HACK: Force kvmtool to create protected VMs for testing Force the vm type to be protected. Reserve memory for restricted DMA. Use this with the linux topic/hackathon/phase-5 branch. Run kvmtool with --force-pci for restricted DMA. Signed-off-by: Fuad Tabba <tabba@google.com>
diff --git a/arm/aarch64/kvm.c b/arm/aarch64/kvm.c index 56a0aed..fc4d486 100644 --- a/arm/aarch64/kvm.c +++ b/arm/aarch64/kvm.c
@@ -79,5 +79,24 @@ if (ipa_bits > max_ipa_bits) die("Memory too large for this system (needs %d bits, %d available)", ipa_bits, max_ipa_bits); - return KVM_VM_TYPE_ARM_IPA_SIZE(ipa_bits); + return KVM_VM_TYPE_ARM_IPA_SIZE(ipa_bits) | (1<<8); } + +/* HACK - HACK - HACK */ +#define KVM_CAP_ARM_PROTECTED_VM 206 +#define KVM_CAP_ARM_PROTECTED_VM_FLAGS_ENABLE 0 +#define KVM_CAP_ARM_PROTECTED_VM_FLAGS_INFO 1 +static int protected_vm_init(struct kvm *kvm) +{ + struct kvm_enable_cap pvm_cap = { + .cap = KVM_CAP_ARM_PROTECTED_VM, + .flags = KVM_CAP_ARM_PROTECTED_VM_FLAGS_ENABLE, + .args[0] = -1, + }; + int ret; + + ret = ioctl(kvm->vm_fd, KVM_ENABLE_CAP, &pvm_cap); + printf("Protected vm init: %d\n", ret); + return 0; +} +dev_init(protected_vm_init);
diff --git a/arm/fdt.c b/arm/fdt.c index 635de7f..0cd45d7 100644 --- a/arm/fdt.c +++ b/arm/fdt.c
@@ -116,6 +116,7 @@ void (*)(void *, u8, enum irq_type)); void (*generate_cpu_peripheral_fdt_nodes)(void *, struct kvm *) = kvm->cpus[0]->generate_fdt_nodes; + u64 resv_mem_prop; /* Create new tree without a reserve map */ _FDT(fdt_create(fdt, FDT_MAX_SIZE)); @@ -163,6 +164,21 @@ _FDT(fdt_property(fdt, "reg", mem_reg_prop, sizeof(mem_reg_prop))); _FDT(fdt_end_node(fdt)); + /* Reserved memory (restricted DMA) */ + _FDT(fdt_begin_node(fdt, "reserved-memory")); + _FDT(fdt_property_cell(fdt, "#address-cells", 0x2)); + _FDT(fdt_property_cell(fdt, "#size-cells", 0x2)); + _FDT(fdt_property(fdt, "ranges", NULL, 0)); + + _FDT(fdt_begin_node(fdt, "restricted_dma_reserved")); + _FDT(fdt_property_string(fdt, "compatible", "restricted-dma-pool")); + resv_mem_prop = cpu_to_fdt64(SZ_2M); + _FDT(fdt_property(fdt, "size", &resv_mem_prop, sizeof(resv_mem_prop))); + _FDT(fdt_property_cell(fdt, "phandle", PHANDLE_DMA)); + _FDT(fdt_end_node(fdt)); + + _FDT(fdt_end_node(fdt)); + /* CPU and peripherals (interrupt controller, timers, etc) */ generate_cpu_nodes(fdt, kvm); if (generate_cpu_peripheral_fdt_nodes)
diff --git a/arm/include/arm-common/fdt-arch.h b/arm/include/arm-common/fdt-arch.h index 60c2d40..81df744 100644 --- a/arm/include/arm-common/fdt-arch.h +++ b/arm/include/arm-common/fdt-arch.h
@@ -1,6 +1,6 @@ #ifndef ARM__FDT_H #define ARM__FDT_H -enum phandles {PHANDLE_RESERVED = 0, PHANDLE_GIC, PHANDLE_MSI, PHANDLES_MAX}; +enum phandles {PHANDLE_RESERVED = 0, PHANDLE_GIC, PHANDLE_MSI, PHANDLE_DMA, PHANDLES_MAX}; #endif /* ARM__FDT_H */
diff --git a/arm/pci.c b/arm/pci.c index 2251f62..c533e98 100644 --- a/arm/pci.c +++ b/arm/pci.c
@@ -69,6 +69,7 @@ _FDT(fdt_property(fdt, "reg", &cfg_reg_prop, sizeof(cfg_reg_prop))); _FDT(fdt_property(fdt, "ranges", ranges, sizeof(ranges))); _FDT(fdt_property_cell(fdt, "msi-parent", PHANDLE_MSI)); + _FDT(fdt_property_cell(fdt, "memory-region", PHANDLE_DMA)); /* Generate the interrupt map ... */ dev_hdr = device__first_dev(DEVICE_BUS_PCI);
diff --git a/builtin-run.c b/builtin-run.c index 9a1a0c1..efa3638 100644 --- a/builtin-run.c +++ b/builtin-run.c
@@ -524,6 +524,7 @@ static char default_name[20]; unsigned int nr_online_cpus; struct kvm *kvm = kvm__new(); + int ret; if (IS_ERR(kvm)) return kvm; @@ -685,6 +686,9 @@ kvm->cfg.nrcpus, kvm->cfg.guest_name); } + ret = mlock2(kvm->ram_start, kvm->ram_size, 0 | MLOCK_ONFAULT); + pr_info("mlock2() guest memory: (%d)", ret); + if (init_list__init(kvm) < 0) die ("Initialisation failed");