From nobody Sat Oct 11 08:22:07 2025 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2376C29AAF0; Wed, 11 Jun 2025 10:50:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749639013; cv=none; b=SedaW83x6ZmPt5PgmFvxBaZcq8C9u5rLiMB0oexVGd4FLI0p904lFj2NyDEu4rlZye6AxesVt01Nl1S9RyBcBa/0gDw155O5iBIYk5lGK7QKFxZkBNkBIN4FNcwm69v0lvOTThh4htxBJyehYWFzmXBSXCW/SFzmLabt7gflTPU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749639013; c=relaxed/simple; bh=w0vsdi1/j/JnD+mUD7OwOSz9y4xgWvLXRh4zn+gpIhg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gL9v+TvKEHQs46WM1nllKp64IUNT0DaTa+k4rSOjXZwmBLFPGhmMe7fzecJiDs/FyIaRHpiVpT089tSAnPsLXRX3pKKrqY8ezloWobVodhLMaYwy+2k93uaFv/oGmHQZRmFPxFLWJNuO31YHnGQU2e43p8IZ6GZXm3bTImcVI+k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2BBD415A1; Wed, 11 Jun 2025 03:49:52 -0700 (PDT) Received: from e122027.arm.com (unknown [10.57.67.107]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 9049F3F673; Wed, 11 Jun 2025 03:50:08 -0700 (PDT) From: Steven Price To: kvm@vger.kernel.org, kvmarm@lists.linux.dev Cc: Steven Price , Catalin Marinas , Marc Zyngier , Will Deacon , James Morse , Oliver Upton , Suzuki K Poulose , Zenghui Yu , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Joey Gouly , Alexandru Elisei , Christoffer Dall , Fuad Tabba , linux-coco@lists.linux.dev, Ganapatrao Kulkarni , Gavin Shan , Shanker Donthineni , Alper Gun , "Aneesh Kumar K . V" , Emi Kisanuki Subject: [PATCH v9 19/43] arm64: RME: Allow populating initial contents Date: Wed, 11 Jun 2025 11:48:16 +0100 Message-ID: <20250611104844.245235-20-steven.price@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250611104844.245235-1-steven.price@arm.com> References: <20250611104844.245235-1-steven.price@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The VMM needs to populate the realm with some data before starting (e.g. a kernel and initrd). This is measured by the RMM and used as part of the attestation later on. Co-developed-by: Suzuki K Poulose Signed-off-by: Suzuki K Poulose Signed-off-by: Steven Price Reviewed-by: Gavin Shan --- Changes since v7: * Improve the error codes. * Other minor changes from review. Changes since v6: * Handle host potentially having a larger page size than the RMM granule. * Drop historic "par" (protected address range) from populate_par_region() - it doesn't exist within the current architecture. * Add a cond_resched() call in kvm_populate_realm(). Changes since v5: * Refactor to use PFNs rather than tracking struct page in realm_create_protected_data_page(). * Pull changes from a later patch (in the v5 series) for accessing pages from a guest memfd. * Do the populate in chunks to avoid holding locks for too long and triggering RCU stall warnings. --- arch/arm64/kvm/rme.c | 227 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 227 insertions(+) diff --git a/arch/arm64/kvm/rme.c b/arch/arm64/kvm/rme.c index 678b14ba2466..d7bb11583506 100644 --- a/arch/arm64/kvm/rme.c +++ b/arch/arm64/kvm/rme.c @@ -660,6 +660,221 @@ void kvm_realm_unmap_range(struct kvm *kvm, unsigned = long start, realm_unmap_private_range(kvm, start, end, may_block); } =20 +static int realm_create_protected_data_granule(struct realm *realm, + unsigned long ipa, + phys_addr_t dst_phys, + phys_addr_t src_phys, + unsigned long flags) +{ + phys_addr_t rd =3D virt_to_phys(realm->rd); + int ret; + + if (rmi_granule_delegate(dst_phys)) + return -ENXIO; + + ret =3D rmi_data_create(rd, dst_phys, ipa, src_phys, flags); + if (RMI_RETURN_STATUS(ret) =3D=3D RMI_ERROR_RTT) { + /* Create missing RTTs and retry */ + int level =3D RMI_RETURN_INDEX(ret); + + WARN_ON(level =3D=3D RMM_RTT_MAX_LEVEL); + + ret =3D realm_create_rtt_levels(realm, ipa, level, + RMM_RTT_MAX_LEVEL, NULL); + if (ret) + return -EIO; + + ret =3D rmi_data_create(rd, dst_phys, ipa, src_phys, flags); + } + if (ret) + return -EIO; + + return 0; +} + +static int realm_create_protected_data_page(struct realm *realm, + unsigned long ipa, + kvm_pfn_t dst_pfn, + kvm_pfn_t src_pfn, + unsigned long flags) +{ + unsigned long