* [RFC PATCH v2 0/1] qemu: KVM VM Planes host support for VBS
@ 2026-08-11 1:54 Sriram Nambakam
2026-08-11 1:54 ` [RFC PATCH v2 1/1] kvm: handle VM-plane configure/activate hypercalls Sriram Nambakam
0 siblings, 1 reply; 2+ messages in thread
From: Sriram Nambakam @ 2026-08-11 1:54 UTC (permalink / raw)
To: qemu-devel; +Cc: kvm
This RFC adds the QEMU support needed to run Virtualization-Based
Security (VBS) across KVM VM Planes. It handles the guest's plane
configure and activate hypercalls in userspace: allocating and mapping
each plane's RAM, creating the plane and its sibling vCPUs, and
initialising them to enter the loaded plane kernel.
This is v2 of the series. Based on feedback from maintainers, the KVM
host, guest, and QEMU changes are now being posted as three separate,
layered RFCs to make it easier to understand the context of these
changes as they pertain to the KVM host, guest, and QEMU. This
patchset does not yet include memory protection between planes; that
will be added in a future version.
This series is based on the QEMU VM Planes prerequisite patchset obtained
from Joerg Roedel's tree (qemu-planes-linux-v7.1).
This is the userspace counterpart to the separately posted four-patch
KVM host RFC. This remains prototype code and is not intended for
production use.
The implementation and integration tooling are available at:
Linux and KVM support:
https://github.com/safe-tee/linux/tree/vm-planes-layered
QEMU support:
https://github.com/safe-tee/qemu/tree/vm-planes-layered
Build, test, and integration tooling:
https://github.com/safe-tee/lvbs
Acknowledgments
===============
This work stands on top of, and is indebted to, several prior efforts:
- Joerg Roedel, whose QEMU and KVM VM Planes work provides the
infrastructure that the VBS/VSM secure plane relies on.
- Paolo Bonzini, whose "[RFC PATCH 00/29] KVM: VM planes" introduced
the VM Plane concept to KVM as a common in-kernel model for AMD VMPLs,
Intel TDX partitions, Hyper-V VTLs, and Arm CCA planes.
https://lwn.net/Articles/1016113/
- James Bottomley and James Morris, for their ongoing VSM-on-KVM work,
which informed the design and direction of this series.
Feedback on the plane configuration/activation handling and the
memory/vCPU setup it performs is welcome.
Sriram Nambakam (1):
kvm: handle VM-plane configure/activate hypercalls
accel/kvm/kvm-all.c | 20 +
include/standard-headers/linux/kvm_para.h | 2 +
include/system/kvm_int.h | 20 +
target/i386/kvm/kvm.c | 517 ++++++++++++++++++++++
4 files changed, 559 insertions(+)
base-commit: e94b8abef8617a074fac3cfc2797c0c2359ceb8c
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [RFC PATCH v2 1/1] kvm: handle VM-plane configure/activate hypercalls
2026-08-11 1:54 [RFC PATCH v2 0/1] qemu: KVM VM Planes host support for VBS Sriram Nambakam
@ 2026-08-11 1:54 ` Sriram Nambakam
0 siblings, 0 replies; 2+ messages in thread
From: Sriram Nambakam @ 2026-08-11 1:54 UTC (permalink / raw)
To: qemu-devel; +Cc: kvm
The guest plane bootstrap issues KVM_HC_VM_PLANES_CONFIG then
KVM_HC_VM_PLANES_ACTIVATE, which the host exits to userspace. Handle them
here: CONFIG reads the per-plane vm_plane_config from guest memory, creates
the plane (KVM_CREATE_PLANE) and one sibling vCPU per plane-0 vCPU, and maps
the plane's RAM; ACTIVATE builds identity page tables, a minimal GDT and a
boot zero-page in that RAM and initialises each plane vCPU to enter the
loaded plane kernel in 64-bit mode.
The plane vCPUs are created and initialised on their owning plane-0 vCPU
threads (they share the plane-0 kvm_vcpu_common) and are left STOPPED.
