Currently, gunyah_cma_release() unconditionally releases the entire
CMA memory region of the VM, regardless of how much was actually mapped.
This can lead to issues if AVF clients lauches VM wherein the memory
mapped is less than the size of the VM's CMA region(max size).
To address this:
- A new mapped_size field is added to struct gunyah_cma to track the
actual size mapped.
- gunyah_cma_alloc() sets this field and logs a debug message if the
mapped size is less than the max size.
- gunyah_cma_release() now uses mapped_size to determine how much memory
to release.
Bug: 440480668
Change-Id: I6408c91eedb4cfe911a52c8a8a8734892e49e209
Signed-off-by: Nikhil V <nikhil.v@oss.qualcomm.com>
Check if the file pointer of the guest_mem_fd is valid or not.
Otherwise, there can be a NULL pointer dereference.
Bug: 436896297
Change-Id: Ib2590ba6326cb3b263bc92211b677f4306708d45
Signed-off-by: Prakruthi Deepak Heragu <prakruthi.heragu@oss.qualcomm.com>
The gunyah_vm_clean_resources() function was freeing resources without
removing them from the ghvm->resources list, leaving dangling pointers
that could lead to use-after-free.
Fix this by removing each resource from the list before freeing it to
ensure lists are empty after cleanup.
Bug: 436769530
Change-Id: I16bb2a73dae66cdef9e62f65b93d1487e32a92ce
Signed-off-by: Mukesh Pilaniya <quic_mpilaniy@quicinc.com>
One process boots up SVM, the CMA memory is allocated and used by SVM.
If another process try to boot up VM again, will allocate fail and
release this CMA memory region. It will cause kernel panic when one
process allocates memory from this CMA memory region due to not do
relciam parcel for this memory. Fix this issue by return a error in
gunyah_cma_create_mem_fd to avoid gunyah_cma_release is called when
the CMA memory region is already allocated by other process.
Bug: 432359620
Change-Id: Iee2d20d455e80d992db45c875488fd9cb631f8fd
Signed-off-by: Peng Yang <quic_penyan@quicinc.com>
Add new VM status GUNYAH_RM_VM_STATUS_RESET_FAILED to indicate that VM
reset is failed.
Bug: 430214928
Change-Id: If9664bf64a6a14c577fb2b29e1ad0775c0e9d140
Signed-off-by: Cong Zhang <quic_congzhan@quicinc.com>
Replace arm_smccc_1_1_smc with arm_smccc_1_1_invoke because
arm_smccc_1_1_invoke() determines the conduit (hvc/smc/none) before
making an SMC, which may not be supported on some virtual platforms.
Bug: 428106948
Change-Id: Ib21c7790b03996e73caa0874dc826d78e7b1c3d8
Signed-off-by: Mukesh Pilaniya <quic_mpilaniy@quicinc.com>
When function gunyah_qtvm_attach call successfully,
it should return value 0 and not -EINVAL.
Bug: 421780599
Change-Id: I549f38a6e7e0d0fd814e475f157d63332031cc94
Signed-off-by: Peng Yang <quic_penyan@quicinc.com>
If call gunyah_vm_pre_vm_configure or gunyah_share_parcel fail
in gunyah_vm_start, and will kfree struct ghvm in _gunyah_vm_put.
But this doesn't remove the ghvm->nb in rm notifier chain before
free ghvm. If call gunyah_rm_notifier_register, will traversing
rm notifier chain and access the memory of ghvm->nb which has
been freed. So call gunyah_rm_notifier_unregister when do error
handle to fix this issue.
Bug: 417898849
Change-Id: Ica8e5f019b42c6cf8b9b50aba04db3050dd3b5aa
Signed-off-by: Peng Yang <quic_penyan@quicinc.com>
PSCI_SYSTEM_RESET is a valid return value of the vcpu_run
hypercall. As kernel doesn't have any special handling of this
case, treat it as a generic SYSTEM_OFF and let the VMM take the
appropriate action as the vcpu_run structure will have the
necessary details for this exit.
Bug: 409998900
Change-Id: I0275e887f869964cb2a27e74f2f55b8ec3febf3c
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Provide vendor hooks for VM and VCPU ioctl release for vendor usage.
Bug: 413283378
Change-Id: I6320313687a20b7f619d27d5f0723225da302672
Signed-off-by: Cong Zhang <quic_congzhan@quicinc.com>
Move gunyah_vcpu define to header file so that other modules can access
this struct.
