[PATCH 3/3] arm64/coco: Add pKVM as a CC platform

[Aneesh Kumar K.V]

Mostafa Saleh <smostafa at google.com> writes:

> pKVM does support memory encryption, expose that to the rest of
> the kernel through cc_platform_has()
>
> At the moment, all devices inside the guest are emulated which
> requires its memory to be shared back to the host (decrypted), so
> set force_dma_unencrypted() to always return true.
>
> Although, typically pKVM guests rely on restricted-dma-pools to
> bounce traffic, with this change, it is possible to solely rely on
> the default SWIOTLB for that (assuming the appropriate size is set
> from the command line)
>
> Signed-off-by: Mostafa Saleh <smostafa at google.com>
> ---
> This change is critical for the ongoing refactoring of the DMA-API[1]
> that will break protected guests under pKVM with this patch. That is
> due to this rework will make the state of the SWIOTLB and restricted
> dma pools depends on the value returned by cc_platform_has()
>
> [1] https://lore.kernel.org/all/20260522042815.370873-1-aneesh.kumar@kernel.org/
> ---
>  arch/arm64/include/asm/hypervisor.h           | 13 +++++++++++++
>  arch/arm64/include/asm/mem_encrypt.h          |  3 ++-
>  arch/arm64/kernel/rsi.c                       | 12 ------------
>  arch/arm64/mm/init.c                          | 15 ++++++++++++++-
>  drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c |  3 +++
>  5 files changed, 32 insertions(+), 14 deletions(-)
>
> diff --git a/arch/arm64/include/asm/hypervisor.h b/arch/arm64/include/asm/hypervisor.h
> index a12fd897c877..8889a0ba1ec5 100644
> --- a/arch/arm64/include/asm/hypervisor.h
> +++ b/arch/arm64/include/asm/hypervisor.h
> @@ -3,6 +3,9 @@
>  #define _ASM_ARM64_HYPERVISOR_H
>  
>  #include <asm/xen/hypervisor.h>
> +#include <linux/jump_label.h>
> +
> +DECLARE_STATIC_KEY_FALSE(pkvm_guest);
>  
>  void kvm_init_hyp_services(void);
>  bool kvm_arm_hyp_service_available(u32 func_id);
> @@ -10,8 +13,18 @@ void kvm_arm_target_impl_cpu_init(void);
>  
>  #ifdef CONFIG_ARM_PKVM_GUEST
>  void pkvm_init_hyp_services(void);
> +
> +static inline bool is_protected_kvm_guest(void)
> +{
> +	return static_branch_unlikely(&pkvm_guest);
> +}
>  #else
>  static inline void pkvm_init_hyp_services(void) { };
> +
> +static inline bool is_protected_kvm_guest(void)
> +{
> +	return false;
> +}
>  #endif
>  
>  static inline void kvm_arch_init_hyp_services(void)
>

...

> diff --git a/drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c b/drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c
> index d66291def0f4..26fe9c3f22e3 100644
> --- a/drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c
> +++ b/drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c
> @@ -17,6 +17,7 @@
>  #include <asm/hypervisor.h>
>  
>  static size_t pkvm_granule;
> +DEFINE_STATIC_KEY_FALSE_RO(pkvm_guest);
>

Do we need EXPORT_SYMBOL on this? 

>  
>  static int arm_smccc_do_one_page(u32 func_id, phys_addr_t phys)
>  {
> @@ -120,4 +121,6 @@ void pkvm_init_hyp_services(void)
>  
>  	if (kvm_arm_hyp_service_available(ARM_SMCCC_KVM_FUNC_MMIO_GUARD))
>  		arm64_ioremap_prot_hook_register(&mmio_guard_ioremap_hook);
> +
> +	static_branch_enable(&pkvm_guest);
>  }
> -- 
> 2.54.0.1032.g2f8565e1d1-goog

-aneesh