virt: add new isolation types and page data for loading isolated partitions#3669
virt: add new isolation types and page data for loading isolated partitions#3669chris-oo wants to merge 2 commits into
Conversation
|
This PR modifies files containing For more on why we check whole files, instead of just diffs, check out the Rustonomicon |
| /// The generic visibility requested for the page range. | ||
| pub visibility: PageVisibility, | ||
| /// The loader acceptance type used to import this range. | ||
| pub acceptance: loader::importer::BootPageAcceptance, |
There was a problem hiding this comment.
this dependency seems wrong to me, and i'm wondering if instead PageVisbility should instead be PageAcceptance/PageType, and either:
A) we keep the loader type and convert between these two enums
B) we define a virt type and just have the loader use it
And then as part of that virt type, we can implement some is_shared or is_private functions. Thoughts?
There was a problem hiding this comment.
We need to define a virt type here, and it should be close to what the hypervisors actually need, abstracted as little as possible. The vm_loader code can convert from the loader's model to the virt model.
There was a problem hiding this comment.
Pull request overview
This PR extends the VM load/start plumbing to support upcoming isolated-guest enablement (SNP and ARM CCA on KVM) by carrying richer “initial page import” metadata through the loader → core → virt backend boundary, and by expanding isolation configuration surfaces (new isolation types + CCA shared GPA bit).
Changes:
- Replace “initial accepted page visibility” lists with
virt::InitialPageImport(range + visibility + acceptance + debug tag) throughout the load/start flow. - Add new isolation types (SNP, CCA) to OpenVMM config and plumb to
virt::IsolationType. - Extend
virt::PlatformInfo(aarch64) withcca_shared_gpa_bit.
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| vmm_core/vm_loader/src/lib.rs | Tracks imported page ranges with metadata and returns InitialPageImport list; converts duplicate register import panic into an error; adds unit tests. |
| vmm_core/vm_loader/Cargo.toml | Adds test_with_tracing for new unit tests. |
| vmm_core/virt/src/generic.rs | Adds PlatformInfo::cca_shared_gpa_bit, introduces InitialPageImport, and updates the initial-page-acceptance trait surface. |
| vmm_core/virt/Cargo.toml | Adds loader dependency to support InitialPageImport.acceptance. |
| vmm_core/virt_whp/src/lib.rs | Updates WHP backend initial-page acceptance implementation for new parameter type. |
| vmm_core/virt_mshv/src/aarch64/mod.rs | Initializes new PlatformInfo field. |
| vmm_core/virt_kvm/src/arch/aarch64/mod.rs | Initializes new PlatformInfo field. |
| vmm_core/virt_hvf/src/lib.rs | Initializes new PlatformInfo field. |
| vmm_core/src/partition_unit.rs | Renames/reshapes the RPC pathway to “accept initial pages” with InitialPageImport. |
| openvmm/openvmm_defs/src/config.rs | Adds IsolationType::{Snp,Cca} and maps to virt::IsolationType. |
| openvmm/openvmm_core/src/worker/vm_loaders/igvm.rs | Returns InitialPageImport from IGVM load. |
| openvmm/openvmm_core/src/worker/dispatch.rs | Moves isolated-partition page finalization to occur after initial register load; updates call to new API. |
| openvmm/openvmm_core/src/partition.rs | Updates partition abstraction to accept InitialPageImport. |
| openhcl/underhill_core/src/wrapped_partition.rs | Updates trait signature for initial page acceptance (unreachable path). |
| Cargo.lock | Updates lockfile for dependency graph changes. |
| /// The CCA shared IPA bit, if available. | ||
| pub cca_shared_gpa_bit: Option<u64>, |
| // imported as a page, not registers, along with revisiting other | ||
| // isolation architectures and backends. | ||
| if self.hypervisor_cfg.with_isolation.is_some() { | ||
| tracing::debug!(?initial_page_vis, "initial_page_imports"); |
| /// The loader acceptance type used to import this range. | ||
| pub acceptance: loader::importer::BootPageAcceptance, | ||
| /// Loader-provided debug tag identifying the source of this range. |
Add OpenVMM config variants for SNP and CCA isolation and carry an optional CCA shared GPA bit in AArch64 platform information. Backends initialize the new platform field to None for now; actual CCA probing is added later. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Preserve loader page import metadata through VM loading and expose a backend hook to finalize initial page imports before first run. This keeps page visibility plus loader acceptance/tag information available for isolated backends without changing non-isolated load behavior.
e7aaa07 to
a6adcff
Compare
| }; | ||
| (range, vis) | ||
| InitialPageImport { | ||
| range: MemoryRange::from_4k_gpn_range(start..(end + 1)), |
There was a problem hiding this comment.
| range: MemoryRange::from_4k_gpn_range(start..(end + 1)), | |
| range: MemoryRange::from_4k_gpn_range(start..=end), |
Add new isolation types and CCA shared gpa bit. Isolated partitions additionally require more than just the visibility of the page, in order to set memory attributes correctly for guest pages that were written to as part of the import process.
These changes are used in upcoming changes to launch SNP and CCA guests on KVM.