Bug: 413283378
Change-Id: I6401143d18216895668739bd5bea931f2d86e84e
Signed-off-by: Cong Zhang <quic_congzhan@quicinc.com>
Operate on the device-tree config only if a device-tree has been
provided by the VMM. The offsets won't make sense to RM otherwise.
Bug: 410870784
Change-Id: Ia2ccd3ebe8cce5400a5ff0f023f3262a340fab08
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
QTVMs' Gunyah resources are handled partially by the VMM. The remaining
resources are handled by the kernel clients. By providing this notifier,
we allow the client drivers to add their operations for setting up the
resources they own.
Bug: 399219478
Change-Id: I2a5377358aa669dcebd6307ba5bc78ac117886f0
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Qualcomm Trusted Virtual Machine (QTVM) are VMs that are authenticated by
Qualcomm firmware before the VM starts. The firmware also defines the
VM's image layout. Additionally, each QTVM comes with a reserved VM ID.
Introduce an IOCTL to allow VMMs to configure a QTVM and this driver will
handle the setup for QTVMs.
Bug: 399219478
Change-Id: Ia3fe74a46c0e53134b9b4b10fa59bcaa8f376c87
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
As QTVMs use Gunyah emulated watchdog instead of vcpu_stall detector,
provide trace_hooks to manage the watchdog of the QTVM.
Bug: 399219478
Change-Id: I6ec8a0236835dcc20c66681a747eae09c0c1a32d
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
RM supports authentication of VMs with the assistance of the firmware.
Add an API for auth_mgr to use if the VM it manages uses the firmare for
authentication.
Bug: 399219478
Change-Id: Ib550c642146586434d8328bb53de08690e2527ad
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Add an IOCTL to choose the authentication mechanism for a Virtual Machine.
vm_mgr can setup differently authenticated VMs based on the ops setup by
the auth_mgr chosen by the VMM.
Bug: 399219478
Change-Id: Ibb6bb30e3f422e606500c04714cda27b2276baf6
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Gunyah supports Virtual Machines (VMs) with various authentication
mechanisms. Since different authentication mechanisms require distinct
operations to be performed to set up a VM, it is necessary to add ops
that can support these mechanisms.
Bug: 399219478
Change-Id: Ia0a6d9b71edfc59a059ddd94919a9f5b7f137855
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Allow VMMs to add a binding backed by CMA. Extend the generic Gunyah
mem APIs to handle bindings backed by CMA.
Bug: 399219478
Change-Id: I1f71641420c8c30f4dfad021d92f70ef6ffdfb29
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Make the bindings generic so that the APIs can now handle the binding's
memory backed either by CMA memory or GUP.
Bug: 399219478
Change-Id: I889fe1fbe5664c7c40938db78f350d62bfe33431
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
To reduce the number of mem entries to be tracked by the firmware, try
and coalesce the folios when they are adjacent.
Bug: 399219478
Change-Id: Iff8ab581264b0041587953b025fbbf2f90085b6c
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
This is a CMA allocator for VMs which need their memory to be backed by
contiguous memory. The driver creates /dev/<qtvm_name_cma> to represent
the qtvm's DMA pool. Once opened, VMM can make an IOCTL CREATE_CMA_MEM to
obtain an fd to the file created which represents the VM's memory backed
by the specific DMA pool.
Bug: 399219478
Change-Id: I63f092ed15ef209a8723de8c2b51df19115d1ecb
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Introduce an ioctl, GH_VM_RECLAIM_REGION which attempts to reclaim guest
memory. If the guest hasn't relinquished the memory, an error is
returned.
Bug: 395833312
Change-Id: I005c947435f0256f6200c0d7d86eea145e1daa0a
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Gunyah (the hypervisor) currently requires a guest to use devicetree to
provide capability IDs and interrupts to communincation with the
resource manager. A new mechanism, address space info area, is
introduced to discover the same information without using devicetree.
Now that we have no devicetree, we don't have a platform device, so the
RM "driver" is converted to a pure kernel module.
Backwards compatability with older Gunyah without the address space info
area is maintained by probing the devicetree directly without using the
platform device.
Bug: 395833312
Change-Id: I6ebfa23dc7ff2fa734327ee3d02002536be3e4ae
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Now that Gunyah modules can be probed without devicetree, there is no
reason to bind/populate the gunyah-hypervisor node, even if it exists.