QEMU never runs them: the secure plane boots lazily and in-kernel the first
time the normal plane issues a VBS/VTL call.
Enable userspace exit for the two plane hypercalls; KVM_HC_VBS_VTL_CALL is
handled in-kernel and is intentionally not enabled here.
---
accel/kvm/kvm-all.c | 20 +
include/standard-headers/linux/kvm_para.h | 2 +
include/system/kvm_int.h | 20 +
target/i386/kvm/kvm.c | 517 ++++++++++++++++++++++
4 files changed, 559 insertions(+)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 46a14ac0f4..0f42fb5b0c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -822,6 +822,26 @@ void kvm_close(void)
close(kvm_get_plane_fd(kvm_state, plane_id));
kvm_set_plane_fd(kvm_state, plane_id, -1);
} while (plane_id != 0);
+ if (kvm_state->vm_planes) {
+ unsigned int i, j;
+ for (i = 1; i < kvm_state->vm_plane_count; i++) {
+ struct kvm_vm_plane_state *ps = &kvm_state->vm_planes[i];
+ if (ps->vcpu_fds) {
+ for (j = 0; j < ps->vcpu_count; j++) {
+ if (ps->vcpu_fds[j] >= 0) {
+ close(ps->vcpu_fds[j]);
+ }
+ }
+ g_free(ps->vcpu_fds);
+ ps->vcpu_fds = NULL;
+ }
+ g_free(ps->vcpu_cpu_index);
+ ps->vcpu_cpu_index = NULL;
+ }
+ g_free(kvm_state->vm_planes);
+ kvm_state->vm_planes = NULL;
+ kvm_state->vm_plane_count = 0;
+ }
close(kvm_state->fd);
kvm_state->fd = -1;
}
diff --git a/include/standard-headers/linux/kvm_para.h b/include/standard-headers/linux/kvm_para.h
index 015c166302..8810444285 100644
--- a/include/standard-headers/linux/kvm_para.h
+++ b/include/standard-headers/linux/kvm_para.h
@@ -30,6 +30,8 @@
#define KVM_HC_SEND_IPI 10
#define KVM_HC_SCHED_YIELD 11
#define KVM_HC_MAP_GPA_RANGE 12
+#define KVM_HC_VM_PLANES_CONFIG 13
+#define KVM_HC_VM_PLANES_ACTIVATE 14
/*
* hypercalls use architecture specific
diff --git a/include/system/kvm_int.h b/include/system/kvm_int.h
index 70b381f1ba..0ba5d8dacb 100644
--- a/include/system/kvm_int.h
+++ b/include/system/kvm_int.h
@@ -109,6 +109,22 @@ struct KVMPlane {
bool vcpu_dirty;
};
+/*
+ * Per-plane VM state managed by the LVBS VM-planes hypercall handlers.
+ * The plane fd itself is owned by the accel layer (kvm_get_plane_fd);
+ * only the plane's vCPU fds and memory description live here.
