| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250611104844.245235-1-steven.price@arm.com>
Date: Wed, 11 Jun 2025 11:47:57 +0100
From: Steven Price <steven.price@....com>
To: kvm@...r.kernel.org,
kvmarm@...ts.linux.dev
Cc: Steven Price <steven.price@....com>,
Catalin Marinas <catalin.marinas@....com>,
Marc Zyngier <maz@...nel.org>,
Will Deacon <will@...nel.org>,
James Morse <james.morse@....com>,
Oliver Upton <oliver.upton@...ux.dev>,
Suzuki K Poulose <suzuki.poulose@....com>,
Zenghui Yu <yuzenghui@...wei.com>,
linux-arm-kernel@...ts.infradead.org,
linux-kernel@...r.kernel.org,
Joey Gouly <joey.gouly@....com>,
Alexandru Elisei <alexandru.elisei@....com>,
Christoffer Dall <christoffer.dall@....com>,
Fuad Tabba <tabba@...gle.com>,
linux-coco@...ts.linux.dev,
Ganapatrao Kulkarni <gankulkarni@...amperecomputing.com>,
Gavin Shan <gshan@...hat.com>,
Shanker Donthineni <sdonthineni@...dia.com>,
Alper Gun <alpergun@...gle.com>,
"Aneesh Kumar K . V" <aneesh.kumar@...nel.org>,
Emi Kisanuki <fj0570is@...itsu.com>
Subject: [PATCH v9 00/43] arm64: Support for Arm CCA in KVM
This series adds support for running protected VMs using KVM under the
Arm Confidential Compute Architecture (CCA).
The related guest support was merged for v6.14-rc1 so you no longer need
that separately.
There are a few changes since v8, many thanks for the review
comments. The highlights are below, and individual patches have a changelog.
* NV support is now upstream, so this series no longer conflicts.
* Tidied up RTT accounting by providing wrapper functions to call
kvm_account_pgtable_pages() only when appropriate.
* Propagate the 'may_block' flag to enable cond_resched calls only when
appropriate.
* Reduce code duplication between INIT_RIPAS and SET_RIPAS.
* Various code improvements from the reviews - many thanks!
* Rebased onto v6.16-rc1.
Things to note:
* The magic numbers for capabilities and ioctls have been updated. So
you'll need to update your VMM. See below for update kvmtool branch.
* Patch 42 increases KVM_VCPU_MAX_FEATURES to expose the new feature.
The ABI to the RMM (the RMI) is based on RMM v1.0-rel0 specification[1].
This series is based on v6.16-rc1. It is also available as a git
repository:
https://gitlab.arm.com/linux-arm/linux-cca cca-host/v9
Work in progress changes for kvmtool are available from the git
repository below:
https://gitlab.arm.com/linux-arm/kvmtool-cca cca/v7
[1] https://developer.arm.com/documentation/den0137/1-0rel0/
Jean-Philippe Brucker (7):
arm64: RME: Propagate number of breakpoints and watchpoints to
userspace
arm64: RME: Set breakpoint parameters through SET_ONE_REG
arm64: RME: Initialize PMCR.N with number counter supported by RMM
arm64: RME: Propagate max SVE vector length from RMM
arm64: RME: Configure max SVE vector length for a Realm
arm64: RME: Provide register list for unfinalized RME RECs
arm64: RME: Provide accurate register list
Joey Gouly (2):
arm64: RME: allow userspace to inject aborts
arm64: RME: support RSI_HOST_CALL
Steven Price (31):
arm64: RME: Handle Granule Protection Faults (GPFs)
