KVM: arm64: relay entropy requests from protected guests directly to secure
As pKVM does not trust the host, it should not be involved in the
handling of, or be able to observe the response to entropy requests
issues by protected guests.
When an SMC-based implementation of the ARM SMCCC TRNG interface is
present, pass any HVC-based requests directly on to the secure firmware.
Co-developed-by: Ard Biesheuvel <ardb@google.com>
Signed-off-by: Ard Biesheuvel <ardb@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index 63fdf38..fadadb1c4 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -147,5 +147,6 @@ extern u64 kvm_nvhe_sym(id_aa64smfr0_el1_sys_val);
extern unsigned long kvm_nvhe_sym(__icache_flags);
extern unsigned int kvm_nvhe_sym(kvm_arm_vmid_bits);
extern unsigned int kvm_nvhe_sym(kvm_host_sve_max_vl);
+extern bool kvm_nvhe_sym(smccc_trng_available);
#endif /* __ARM64_KVM_HYP_H__ */
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 5ceece2..1030b82 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -27,6 +27,7 @@
#include "trace_arm.h"
#include <linux/uaccess.h>
+#include <asm/archrandom.h>
#include <asm/ptrace.h>
#include <asm/mman.h>
#include <asm/tlbflush.h>
@@ -2426,6 +2427,7 @@ static void kvm_hyp_init_symbols(void)
kvm_nvhe_sym(id_aa64smfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64SMFR0_EL1);
kvm_nvhe_sym(__icache_flags) = __icache_flags;
kvm_nvhe_sym(kvm_arm_vmid_bits) = kvm_arm_vmid_bits;
+ kvm_nvhe_sym(smccc_trng_available) = smccc_trng_available;
}
static int __init kvm_hyp_init_protection(u32 hyp_va_bits)
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index d02d47c..efc3cbd 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -1290,6 +1290,35 @@ static bool pkvm_memunshare_call(struct pkvm_hyp_vcpu *hyp_vcpu)
return true;
}
+bool smccc_trng_available;
+
+static bool pkvm_forward_trng(struct kvm_vcpu *vcpu)
+{
+ u32 fn = smccc_get_function(vcpu);
+ struct arm_smccc_res res;
+ unsigned long arg1 = 0;
+
+ /*
+ * Forward TRNG calls to EL3, as we can't trust the host to handle
+ * these for us.
+ */
+ switch (fn) {
+ case ARM_SMCCC_TRNG_FEATURES:
+ case ARM_SMCCC_TRNG_RND32:
+ case ARM_SMCCC_TRNG_RND64:
+ arg1 = smccc_get_arg1(vcpu);
+ fallthrough;
+ case ARM_SMCCC_TRNG_VERSION:
+ case ARM_SMCCC_TRNG_GET_UUID:
+ arm_smccc_1_1_smc(fn, arg1, &res);
+ smccc_set_retval(vcpu, res.a0, res.a1, res.a2, res.a3);
+ memzero_explicit(&res, sizeof(res));
+ break;
+ }
+
+ return true;
+}
+
/*
* Handler for protected VM HVC calls.
*
@@ -1334,6 +1363,11 @@ bool kvm_handle_pvm_hvc64(struct kvm_vcpu *vcpu, u64 *exit_code)
return pkvm_memshare_call(hyp_vcpu, exit_code);
case ARM_SMCCC_VENDOR_HYP_KVM_MEM_UNSHARE_FUNC_ID:
return pkvm_memunshare_call(hyp_vcpu);
+ case ARM_SMCCC_TRNG_VERSION ... ARM_SMCCC_TRNG_RND32:
+ case ARM_SMCCC_TRNG_RND64:
+ if (smccc_trng_available)
+ return pkvm_forward_trng(vcpu);
+ break;
default:
return pkvm_handle_psci(hyp_vcpu);
}