Convert the probe function, which checked if we were running under
Gunyah and tested for the info_area, into a regular initcall.
core_initcall() used because Gunyah-aware protected guest needs to
initialize early for virtio-balloon/free page reporting.
Bug: 395833312
Change-Id: I7e2787d814c45d44d8868e249a512c66f90a725c
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
In preparation for Gunyah-aware protected guests, make the core gunyah
driver which probes the info_area page compile separately.
Bug: 395833312
Change-Id: Ibea70a89dfa66fbc08491acb1a78fa6e57d6943a
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
The Gunyah info_area page contains a series of descriptors of
"information". Probe the info_area page during probe and expose a
function to fetch information by its identifier.
Bug: 395833312
Change-Id: I380fa59259f487f1ca9b48c12eb07957603ea099
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Gunyah-aware confidential compute guest virtual machines don't need the
code to launch virtual machines, but still need to make hypercalls.
Split the gunyah_hypercall module into a separate Kconfig symbol which
can be selected by the guest module.
Bug: 395833312
Change-Id: Ic2ec7248bd7a85d09a4769b8d74090426b2f56b7
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
When reclaiming multiple folios, Gunyah allows the host to skip sync
operation to speed up the reclaim. The sync can occur on the last folio
to be reclaimed. The logic was flipped, correct it.
Fixes: 162a44744e7e ("FROMLIST: virt: gunyah: Add interfaces to map memory into guest address space")
Change-Id: I7848754bba92cf6e9ed6525141955a9626b20228
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Values from (LONG_MAX, ULONG_MAX] aren't supported values by xarray.
Allocate a container to store the value instead and insert the container
to the xarray.
Change-Id: Iaf6a50cc4d56ab2108e3e21f2dfc493cd518cb22
Bug: 373872273
Fixes: ed8ebd8c80c5 ("FROMLIST: virt: gunyah: Allow userspace to initialize context of primary vCPU")
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
gunyah_gup_share_parcel() has an in/out parameter which indicates the
number of pages requested to be shared in the mem parcel. We were not
returning the number of pages actually shared in the mem parcel and this
caused THPs to be undercounted. Later, when converting the parcel to
demand paged (gunyah_vm_parcel_to_paged), we hit the BUG_ON on line 55
due to the undercount. Fix the BUG_ON by correctly counting the *nr
return value.
Fixes: due to the undercount. Fix the BUG_ON by correctly counting the
*nr return value due to the undercount. Fix the BUG_ON by correctly
counting the *nr return value.
Fixes: 296cceed0844 ("ANDROID: virt: gunyah: Add gup based demand paging support")
Change-Id: I6492b02d075d903ab68d6c89c4bb1cd78af25c28
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
gunyah_gup_reclaim_parcel incorrectly used folio_put() to drop the
refcount for the pinned page. This leaves the folio pincount elevated.
If the VM initialization fails in Gunyah and Linux needs to reclaim the
mem parcel, mm will complain that the pincount was higher than refcount.
This reclaim path is not normally used, as memory backed by parcels is
reclaimed in the demand paging path if the VM starts successfully.
Bug: 358605784
Fixes: 296cceed0844 ("ANDROID: virt: gunyah: Add gup based demand paging support")
Change-Id: I88454e1f0527632f1f78345e3833d16cbc098467
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
gunyah_gup_share_parcel incorrectly calculates n_mem_entries and places
items into the mem_entries array. To save number of bytes sent to RM, we
describe only folios -- not individual pages. We incorrectly filled the
mem_entries array with some entries as 0's. Track insertion into the
mem_entries array with new indexer: entries.
Bug: 358605784
Fixes: 296cceed0844 ("ANDROID: virt: gunyah: Add gup based demand paging support")
Change-Id: I4738874579136a834bed86daba6d70e469512656
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Mechanism to detect vCPU stalls relies on VMM (running in userspace) to
keep track of the time vCPU has run as guest. Currently, Gunyah drivers
do not provide any mechanism for VMM to track how long a vCPU has run
in guest context. In case of vCPU stall detection, this results in VMM
always seeing the guest VM run duration as zero, consequently never
triggering VM watchdog.
This patch adds calls to vtime_account_guest_enter() and
vtime_account_guest_exit() to track how much a vCPU has run as
guest VM.
