| Message ID | 20230127150727.612594-17-jean-philippe@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | arm: Run Arm CCA VMs with KVM | expand |
On 1/27/23 05:07, Jean-Philippe Brucker wrote: > KVM does not support creating read-only mappings for realms at the > moment. Add an arch helper to detect whether read-only mappings are > supported. > > Device ROM and flash normally use read-only mappings. Device ROM seems > limited to legacy use and does not need to be trusted by the guest, so > trapping reads should be fine. Flash on the other hand, is used for the > firmware and needs to be both executable and measured. It may be > necessary to replace flash with RAM in order to run firmwares like edk2 > in realms. > > Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> > --- > include/sysemu/kvm.h | 2 ++ > accel/kvm/kvm-all.c | 8 +++++++- > target/arm/kvm-rme.c | 9 +++++++++ > 3 files changed, 18 insertions(+), 1 deletion(-) > > diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h > index e9a97eda8c..8d467c76c6 100644 > --- a/include/sysemu/kvm.h > +++ b/include/sysemu/kvm.h > @@ -581,5 +581,7 @@ bool kvm_arch_cpu_check_are_resettable(void); > > bool kvm_dirty_ring_enabled(void); > > +bool kvm_arch_readonly_mem_allowed(KVMState *s); > + > uint32_t kvm_dirty_ring_size(void); > #endif > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c > index f99b0becd8..56cdd2e9e9 100644 > --- a/accel/kvm/kvm-all.c > +++ b/accel/kvm/kvm-all.c > @@ -2267,6 +2267,11 @@ bool kvm_dirty_ring_enabled(void) > return kvm_state->kvm_dirty_ring_size ? true : false; > } > > +bool __attribute__((weak)) kvm_arch_readonly_mem_allowed(KVMState *s) > +{ > + return true; > +} Not a fan of the weak. Just populate this like kvm_arch_cpu_check_are_resettable. r~
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h index e9a97eda8c..8d467c76c6 100644 --- a/include/sysemu/kvm.h +++ b/include/sysemu/kvm.h @@ -581,5 +581,7 @@ bool kvm_arch_cpu_check_are_resettable(void); bool kvm_dirty_ring_enabled(void); +bool kvm_arch_readonly_mem_allowed(KVMState *s); + uint32_t kvm_dirty_ring_size(void); #endif diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index f99b0becd8..56cdd2e9e9 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -2267,6 +2267,11 @@ bool kvm_dirty_ring_enabled(void) return kvm_state->kvm_dirty_ring_size ? true : false; } +bool __attribute__((weak)) kvm_arch_readonly_mem_allowed(KVMState *s) +{ + return true; +} + static void query_stats_cb(StatsResultList **result, StatsTarget target, strList *names, strList *targets, Error **errp); static void query_stats_schemas_cb(StatsSchemaList **result, Error **errp); @@ -2520,7 +2525,8 @@ static int kvm_init(MachineState *ms) } kvm_readonly_mem_allowed = - (kvm_check_extension(s, KVM_CAP_READONLY_MEM) > 0); + (kvm_check_extension(s, KVM_CAP_READONLY_MEM) > 0) && + kvm_arch_readonly_mem_allowed(s); kvm_eventfds_allowed = (kvm_check_extension(s, KVM_CAP_IOEVENTFD) > 0); diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c index 1baed79d46..2812a52aeb 100644 --- a/target/arm/kvm-rme.c +++ b/target/arm/kvm-rme.c @@ -62,6 +62,15 @@ bool kvm_arm_rme_enabled(void) return !!cgs_to_rme(cgs); } +/* + * KVM does not support creating read-only stage-2 mappings for realms at the + * moment + */ +bool kvm_arch_readonly_mem_allowed(KVMState *s) +{ + return !kvm_arm_rme_enabled(); +} + static int rme_create_rd(RmeGuest *guest, Error **errp) { int ret = kvm_vm_enable_cap(kvm_state, KVM_CAP_ARM_RME, 0,
KVM does not support creating read-only mappings for realms at the moment. Add an arch helper to detect whether read-only mappings are supported. Device ROM and flash normally use read-only mappings. Device ROM seems limited to legacy use and does not need to be trusted by the guest, so trapping reads should be fine. Flash on the other hand, is used for the firmware and needs to be both executable and measured. It may be necessary to replace flash with RAM in order to run firmwares like edk2 in realms. Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> --- include/sysemu/kvm.h | 2 ++ accel/kvm/kvm-all.c | 8 +++++++- target/arm/kvm-rme.c | 9 +++++++++ 3 files changed, 18 insertions(+), 1 deletion(-)