tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: drivers/vfio: Add VFIO_PKVM_IOMMU

Browse Source 
pKVM provides mutual distrust between host kernel and protected VMs(pVM)
One solution to provide DMA isolation in this model, is to move the IOMMU
control to the hypervisor and para-virtualize the IOMMU interface for
the host and guest kernel. (none of them have direct access to IOMMU
programming interface).
In the case of device assignement, the host can't map memory in for the
guest kernel (as it is not trusted).
So, what mainly needs to be done is to assign a blocking domain, when
VFIO assigns the device to user space, so it can't issue any DMA, and
when the guest take control it can program the IOMMU through hypervisor
with collapsed translation (IOVA->PA directly).

Bug: 357781595
Bug: 348382247
Change-Id: Ie424c54d32f43016465de71f24129fea2fe47e59
Signed-off-by: Mostafa Saleh <smostafa@google.com>
This commit is contained in:
Mostafa Saleh
2023-11-13 11:11:58 +00:00
committed by Treehugger Robot
parent 007871cbf7
commit 0ef77a1bee
6 changed files with 136 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/vfio/platform/vfio_platform_common.c
+8
View File
@@ -450,6 +450,10 @@ ssize_t vfio_platform_read(struct vfio_device *core_vdev,
unsigned int index = VFIO_PLATFORM_OFFSET_TO_INDEX(*ppos);
loff_t off = *ppos & VFIO_PLATFORM_OFFSET_MASK;
/* Only readable through mmap*/
if (core_vdev->protected)
return -EINVAL;
if (index >= vdev->num_regions)
return -EINVAL;
@@ -533,6 +537,10 @@ ssize_t vfio_platform_write(struct vfio_device *core_vdev, const char __user *bu
unsigned int index = VFIO_PLATFORM_OFFSET_TO_INDEX(*ppos);
loff_t off = *ppos & VFIO_PLATFORM_OFFSET_MASK;
/* Only writable through mmap*/
if (core_vdev->protected)
return -EINVAL;
if (index >= vdev->num_regions)
return -EINVAL;