By design, interrupts must be enabled when making the Gunyah hypercall
to switch to guest vCPU. However, if VIRT_CPU_ACCOUNTING_NATIVE or
VIRT_VCPU_ACCOUNTING_GEN configs are enabled,
vtime_account_guest_enter() & vtime_account_guest_exit()
implementations use seqlocks, which require interrupts to be disabled.
Hence, if either of these configs are enabled, guest VM run time
tracking cannot be supported with Gunyah.
Bug: 350614114
Change-Id: Ia49677137716fed50948f209b5e22fba05271c1b
Signed-off-by: Hrishabh Rajput <quic_hrishabh@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Add support for further vendor features of Gunyah. To probe the vendor
features, add auxiliary device and export gunyah_rm_call to all the vendor
features to make not-yet-upstreamed RM RPC calls.
Bug: 338347082
Change-Id: I13de37b7c0d5d6c85bdd32a20c39fdde99cffbdd
Signed-off-by: Sreenad Menon <quic_sreemeno@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Android protected virtual machines use "pvmfw" in their boot flow. Add
support to nominate a region of memory for the pvmfw. When nominated,
the region is shared to the VM as a memory parcel and is unmarked as a
demand-paged region.
Bug: 338347082
Change-Id: I57d203761fbe58eb935a158db7f62f762c3c82dd
Signed-off-by: Sreenad Menon <quic_sreemeno@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
This diff was found during testing and is going in future revision of
upstream Gunyah patches. When reclaiming all the VM's memory when
tearing down the virtual machine, we can avoid synchronization and batch
the sync on the last reclaim (see gunyah_vm_reclaim_range()). The flag
was correctly passed to gunyah_hypercall_addrspace_unmap(), but was
missed for the gunyah_hypercall_memextent_donate(). Add it.
Bug: 338347082
Change-Id: I809650b8c6e102a760b6cc589c23aaa18b7bfa2e
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Gunyah resource manager has limited internal buffering to send messages
to VMs and it is possible to fill the buffer and cause RM to drop
replies. Prevent the "drop" scenario by serializing the entire
send/receive RPC flow.
Bug: 330201551
Change-Id: I65f2f6daf495eb24e1bc120a6a4d0b84c966e3cc
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Allow userspace to attach an ioeventfd to an mmio address within the
guest. Userspace provides a description of the type of write to
"subscribe" to and eventfd to trigger when that type of write is
performed by the guest. This mechanism allows userspace to respond
asynchronously to a guest manipulating a virtualized device and is
similar to KVM's ioeventfd.
Bug: 338347082
Link: https://lore.kernel.org/all/20240222-gunyah-v17-34-1e9da6763d38@quicinc.com/
Change-Id: Ic01e6a05f268b278a972fc28fb70168c14894537
Reviewed-by: Alex Elder <elder@linaro.org>
Co-developed-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Sreenad Menon <quic_sreemeno@quicinc.com>
[Elliot: s/eventfd_signal(..., 1)/event_fd_signal(...)/]
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Enable support for creating irqfds which can raise an interrupt on a
Gunyah virtual machine. irqfds are exposed to userspace as a Gunyah VM
function with the name "irqfd". If the VM devicetree is not configured
to create a doorbell with the corresponding label, userspace will still
be able to assert the eventfd but no interrupt will be raised on the
guest.
Bug: 338347082
Link: https://lore.kernel.org/all/20240222-gunyah-v17-32-1e9da6763d38@quicinc.com/
Change-Id: I642ff862db1268cc5195346f79ed96573a9ba492
Acked-by: Alex Elder <elder@linaro.org>
Co-developed-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
[Elliot: s/fd.file/fd_file(fd)/]
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Add Gunyah Resource Manager RPC to enable demand paging for a virtual
machine. Resource manager needs to be informed of private memory regions
which will be demand paged and the location where the DTB memory parcel
should live in the guest's address space.
Bug: 338347082
Link: https://lore.kernel.org/all/20240222-gunyah-v17-27-1e9da6763d38@quicinc.com/
Change-Id: Iff343e98741df4f6265ffd9ef71d9d4b4cb2e31a
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Elliot Berman <elliot.berman@oss.qualcomm.com>
Nikhil V
Prakruthi Deepak Heragu
Mukesh Pilaniya
Peng Yang
Cong Zhang
Prakruthi Deepak Heragu
Elliot Berman
Elliot Berman
Hrishabh Rajput
Sreenad Menon