Merge tag 'kvmarm-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 updates for 7.4

* New features

  - pKVM state isolation: years after pKVM started being enabled
    upstream, we finally get the basics in the form of state
    isolation. The vcpu state is now off-limit for the host for
    protected VMs.

  - pKVM also grows a hypervisor-private memory allocator, allowing it
    to deal with sub-page allocation, much like everywhere else.

  - pKVM also lands a trace_printk() equivalent, which hopefully will
    make debugging a bit easier.

  - First shot at annotating portions of the KVM/arm64 code to be
    extracted and built on s390. The real fun is yet to come.

  - Allow pre-faulting of stage-2 canonical mappings from userspace,
    joining x86 and s390 in implementing this feature.

  - Add a reverse mapping infrastructure for shadow stage-2,
    significantly improving performance when MMU notifiers kick in,
    and avoiding full unmap of all shadow tables for this VM.

  - Next step of GICv5 enablement, adding support for the IRS block,
    and providing both SPI and LPI support.  This is the first point
    where KVM/arm64 can support an SMP GICv5 guest.

* Improvements

  - As a preliminary to eventually enabling CCA, add a bunch of
    infrastructure to KVM/arm64, splitting some of the basic
    operations into individual backends (normal VM, normal pKVM VM,
    protected pKVM VM). This allows CCA to later slot in without
    polluting the rest of KVM with its firmware-driven nonsense.

  - Make ID registers immutable from the point where a vcpu is able
    to run, even if it fails to run. This prevents KVM from sampling
    untrusted values.

  - Restore some type checking to the EL2 object. KVM/arm64 originally
    had some strong type checking between the kernel and the EL2
    object, but lost it along the way when the private hypercall
    interface was (somewhat pointlessly) converted to SMCCC. Type
    checking is back, syscall style, and with added sparse goodies.

  - Expand the FFA support to FFA_NOTIFICATION_*, and add some
    sanitisation of the protocol that pKVM relays to the "trusted"
    runtime.

* Fixes

  - Make GICv3 RD assignment more robust to userspace nonsense

  - Convert the remaining MMU fault handler backends to
    kvm_s2_fault_vma_info and co, fixing a number of bugs in the
    process.

  - Fix the SError/SEA selftests to be both more robust and less
    braindead.

  - Fix a smattering of documentation bugs, some of them as a result
    of our AI friends spitting out credible assertions based on
    non-existing symbols.

  - The usual collection of low impact bug fixes (SMCCC, timers, PMU).

1 files changed, 10 insertions, 2 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index ba546c1a92f5..ed4340c62518 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -472,7 +472,7 @@ static void kvm_vcpu_destroy(struct kvm_vcpu *vcpu)
 	kvm_dirty_ring_free(&vcpu->dirty_ring);
 
 	/*
-	 * No need for rcu_read_lock as VCPU_RUN is the only place that changes
+	 * No need for rcu_read_lock as KVM_RUN is the only place that changes
 	 * the vcpu->pid pointer, and at destruction time all file descriptors
 	 * are already gone.
 	 */
@@ -4367,7 +4367,7 @@ static int kvm_vcpu_ioctl_get_stats_fd(struct kvm_vcpu *vcpu)
 static int kvm_vcpu_pre_fault_memory(struct kvm_vcpu *vcpu,
 				     struct kvm_pre_fault_memory *range)
 {
-	int idx;
+	int idx, err;
 	long r;
 	u64 full_size;
 
@@ -4379,6 +4379,14 @@ static int kvm_vcpu_pre_fault_memory(struct kvm_vcpu *vcpu,
 	    range->gpa + range->size <= range->gpa)
 		return -EINVAL;
 
+	/*
+	 * Certain architectures (e.g. arm64) need to reject the ioctl 'early'
+	 * before vcpu_load().
+	 */
+	err = kvm_arch_pre_fault_allowed(vcpu);
+	if (err)
+		return err;
+
 	vcpu_load(vcpu);
 	idx = srcu_read_lock(&vcpu->kvm->srcu);