+ */
+struct kvm_vm_plane_state {
+ int *vcpu_fds;
+ unsigned int *vcpu_cpu_index;
+ unsigned int vcpu_count;
+ uint64_t load_offset;
+ uint64_t memory_size;
+ uint64_t entry_point;
+ void *host_addr; /* host pointer to plane RAM */
+ char cmdline[512];
+};
+
struct KVMState
{
AccelState parent_obj;
@@ -176,6 +192,10 @@ struct KVMState
uint16_t xen_evtchn_max_pirq;
char *device;
OnOffAuto honor_guest_pat;
+ /* VM planes state (populated by the LVBS hypercall handlers) */
+ struct kvm_vm_plane_state *vm_planes;
+ unsigned int vm_plane_count;
+ unsigned int vm_planes_max;
};
static inline void kvm_set_plane_fd(KVMState *s, unsigned plane, int fd)
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 13cfa60071..357410c159 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -70,6 +70,8 @@
#include "migration/blocker.h"
#include "exec/memattrs.h"
#include "exec/target_page.h"
+#include "system/address-spaces.h"
+#include "system/memory.h"
#include "trace.h"
#include CONFIG_DEVICES
@@ -3588,6 +3590,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
kvm_vmfd_add_change_notifier(&kvm_vmfd_change_notifier);
}
+ /* Exit to userspace for VM-plane config/activate hypercalls (LVBS). */
+ if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_VM_PLANES_CONFIG) |
+ BIT_ULL(KVM_HC_VM_PLANES_ACTIVATE))) {
+ warn_report("kvm: failed to enable VM-planes hypercall exit");
+ }
+
/*
* Most x86 CPUs in current use have self-snoop, so honoring guest PAT is
* preferable. As well, the bochs video driver bug which motivated making
@@ -6519,10 +6527,519 @@ static int kvm_handle_hc_map_gpa_range(X86CPU *cpu, struct kvm_run *run)
return 0;
}
+/* ========================================================================
+ * LVBS — VM planes configure/activate hypercall handlers
+ *
+ * The guest plane bootstrap (Linux init/vm_planes.c) issues
+ * KVM_HC_VM_PLANES_CONFIG then KVM_HC_VM_PLANES_ACTIVATE. QEMU creates the
+ * plane and its per-plane-0 sibling vCPUs and initialises them to enter the
+ * loaded plane kernel in 64-bit mode. It does NOT run the plane vCPUs: the
+ * secure plane boots lazily, in-kernel, the first time the normal plane
+ * issues a VBS/VTL call (handled by the host via KVM_HC_VBS_VTL_CALL).
+ *
+ * Guest struct vm_plane_config layout (see Linux include/linux/vm_planes.h):
+ * off 0 u64 load_offset
+ * off 8 u64 memory_size
+ * off 16 u64 entry_point
+ * off 24 u32 kernel_format
+ * off 28 char kernel[128]
+ * off 156 char cmdline[512]
+ * ======================================================================== */
+
+#define VM_PLANE_CFG_STRIDE 672
+
+/*
+ * Plane>0 vCPU creation and initialization must run on the OWNING plane-0
+ * vCPU's thread. A plane>0 vCPU shares its plane-0 sibling's
+ * struct kvm_vcpu_common, including the single embedded preempt_notifier.
+ * KVM_CREATE_VCPU and KVM_SET_{S,}REGS all vcpu_load() the plane vCPU, which
+ * registers that shared notifier on the *calling* task. If issued from the
