Message-ID: <190e49bb-88d2-49fe-a228-c379c33503c1@infradead.org>
Date: Tue, 30 Jul 2024 07:13:54 -0700
From: Randy Dunlap <rdunlap@...radead.org>
To: Liju-clr Chen <liju-clr.chen@...iatek.com>, Rob Herring
 <robh@...nel.org>, Krzysztof Kozlowski <krzk+dt@...nel.org>,
 Conor Dooley <conor+dt@...nel.org>, Jonathan Corbet <corbet@....net>,
 Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>,
 Steven Rostedt <rostedt@...dmis.org>, Masami Hiramatsu
 <mhiramat@...nel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Richard Cochran <richardcochran@...il.com>,
 Matthias Brugger <matthias.bgg@...il.com>,
 AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
 Yingshiuan Pan <Yingshiuan.Pan@...iatek.com>,
 Ze-yu Wang <Ze-yu.Wang@...iatek.com>
Cc: devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-doc@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
 linux-trace-kernel@...r.kernel.org, netdev@...r.kernel.org,
 linux-mediatek@...ts.infradead.org, Shawn Hsiao <shawn.hsiao@...iatek.com>,
 PeiLun Suei <PeiLun.Suei@...iatek.com>,
 Chi-shen Yeh <Chi-shen.Yeh@...iatek.com>,
 Kevenny Hsieh <Kevenny.Hsieh@...iatek.com>
Subject: Re: [PATCH v12 02/24] docs: geniezone: Introduce GenieZone hypervisor

Hi--

On 7/30/24 1:24 AM, Liju-clr Chen wrote:
> From: Yingshiuan Pan <yingshiuan.pan@...iatek.com>
> 
> GenieZone is MediaTek proprietary hypervisor solution, and it is running
> in EL2 stand alone as a type-I hypervisor. It is a pure EL2
> implementation which implies it does not rely any specific host VM, and
> this behavior improves GenieZone's security as it limits its interface.
> 
> Signed-off-by: Yingshiuan Pan <yingshiuan.pan@...iatek.com>
> Co-developed-by: Yi-De Wu <yi-de.wu@...iatek.com>
> Signed-off-by: Yi-De Wu <yi-de.wu@...iatek.com>
> Signed-off-by: Liju Chen <liju-clr.chen@...iatek.com>
> ---
>  Documentation/virt/geniezone/introduction.rst | 87 +++++++++++++++++++
>  Documentation/virt/index.rst                  |  1 +
>  MAINTAINERS                                   |  6 ++
>  3 files changed, 94 insertions(+)
>  create mode 100644 Documentation/virt/geniezone/introduction.rst
> 
> diff --git a/Documentation/virt/geniezone/introduction.rst b/Documentation/virt/geniezone/introduction.rst
> new file mode 100644
> index 000000000000..f280476228b3
> --- /dev/null
> +++ b/Documentation/virt/geniezone/introduction.rst
> @@ -0,0 +1,87 @@
> +.. SPDX-License-Identifier: GPL-2.0
> +
> +======================
> +GenieZone Introduction
> +======================
> +
> +Overview
> +========
> +GenieZone hypervisor (gzvm) is a type-1 hypervisor that supports various virtual
> +machine types and provides security features such as TEE-like scenarios and
> +secure boot. It can create guest VMs for security use cases and has
> +virtualization capabilities for both platform and interrupt. Although the
> +hypervisor can be booted independently, it requires the assistance of GenieZone
> +hypervisor kernel driver(also named gzvm) to leverage the ability of Linux

                     driver (also

> +kernel for vCPU scheduling, memory management, inter-VM communication and virtio
> +backend support.
> +
> +Supported Architecture
> +======================
> +GenieZone now only supports MediaTek ARM64 SoC.
> +
> +Features
> +========
> +
> +- vCPU Management
> +
> +  VM manager aims to provide vCPUs on the basis of time sharing on physical
> +  CPUs. It requires Linux kernel in host VM for vCPU scheduling and VM power
> +  management.
> +
> +- Memory Management
> +
> +  Direct use of physical memory from VMs is forbidden and designed to be
> +  dictated to the privilege models managed by GenieZone hypervisor for security
> +  reason. With the help of gzvm module, the hypervisor would be able to manipulate

Is this change acceptable?:

             With the help of the gzvm module, the hypervisor is able to manipulate

> +  memory as objects.
> +
> +- Virtual Platform
> +
> +  We manage to emulate a virtual mobile platform for guest OS running on guest

     s/We manage to emulate/The gzvm hypervisor emulates/

or something like that...

> +  VM. The platform supports various architecture-defined devices, such as
> +  virtual arch timer, GIC, MMIO, PSCI, and exception watching...etc.
> +
> +- Inter-VM Communication
> +
> +  Communication among guest VMs was provided mainly on RPC. More communication

                                   is provided

> +  mechanisms were to be provided in the future based on VirtIO-vsock.

                are to be provided
or
                will be provided

> +
> +- Device Virtualization
> +
> +  The solution is provided using the well-known VirtIO. The gzvm module would

                                                           The gzvm module

> +  redirect MMIO traps back to VMM where the virtual devices are mostly emulated.

     redirects

> +  Ioeventfd is implemented using eventfd for signaling host VM that some IO
> +  events in guest VMs need to be processed.
> +
> +- Interrupt virtualization
> +
> +  All Interrupts during some guest VMs running would be handled by GenieZone

         interrupts                               are handled

> +  hypervisor with the help of gzvm module, both virtual and physical ones.
> +  In case there's no guest VM running out there, physical interrupts would be

                     no guest VM running, physical interrupts are

> +  handled by host VM directly for performance reason. Irqfd is also implemented
> +  using eventfd for accepting vIRQ requests in gzvm module.
> +
> +Platform architecture component
> +===============================
> +
> +- vm
> +
> +  The vm component is responsible for setting up the capability and memory
> +  management for the protected VMs. The capability is mainly about the lifecycle
> +  control and boot context initialization. And the memory management is highly
> +  integrated with ARM 2-stage translation tables to convert VA to IPA to PA
> +  under proper security measures required by protected VMs.
> +
> +- vcpu
> +
> +  The vcpu component is the core of virtualizing aarch64 physical CPU runnable,

The ending "runnable" doesn't seem to fit here - or I just can't parse that.

> +  and it controls the vCPU lifecycle including creating, running and destroying.
> +  With self-defined exit handler, the vm component would be able to act

                                     the vm component is able to act

> +  accordingly before terminated.

                 before termination.
or
                 before being terminated.
or
                 before exit.

> +
> +- vgic
> +
> +  The vgic component exposes control interfaces to Linux kernel via irqchip, and
> +  we intend to support all SPI, PPI, and SGI. When it comes to virtual
> +  interrupts, the GenieZone hypervisor would write to list registers and trigger

                               hypervisor writes to list registers and triggers

> +  vIRQ injection in guest VMs via GIC.


HTH.
-- 
~Randy

Powered by blists - more mailing lists