at the "unprotected" alias.
 2. Always mask the "top" bit off any IPA it receives from the Realm for DMA.

KVM is not affected. A kvmtool branch with the changes above is available here [1].
There are two patches [2] & [3], that are really required on top of the Arm CCA
support. 

Ideally it would be good to get this backported to stable kernel releases to make
sure that they are compliant.

[1] git@....gitlab.arm.com:linux-arm/kvmtool-cca.git cca/guest-dma-alias/v1
[2] https://gitlab.arm.com/linux-arm/kvmtool-cca/-/commit/ea37a6eb968abe4c75be4a8a90808714657c2ef7
[3] https://gitlab.arm.com/linux-arm/kvmtool-cca/-/commit/8afd0d5e6a7ee444dd0c1565fe94ecd831054a29

Cc: Will Deacon <will@...nel.org>
Cc: Jean-Philippe Brucker <jean-philippe@...aro.org>
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: Robin Murphy <robin.murphy@....com>
Cc: Steven Price <steven.price@....com>
Cc: Christoph Hellwig <hch@....de>
Cc: Tom Lendacky <thomas.lendacky@....com>

Suzuki K Poulose (1):
  arm64: realm: Use aliased addresses for device DMA to shared buffers

 arch/arm64/Kconfig                  |  1 +
 arch/arm64/include/asm/dma-direct.h | 38 +++++++++++++++++++++++++++++
 include/linux/dma-direct.h          | 35 +++++++++++++++++---------
 3 files changed, 62 insertions(+), 12 deletions(-)
 create mode 100644 arch/arm64/include/asm/dma-direct.h

-- 
2.43.0

Powered by blists - more mailing lists