+ * hypercall vCPU's thread while a sibling is concurrently in KVM_RUN on
+ * another host CPU, the same hlist_node would be linked onto two tasks'
+ * preempt-notifier lists -> list corruption -> host lockup. run_on_cpu()
+ * forces the sibling out of KVM_RUN and runs the work on its own thread.
+ */
+struct plane_vcpu_create_ctx {
+ KVMState *s;
+ unsigned int plane_id;
+ unsigned int vcpu_id;
+ int fd; /* out: vcpu fd, or -errno on failure */
+};
+
+static void plane_vcpu_create_cb(CPUState *cs, run_on_cpu_data data)
+{
+ struct plane_vcpu_create_ctx *ctx = data.host_ptr;
+ int fd;
+
+ fd = kvm_vm_plane_ioctl(ctx->s, ctx->plane_id, KVM_CREATE_VCPU,
+ (void *)(uintptr_t)ctx->vcpu_id);
+ ctx->fd = (fd < 0) ? -errno : fd;
+}
+
+static int kvm_handle_hc_vm_planes_config(X86CPU *cpu, struct kvm_run *run)
+{
+ uint64_t gpa = run->hypercall.args[0];
+ uint64_t plane_count = run->hypercall.args[1];
+ uint64_t plane_id;
+ unsigned int plane0_vcpu_count;
+ unsigned int *plane0_vcpu_ids;
+ CPUState *cs;
+ KVMState *s = kvm_state;
+
+ if (!gpa || !plane_count) {
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ if (!s->vm_planes_max) {
+ int max = kvm_vm_ioctl(s, KVM_CHECK_EXTENSION, KVM_CAP_PLANES);
+ if (max <= 0) {
+ error_report("vm_planes: KVM does not support planes");
+ run->hypercall.ret = -ENOTSUP;
+ return 0;
+ }
+ s->vm_planes_max = max;
+ }
+
+ if (plane_count > s->vm_planes_max) {
+ error_report("vm_planes: requested %" PRIu64 " planes but KVM "
+ "supports %u", plane_count, s->vm_planes_max);
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ if (s->vm_planes) {
+ info_report("vm_planes: already configured, ignoring");
+ run->hypercall.ret = 0;
+ return 0;
+ }
+
+ s->vm_planes = g_new0(struct kvm_vm_plane_state, plane_count);
+ s->vm_plane_count = plane_count;
+
+ plane0_vcpu_count = 0;
+ CPU_FOREACH(cs) {
+ plane0_vcpu_count++;
+ }
+ if (!plane0_vcpu_count) {
+ error_report("vm_planes: no plane0 vCPUs available");
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ plane0_vcpu_ids = g_new(unsigned int, plane0_vcpu_count);
+ plane0_vcpu_count = 0;
+ CPU_FOREACH(cs) {
+ plane0_vcpu_ids[plane0_vcpu_count++] = cs->cpu_index;
+ }
+
+ for (plane_id = 1; plane_id < plane_count; plane_id++) {
+ uint64_t plane_gpa = gpa + (plane_id * VM_PLANE_CFG_STRIDE);
+ uint64_t load_offset = 0, memory_size = 0, entry_point = 0;
+ uint32_t vcpu_count = plane0_vcpu_count;
+ struct kvm_vm_plane_state *ps = &s->vm_planes[plane_id];
+ char cmdline_buf[512];
+ MemoryRegionSection section;
+ int plane_fd;
+ unsigned int i;
+
+ address_space_read(&address_space_memory, plane_gpa + 0,
+ MEMTXATTRS_UNSPECIFIED, &load_offset, 8);
+ address_space_read(&address_space_memory, plane_gpa + 8,
+ MEMTXATTRS_UNSPECIFIED, &memory_size, 8);
+ address_space_read(&address_space_memory, plane_gpa + 16,
+ MEMTXATTRS_UNSPECIFIED, &entry_point, 8);
+
+ /*
+ * joergroedel plane model: a plane has exactly one vCPU per
