Track pages once ownership has moved from Xen to the RMM. Teardown uses these records to hand them back in the right RMI order.
Signed-off-by: Koichiro Den <[email protected]> --- xen/arch/arm/cca/state.c | 19 ++++++++++++++++ xen/arch/arm/include/asm/cca.h | 40 ++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) diff --git a/xen/arch/arm/cca/state.c b/xen/arch/arm/cca/state.c index a47d9cd7b6fd..66375965a1b4 100644 --- a/xen/arch/arm/cca/state.c +++ b/xen/arch/arm/cca/state.c @@ -10,17 +10,36 @@ static void arm_cca_reset_domain_state(struct domain *d) { + unsigned int i; + d->arch.cca.realm_active = false; d->arch.cca.rd = INVALID_PADDR; d->arch.cca.rmi_features0 = 0; d->arch.cca.rmi_features1 = 0; + d->arch.cca.rd_page = NULL; + d->arch.cca.rtt_root_page = NULL; + d->arch.cca.nr_realm_sro_pages = 0; + d->arch.cca.rtts = NULL; + d->arch.cca.nr_rtts = 0; + d->arch.cca.data_pages = NULL; + d->arch.cca.nr_data_pages = 0; + + for ( i = 0; i < ARRAY_SIZE(d->arch.cca.realm_sro_pages); ++i ) + d->arch.cca.realm_sro_pages[i] = NULL; } static void arm_cca_reset_vcpu_state(struct vcpu *v) { + unsigned int i; + v->arch.cca.rec = INVALID_PADDR; v->arch.cca.run = NULL; v->arch.cca.run_pa = INVALID_PADDR; + v->arch.cca.rec_page = NULL; + v->arch.cca.nr_aux = 0; + + for ( i = 0; i < ARRAY_SIZE(v->arch.cca.aux_pages); ++i ) + v->arch.cca.aux_pages[i] = NULL; } void arm_cca_domain_init(struct domain *d) diff --git a/xen/arch/arm/include/asm/cca.h b/xen/arch/arm/include/asm/cca.h index 1be43327119e..6bf644fbcee5 100644 --- a/xen/arch/arm/include/asm/cca.h +++ b/xen/arch/arm/include/asm/cca.h @@ -14,20 +14,60 @@ */ #define ARM_CCA_MAX_REC_AUX 16U +/* + * Xen implementation cap for pages accepted by one memory-transferring SRO, + * not an RMI architectural limit. Switch to dynamic tracking if a real RMM + * needs more. + */ +#define ARM_CCA_MAX_SRO_DONATION_PAGES 64U + struct domain; struct vcpu; +struct page_info; + +struct arm_cca_rtt_record { + paddr_t ipa; + paddr_t pa; + unsigned int level; +}; + +struct arm_cca_data_page_record { + paddr_t ipa; + paddr_t pa; +}; struct arm_cca_domain_state { bool realm_active; paddr_t rd; unsigned long rmi_features0; unsigned long rmi_features1; + + /* + * Host references for granules whose RMM state is no longer represented + * by Xen's page allocator alone. They let relinquish complete the + * reverse DEN0137 2.0-bet1 A2.3.6 transitions before the pages are + * returned to Xen. + */ + struct page_info *rd_page; + struct page_info *rtt_root_page; + struct page_info *realm_sro_pages[ARM_CCA_MAX_SRO_DONATION_PAGES]; + unsigned int nr_realm_sro_pages; + + struct arm_cca_rtt_record *rtts; + unsigned int nr_rtts; + + struct arm_cca_data_page_record *data_pages; + unsigned long nr_data_pages; }; struct arm_cca_vcpu_state { paddr_t rec; void *run; paddr_t run_pa; + + struct page_info *rec_page; + struct page_info *aux_pages[ARM_CCA_MAX_REC_AUX]; + unsigned int nr_aux; }; void arm_cca_domain_init(struct domain *d); -- 2.51.0