rd =3D virt_to_phys(realm->rd); + phys_addr_t dst_phys, src_phys; + bool undelegate_failed =3D false; + int ret, offset; + + dst_phys =3D __pfn_to_phys(dst_pfn); + src_phys =3D __pfn_to_phys(src_pfn); + + for (offset =3D 0; offset < PAGE_SIZE; offset +=3D RMM_PAGE_SIZE) { + ret =3D realm_create_protected_data_granule(realm, + ipa, + dst_phys, + src_phys, + flags); + if (ret) + goto err; + + ipa +=3D RMM_PAGE_SIZE; + dst_phys +=3D RMM_PAGE_SIZE; + src_phys +=3D RMM_PAGE_SIZE; + } + + return 0; + +err: + if (ret =3D=3D -EIO) { + /* current offset needs undelegating */ + if (WARN_ON(rmi_granule_undelegate(dst_phys))) + undelegate_failed =3D true; + } + while (offset > 0) { + ipa -=3D RMM_PAGE_SIZE; + offset -=3D RMM_PAGE_SIZE; + dst_phys -=3D RMM_PAGE_SIZE; + + rmi_data_destroy(rd, ipa, NULL, NULL); + + if (WARN_ON(rmi_granule_undelegate(dst_phys))) + undelegate_failed =3D true; + } + + if (undelegate_failed) { + /* + * A granule could not be undelegated, + * so the page has to be leaked + */ + get_page(pfn_to_page(dst_pfn)); + } + + return -ENXIO; +} + +static int populate_region(struct kvm *kvm, + phys_addr_t ipa_base, + phys_addr_t ipa_end, + unsigned long data_flags) +{ + struct realm *realm =3D &kvm->arch.realm; + struct kvm_memory_slot *memslot; + gfn_t base_gfn, end_gfn; + int idx; + phys_addr_t ipa =3D ipa_base; + int ret =3D 0; + + base_gfn =3D gpa_to_gfn(ipa_base); + end_gfn =3D gpa_to_gfn(ipa_end); + + idx =3D srcu_read_lock(&kvm->srcu); + memslot =3D gfn_to_memslot(kvm, base_gfn); + if (!memslot) { + ret =3D -EFAULT; + goto out; + } + + /* We require the region to be contained within a single memslot */ + if (memslot->base_gfn + memslot->npages < end_gfn) { + ret =3D -EINVAL; + goto out; + } + + if (!kvm_slot_can_be_private(memslot)) { + ret =3D -EPERM; + goto out; + } + + while (ipa < ipa_end) { + struct vm_area_struct *vma; + unsigned long hva; + struct page *page; + bool writeable; + kvm_pfn_t pfn; + kvm_pfn_t priv_pfn; + struct page *gmem_page; + + hva =3D gfn_to_hva_memslot(memslot, gpa_to_gfn(ipa)); + vma =3D vma_lookup(current->mm, hva); + if (!vma) { + ret =3D -EFAULT; + break; + } + + pfn =3D __kvm_faultin_pfn(memslot, gpa_to_gfn(ipa), FOLL_WRITE, + &writeable, &page); + + if (is_error_pfn(pfn)) { + ret =3D -EFAULT; + break; + } + + ret =3D kvm_gmem_get_pfn(kvm, memslot, + ipa >> PAGE_SHIFT, + &priv_pfn, &gmem_page, NULL); + if (ret) + break; + + ret =3D realm_create_protected_data_page(realm, ipa, + priv_pfn, + pfn, + data_flags); + + kvm_release_page_clean(page); + + if (ret) + break; + + ipa +=3D PAGE_SIZE; + } + +out: + srcu_read_unlock(&kvm->srcu, idx); + return ret; +} + +static int kvm_populate_realm(struct kvm *kvm, + struct arm_rme_populate_realm *args) +{ + phys_addr_t ipa_base, ipa_end; + unsigned long data_flags =3D 0; + + if (kvm_realm_state(kvm) !=3D REALM_STATE_NEW) + return -EPERM; + + if (!IS_ALIGNED(args->base, PAGE_SIZE) || + !IS_ALIGNED(args->size, PAGE_SIZE) || + (args->flags & ~RMI_MEASURE_CONTENT)) + return -EINVAL; + + ipa_base =3D args->base; + ipa_end =3D ipa_base + args->size; + + if (ipa_end < ipa_base) + return -EINVAL; + + if (args->flags & RMI_MEASURE_CONTENT) + data_flags |=3D RMI_MEASURE_CONTENT; + + /* + * Perform the population in parts to ensure locks are not held for too + * long + */ + while (ipa_base < ipa_end) { + phys_addr_t end =3D min(ipa_end, ipa_base + SZ_2M); + + int ret =3D populate_region(kvm, ipa_base, end, + args->flags); + + if (ret) + return ret; + + ipa_base =3D end; + + cond_resched(); + } + + return 0; +} + enum ripas_action { RIPAS_INIT, RIPAS_SET, @@ -903,6 +1118,18 @@ int kvm_realm_enable_cap(struct kvm *kvm, struct kvm_= enable_cap *cap) r =3D kvm_init_ipa_range_realm(kvm, &args); break; } + case KVM_CAP_ARM_RME_POPULATE_REALM: { + struct arm_rme_populate_realm args; + void __user *argp =3D u64_to_user_ptr(cap->args[1]); + + if (copy_from_user(&args, argp, sizeof(args))) { + r =3D -EFAULT; + break; + } + + r =3D kvm_populate_realm(kvm, &args); + break; + } default: r =3D -EINVAL; break; --=20 2.43.0