+ * plane-0 vCPU -- each is the sibling of a plane-0 vCPU sharing the
+ * same logical CPU. The guest does not configure a count; QEMU
+ * mirrors the plane-0 vCPU set.
+ */
+ if (!memory_size) {
+ error_report("vm_planes: plane %" PRIu64 " invalid "
+ "(load_offset=0x%" PRIx64 " size=0x%" PRIx64 ")",
+ plane_id, load_offset, memory_size);
+ g_free(plane0_vcpu_ids);
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ memset(cmdline_buf, 0, sizeof(cmdline_buf));
+ address_space_read(&address_space_memory, plane_gpa + 156,
+ MEMTXATTRS_UNSPECIFIED, cmdline_buf,
+ sizeof(cmdline_buf));
+ cmdline_buf[sizeof(cmdline_buf) - 1] = '\0';
+ memcpy(ps->cmdline, cmdline_buf, sizeof(ps->cmdline));
+
+ plane_fd = kvm_vm_ioctl(s, KVM_CREATE_PLANE, (int)plane_id);
+ if (plane_fd < 0) {
+ error_report("vm_planes: KVM_CREATE_PLANE plane %" PRIu64
+ " failed: %s", plane_id, strerror(errno));
+ g_free(plane0_vcpu_ids);
+ run->hypercall.ret = -errno;
+ return 0;
+ }
+ /* The kvm_vm_plane_ioctl path looks up the plane fd via
+ * kvm_get_plane_fd / kvm_set_plane_fd, so register the fd. */
+ kvm_set_plane_fd(s, plane_id, plane_fd);
+
+ section = memory_region_find(get_system_memory(),
+ load_offset, memory_size);
+ if (!section.mr || !memory_region_is_ram(section.mr)) {
+ error_report("vm_planes: plane %" PRIu64 " GPA 0x%" PRIx64
+ " size 0x%" PRIx64 " is not RAM",
+ plane_id, load_offset, memory_size);
+ if (section.mr) {
+ memory_region_unref(section.mr);
+ }
+ close(plane_fd);
+ kvm_set_plane_fd(s, plane_id, -1);
+ g_free(plane0_vcpu_ids);
+ run->hypercall.ret = -ENOMEM;
+ return 0;
+ }
+ ps->host_addr = memory_region_get_ram_ptr(section.mr) +
+ section.offset_within_region;
+ memory_region_unref(section.mr);
+
+ ps->vcpu_fds = g_new0(int, vcpu_count);
+ ps->vcpu_cpu_index = g_new0(unsigned int, vcpu_count);
+ for (i = 0; i < vcpu_count; i++) {
+ unsigned int vcpu_id = plane0_vcpu_ids[i];
+ CPUState *target = qemu_get_cpu(vcpu_id);
+ struct plane_vcpu_create_ctx cctx = {
+ .s = s,
+ .plane_id = plane_id,
+ .vcpu_id = vcpu_id,
+ .fd = -EINVAL,
+ };
+
+ if (!target) {
+ error_report("vm_planes: plane %" PRIu64 " no CPU for id=%u",
+ plane_id, vcpu_id);
+ close(plane_fd);
+ kvm_set_plane_fd(s, plane_id, -1);
+ g_free(plane0_vcpu_ids);
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ /* Create on the owning CPU's thread; see plane_vcpu_create_cb. */
+ bql_lock();
+ run_on_cpu(target, plane_vcpu_create_cb,
+ RUN_ON_CPU_HOST_PTR(&cctx));
+ bql_unlock();
+
+ if (cctx.fd < 0) {
+ error_report("vm_planes: KVM_CREATE_VCPU plane %" PRIu64
+ " vcpu %u failed: %s",
+ plane_id, vcpu_id, strerror(-cctx.fd));
+ close(plane_fd);
+ kvm_set_plane_fd(s, plane_id, -1);
+ g_free(plane0_vcpu_ids);
+ run->hypercall.ret = cctx.fd;
+ return 0;
+ }
+
+ ps->vcpu_fds[i] = cctx.fd;
+ ps->vcpu_cpu_index[i] = vcpu_id;
+ }
+
+ ps->vcpu_count = vcpu_count;
+ ps->load_offset = load_offset;
+ ps->memory_size = memory_size;
+ ps->entry_point = entry_point;