arm64: RME: Add SMC definitions for calling the RMM
arm64: RME: Add wrappers for RMI calls
arm64: RME: Check for RME support at KVM init
arm64: RME: Define the user ABI
arm64: RME: ioctls to create and configure realms
KVM: arm64: Allow passing machine type in KVM creation
arm64: RME: RTT tear down
arm64: RME: Allocate/free RECs to match vCPUs
KVM: arm64: vgic: Provide helper for number of list registers
arm64: RME: Support for the VGIC in realms
KVM: arm64: Support timers in realm RECs
arm64: RME: Allow VMM to set RIPAS
arm64: RME: Handle realm enter/exit
arm64: RME: Handle RMI_EXIT_RIPAS_CHANGE
KVM: arm64: Handle realm MMIO emulation
arm64: RME: Allow populating initial contents
arm64: RME: Runtime faulting of memory
KVM: arm64: Handle realm VCPU load
KVM: arm64: Validate register access for a Realm VM
KVM: arm64: Handle Realm PSCI requests
KVM: arm64: WARN on injected undef exceptions
arm64: Don't expose stolen time for realm guests
arm64: RME: Always use 4k pages for realms
arm64: RME: Prevent Device mappings for Realms
arm_pmu: Provide a mechanism for disabling the physical IRQ
arm64: RME: Enable PMU support with a realm guest
arm64: RME: Hide KVM_CAP_READONLY_MEM for realm guests
KVM: arm64: Expose support for private memory
KVM: arm64: Expose KVM_ARM_VCPU_REC to user space
KVM: arm64: Allow activating realms
Suzuki K Poulose (3):
kvm: arm64: Include kvm_emulate.h in kvm/arm_psci.h
kvm: arm64: Don't expose debug capabilities for realm guests
arm64: RME: Allow checking SVE on VM instance
Documentation/virt/kvm/api.rst | 94 +-
arch/arm64/include/asm/kvm_emulate.h | 40 +
arch/arm64/include/asm/kvm_host.h | 17 +-
arch/arm64/include/asm/kvm_rme.h | 139 ++
arch/arm64/include/asm/rmi_cmds.h | 508 ++++++++
arch/arm64/include/asm/rmi_smc.h | 268 ++++
arch/arm64/include/asm/virt.h | 1 +
arch/arm64/include/uapi/asm/kvm.h | 49 +
arch/arm64/kvm/Kconfig | 1 +
arch/arm64/kvm/Makefile | 3 +-
arch/arm64/kvm/arch_timer.c | 48 +-
arch/arm64/kvm/arm.c | 168 ++-
arch/arm64/kvm/guest.c | 108 +-
arch/arm64/kvm/hypercalls.c | 4 +-
arch/arm64/kvm/inject_fault.c | 5 +-
arch/arm64/kvm/mmio.c | 16 +-
arch/arm64/kvm/mmu.c | 207 ++-
arch/arm64/kvm/pmu-emul.c | 6 +
arch/arm64/kvm/psci.c | 30 +
arch/arm64/kvm/reset.c | 23 +-
arch/arm64/kvm/rme-exit.c | 207 +++
arch/arm64/kvm/rme.c | 1743 ++++++++++++++++++++++++++
arch/arm64/kvm/sys_regs.c | 53 +-
arch/arm64/kvm/vgic/vgic-init.c | 2 +-
arch/arm64/kvm/vgic/vgic-v3.c | 6 +-
arch/arm64/kvm/vgic/vgic.c | 60 +-
arch/arm64/mm/fault.c | 31 +-
drivers/perf/arm_pmu.c | 15 +
include/kvm/arm_arch_timer.h | 2 +
include/kvm/arm_pmu.h | 4 +
include/kvm/arm_psci.h | 2 +
include/linux/perf/arm_pmu.h | 5 +
include/uapi/linux/kvm.h | 29 +-
33 files changed, 3790 insertions(+), 104 deletions(-)
create mode 100644 arch/arm64/include/asm/kvm_rme.h
create mode 100644 arch/arm64/include/asm/rmi_cmds.h
create mode 100644 arch/arm64/include/asm/rmi_smc.h
create mode 100644 arch/arm64/kvm/rme-exit.c
create mode 100644 arch/arm64/kvm/rme.c
--
2.43.0
Powered by blists - more mailing lists