Messages in this thread | | | Date | Wed, 11 Nov 2020 14:32:50 +0000 | From | Marc Zyngier <> | Subject | Re: [PATCH v1 00/24] Opt-in always-on nVHE hypervisor |
| |
Hi David,
On 2020-11-09 11:32, David Brazdil wrote: > As we progress towards being able to keep guest state private to the > host running nVHE hypervisor, this series allows the hypervisor to > install itself on newly booted CPUs before the host is allowed to run > on them. > > All functionality described below is opt-in, guarded by an early param > 'kvm-arm.protected'. Future patches specific to the new "protected" > mode > should be hidden behind the same param. > > The hypervisor starts trapping host SMCs and intercepting host's PSCI > CPU_ON/OFF/SUSPEND calls. It replaces the host's entry point with its > own, initializes the EL2 state of the new CPU and installs the nVHE hyp > vector before ERETing to the host's entry point. > > The kernel checks new cores' features against the finalized system > capabilities. To avoid the need to move this code/data to EL2, the > implementation only allows to boot cores that were online at the time > of > KVM initialization and therefore had been checked already. > > Other PSCI SMCs are forwarded to EL3, though only the known set of SMCs > implemented in the kernel is allowed. Non-PSCI SMCs are also forwarded > to EL3. Future changes will need to ensure the safety of all SMCs wrt. > private guests. > > The host is still allowed to reset EL2 back to the stub vector, eg. for > hibernation or kexec, but will not disable nVHE when there are no VMs. > > Tested on Rock Pi 4b, based on 5.10-rc3.
I think I've gone through most of the patches. When you respin this series, you may want to do so on top of my host EL2 entry rework [1], which change a few things you currently rely on.
If anything in there doesn't work for you, please let me know.
Thanks,
M.
[1] https://lore.kernel.org/kvm/20201109175923.445945-1-maz@kernel.org/ -- Jazz is not dead. It just smells funny...
| |