+
+ info_report("vm_planes: plane %" PRIu64 " ready — GPA 0x%" PRIx64
+ " size 0x%" PRIx64 " entry 0x%" PRIx64 " vcpus %u",
+ plane_id, load_offset, memory_size, entry_point,
+ vcpu_count);
+ }
+
+ g_free(plane0_vcpu_ids);
+ run->hypercall.ret = 0;
+ return 0;
+}
+
+static int kvm_init_plane_vcpu(int vcpu_fd, uint64_t entry_addr,
+ uint64_t stack_addr, uint64_t zero_page_gpa,
+ uint64_t page_table_gpa, uint64_t gdt_gpa,
+ bool is_bsp)
+{
+ struct kvm_regs regs = {};
+ struct kvm_sregs sregs = {};
+ int ret;
+
+ sregs.cs.base = 0; sregs.cs.limit = 0xffffffff; sregs.cs.selector = 0x10;
+ sregs.cs.type = 0xb; sregs.cs.present = 1; sregs.cs.dpl = 0;
+ sregs.cs.db = 0; sregs.cs.s = 1; sregs.cs.l = 1; sregs.cs.g = 1;
+
+ sregs.ds.base = 0; sregs.ds.limit = 0xffffffff; sregs.ds.selector = 0x18;
+ sregs.ds.type = 0x3; sregs.ds.present = 1; sregs.ds.dpl = 0;
+ sregs.ds.db = 1; sregs.ds.s = 1; sregs.ds.g = 1;
+ sregs.es = sregs.ds;
+ sregs.ss = sregs.ds;
+ sregs.fs = sregs.ds; sregs.fs.selector = 0;
+ sregs.gs = sregs.fs;
+
+ sregs.gdt.base = gdt_gpa; sregs.gdt.limit = 0x2f;
+ sregs.idt.base = 0; sregs.idt.limit = 0xffff;
+ sregs.tr.base = 0; sregs.tr.limit = 0x67; sregs.tr.selector = 0x28;
+ sregs.tr.type = 0xb; sregs.tr.present = 1; sregs.tr.dpl = 0; sregs.tr.s = 0;
+ sregs.ldt.unusable = 1;
+
+ sregs.cr3 = page_table_gpa;
+ sregs.cr4 = (1u << 5); /* PAE */
+ sregs.cr0 = (1u << 0) | (1u << 4) | (1u << 5) | (1u << 16) | (1u << 31);
+ sregs.efer = (1u << 0) | (1u << 8) | (1u << 10) | (1u << 11);
+ sregs.apic_base = 0xfee00000 | (1u << 11);
+ if (is_bsp) {
+ sregs.apic_base |= (1u << 8);
+ }
+
+ ret = ioctl(vcpu_fd, KVM_SET_SREGS, &sregs);
+ if (ret < 0) {
+ error_report("vm_planes: KVM_SET_SREGS: %s", strerror(errno));
+ return -errno;
+ }
+
+ regs.rip = entry_addr;
+ regs.rsp = stack_addr;
+ regs.rsi = zero_page_gpa;
+ regs.rflags = 0x2;
+ ret = ioctl(vcpu_fd, KVM_SET_REGS, ®s);
+ if (ret < 0) {
+ error_report("vm_planes: KVM_SET_REGS: %s", strerror(errno));
+ return -errno;
+ }
+
+ /*
+ * Do NOT issue KVM_SET_MP_STATE on a plane (plane_level > 0) vCPU fd:
+ * the VM-planes kernel only whitelists a subset of vCPU ioctls for
+ * plane vCPUs and KVM_SET_MP_STATE is intentionally excluded. The
+ * kernel already establishes the correct initial MP state at create
+ * time: the plane BSP is left RUNNABLE and APs wait-for-INIT.
+ */
+ return 0;
+}
+
+/* Initialize a plane vCPU on its owning CPU's thread (see
+ * plane_vcpu_create_cb for why the shared-common vcpu_load() must not race
+ * the running sibling). */
+struct plane_vcpu_init_ctx {
+ int vcpu_fd;
+ uint64_t entry_addr;
+ uint64_t stack_addr;
+ uint64_t zero_page_gpa;
+ uint64_t page_table_gpa;
+ uint64_t gdt_gpa;
+ bool is_bsp;
+ int ret; /* out: 0 on success, -errno on failure */
+};
+
+static void plane_vcpu_init_cb(CPUState *cs, run_on_cpu_data data)
+{
+ struct plane_vcpu_init_ctx *ctx = data.host_ptr;
+
+ ctx->ret = kvm_init_plane_vcpu(ctx->vcpu_fd, ctx->entry_addr,
+ ctx->stack_addr, ctx->zero_page_gpa,
+ ctx->page_table_gpa, ctx->gdt_gpa,
+ ctx->is_bsp);
+}
+
+static int kvm_handle_hc_vm_planes_activate(X86CPU *cpu, struct kvm_run *run)
+{
+ uint64_t gpa = run->hypercall.args[0];
+ uint64_t plane_count = run->hypercall.args[1];
+ uint64_t plane_id;
+ KVMState *s = kvm_state;
+
+ if (!gpa || !plane_count || !s->vm_planes ||
+ plane_count != s->vm_plane_count) {
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ for (plane_id = 1; plane_id < plane_count; plane_id++) {
+ struct kvm_vm_plane_state *ps = &s->vm_planes[plane_id];
+ uint64_t stack_addr;
+ uint64_t entry_point = 0;
+ uint64_t cmdline_gpa, zero_page_gpa;
+ uint64_t pt_base, pml4_gpa, pdpt_gpa, pd_base, gdt_gpa_val;
+ unsigned int i;
+
+ if (kvm_get_plane_fd(s, plane_id) < 0 || !ps->vcpu_count ||
+ !ps->host_addr) {
+ error_report("vm_planes: plane %" PRIu64 " not configured",
+ plane_id);
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ address_space_read(&address_space_memory,
+ gpa + (plane_id * VM_PLANE_CFG_STRIDE) + 16,
+ MEMTXATTRS_UNSPECIFIED, &entry_point, 8);
+ if (!entry_point) {
+ error_report("vm_planes: plane %" PRIu64 " bad entry_point",
+ plane_id);
+ run->hypercall.ret = -EIO;
+ return 0;
+ }
+ ps->entry_point = entry_point;
+
+ stack_addr = ps->load_offset + ps->memory_size;
+ cmdline_gpa = stack_addr - 0x1000;
+ zero_page_gpa = stack_addr - 0x2000;
+ pt_base = ps->load_offset + ps->memory_size - 0x10000;
+ pml4_gpa = pt_base;
+ pdpt_gpa = pt_base + 0x1000;
+ pd_base = pt_base + 0x2000;
+ gdt_gpa_val = pt_base + 0x6000;
+
+#define PLANE_HOST(g) ((uint8_t *)ps->host_addr + ((g) - ps->load_offset))
+
+ /* cmdline */
+ {
+ size_t cl = strlen(ps->cmdline) + 1;
+ memcpy(PLANE_HOST(cmdline_gpa), ps->cmdline, cl);
+ }
+
+ /* boot_params zero page */
+ {
+ uint8_t zp[4096] = {};
+ uint32_t cl_ptr = (uint32_t)(cmdline_gpa & 0xffffffff);
+ uint32_t cl_hi = (uint32_t)(cmdline_gpa >> 32);
+ struct {
+ uint64_t addr;
+ uint64_t size;
+ uint32_t type;
+ } QEMU_PACKED e820 = {
+ ps->load_offset, ps->memory_size, 1,
+ };
+
+ zp[0x1fe] = 0x55; zp[0x1ff] = 0xAA;
+ zp[0x202] = 'H'; zp[0x203] = 'd';
+ zp[0x204] = 'r'; zp[0x205] = 'S';
+ zp[0x206] = 0x0f; zp[0x207] = 0x02;
+ zp[0x210] = 0xff;
+ memcpy(&zp[0x228], &cl_ptr, 4);
+ memcpy(&zp[0x0c8], &cl_hi, 4);
+ zp[0x1e8] = 1;
+ memcpy(&zp[0x2d0], &e820, 20);
+ memcpy(PLANE_HOST(zero_page_gpa), zp, sizeof(zp));
+ }
+
+ /* Identity-mapped page tables (PML4 → PDPT → 4×PD with 2MB pages) */
+ {
+ uint8_t page[4096];
+ uint64_t *entries;
+ int pd_idx;
+
+ memset(page, 0, sizeof(page));
+ entries = (uint64_t *)page;
+ entries[0] = pdpt_gpa | 0x3;
+ memcpy(PLANE_HOST(pml4_gpa), page, 4096);
+
+ memset(page, 0, sizeof(page));
+ entries = (uint64_t *)page;
+ for (pd_idx = 0; pd_idx < 4; pd_idx++) {
+ entries[pd_idx] = (pd_base + pd_idx * 0x1000) | 0x3;
+ }
+ memcpy(PLANE_HOST(pdpt_gpa), page, 4096);
+
+ for (pd_idx = 0; pd_idx < 4; pd_idx++) {
+ int j;
+ memset(page, 0, sizeof(page));
+ entries = (uint64_t *)page;
+ for (j = 0; j < 512; j++) {
+ uint64_t phys = ((uint64_t)pd_idx << 30) |
+ ((uint64_t)j << 21);
+ entries[j] = phys | 0x83;
+ }
+ memcpy(PLANE_HOST(pd_base + pd_idx * 0x1000), page, 4096);
+ }
+ }
+
+ /* Minimal GDT */
+ {
+ uint8_t gdt[48] = {};
+ uint64_t *gdt64 = (uint64_t *)gdt;
+
+ gdt64[0] = 0;
+ gdt64[1] = 0;
+ gdt64[2] = 0x00af9a000000ffffULL;
+ gdt64[3] = 0x00cf92000000ffffULL;
+ gdt64[4] = 0;
+ gdt64[5] = 0x0000890000000067ULL;
+ memcpy(PLANE_HOST(gdt_gpa_val), gdt, sizeof(gdt));
+ }
+
+ /* Initialize all plane vCPUs on their owning CPU threads. */
+ for (i = 0; i < ps->vcpu_count; i++) {
+ CPUState *target = qemu_get_cpu(ps->vcpu_cpu_index[i]);
+ struct plane_vcpu_init_ctx ictx = {
+ .vcpu_fd = ps->vcpu_fds[i],
+ .entry_addr = entry_point,
+ .stack_addr = stack_addr,
+ .zero_page_gpa = zero_page_gpa,
+ .page_table_gpa = pml4_gpa,
+ .gdt_gpa = gdt_gpa_val,
+ .is_bsp = (i == 0),
+ .ret = -EINVAL,
+ };
+
+ if (!target) {
+ error_report("vm_planes: plane %" PRIu64 " no CPU for vcpu %u",
+ plane_id, i);
+ run->hypercall.ret = -EINVAL;
+ return 0;
+ }
+
+ /* See plane_vcpu_init_cb: must run on the sibling's own thread. */
+ bql_lock();
+ run_on_cpu(target, plane_vcpu_init_cb,
+ RUN_ON_CPU_HOST_PTR(&ictx));
+ bql_unlock();
+
+ if (ictx.ret) {
+ error_report("vm_planes: init plane %" PRIu64 " vcpu %u "
+ "failed", plane_id, i);
+ run->hypercall.ret = ictx.ret;
+ return 0;
+ }
+ }
+#undef PLANE_HOST
+
+ /*
+ * The plane vCPU is initialized (entry point, page tables) but left
+ * STOPPED. It boots lazily and in-kernel the first time the normal
+ * plane issues a VBS/VTL call: KVM switches to the secure plane
+ * within the normal plane's KVM_RUN. QEMU never runs it.
+ */
+ ps->host_addr = NULL;
+
+ info_report("vm_planes: plane %" PRIu64 " launched — entry 0x%" PRIx64
+ " vcpus %u", plane_id, entry_point, ps->vcpu_count);
+ }
+
+ run->hypercall.ret = 0;
+ return 0;
+}
+
+/*
+ * VBS/VTL calls (KVM_HC_VBS_VTL_CALL / _RETURN) are serviced entirely
+ * in-kernel by switching to the secure plane, so they never exit to
+ * userspace here. QEMU only handles plane configuration/activation.
+ */
static int kvm_handle_hypercall(X86CPU *cpu, struct kvm_run *run)
{
if (run->hypercall.nr == KVM_HC_MAP_GPA_RANGE)
return kvm_handle_hc_map_gpa_range(cpu, run);
+ if (run->hypercall.nr == KVM_HC_VM_PLANES_CONFIG)
+ return kvm_handle_hc_vm_planes_config(cpu, run);
+ if (run->hypercall.nr == KVM_HC_VM_PLANES_ACTIVATE)
+ return kvm_handle_hc_vm_planes_activate(cpu, run);
return -EINVAL;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-11 1:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-11 1:54 [RFC PATCH v2 0/1] qemu: KVM VM Planes host support for VBS Sriram Nambakam
2026-08-11 1:54 ` [RFC PATCH v2 1/1] kvm: handle VM-plane configure/activate hypercalls Sriram Nambakam
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.