Implement support for HVF Nested Virtualization

edk2/Sources.txt

@@ -1 +1 @@
-KRUN_EFI.silent.fd was built from commit 82563b1d62ba029bd7bbfff73d49cce21af302c0 of the https://github.com/slp/edk2 repository.
+KRUN_EFI.silent.fd was built from commit 13e8adac8a83141b51375c799996946082e1eb43 of the https://github.com/slp/edk2 repository.

examples/external_kernel.c

@@ -45,6 +45,7 @@ static void print_help(char *const name)
             "        -d    --data-disk           Path to a data disk in raw format\n"
             "        -h    --help                Show help\n"
             "        -i    --initrd              Path to initramfs\n"
+            "        -n    --nested              Enabled nested virtualization\n"
             "              --net=NET_MODE        Set network mode\n"
             "              --passt-socket=PATH   Connect to passt socket at PATH"
             "\n"
@@ -63,6 +64,7 @@ static const struct option long_options[] = {
     {"kernel-cmdline", required_argument, NULL, 'c'},
     {"data-disk", required_argument, NULL, 'd'},
     {"initrd-path", required_argument, NULL, 'i'},
+    {"nested", no_argument, NULL, 'n'},
     {"help", no_argument, NULL, 'h'},
     {"passt-socket", required_argument, NULL, 'P'},
     {NULL, 0, NULL, 0}};
@@ -77,6 +79,7 @@ struct cmdline
     char const *kernel_path;
     char const *kernel_cmdline;
     char const *initrd_path;
+    bool nested;
 };
 
 bool parse_cmdline(int argc, char *const argv[], struct cmdline *cmdline)
@@ -93,12 +96,13 @@ bool parse_cmdline(int argc, char *const argv[], struct cmdline *cmdline)
         .kernel_path = NULL,
         .kernel_cmdline = NULL,
         .initrd_path = NULL,
+        .nested = false,
     };
 
     int option_index = 0;
     int c;
     // the '+' in optstring is a GNU extension that disables permutating argv
-    while ((c = getopt_long(argc, argv, "+hb:c:d:i:", long_options, &option_index)) != -1)
+    while ((c = getopt_long(argc, argv, "+hb:c:d:i:n", long_options, &option_index)) != -1)
     {
         switch (c)
         {
@@ -117,6 +121,9 @@ bool parse_cmdline(int argc, char *const argv[], struct cmdline *cmdline)
         case 'i':
             cmdline->initrd_path = optarg;
             break;
+        case 'n':
+            cmdline->nested = true;
+            break;
         case 'P':
             cmdline->passt_socket_path = optarg;
             break;
@@ -307,6 +314,14 @@ int main(int argc, char *const argv[])
         return -1;
     }
 
+    fprintf(stderr, "nested=%d\n", cmdline.nested);
+    if (err = krun_set_nested_virt(ctx_id, cmdline.nested))
+    {
+        errno = -err;
+        perror("Error configuring nested virtualization");
+        return -1;
+    }
+
     // Start and enter the microVM. Unless there is some error while creating the microVM
     // this function never returns.
     if (err = krun_start_enter(ctx_id))

include/libkrun.h

@@ -536,6 +536,23 @@ int32_t krun_setuid(uint32_t ctx_id, uid_t uid);
  */
 int32_t krun_setgid(uint32_t ctx_id, gid_t gid);
 
+/**
+ * Configures the microVM to support Nested Virtualization
+ *
+ * Arguments:
+ *  "ctx_id"  - the configuration context ID.
+ *  "enabled" - true to enable Nested Virtualization in the microVM.
+ *
+ * Notes:
+ *  This feature is only supported on macOS.
+ *
+ * Returns:
+ *  Zero on success or a negative error number on failure. Success doesn't imply that
+ *  Nested Virtualization is supported on the system, only that it's going to be requested
+ *  when the microVM is created after calling "krun_start_enter".
+ */
+int32_t krun_set_nested_virt(uint32_t ctx_id, bool enabled);
+
 /**
  * Starts and enters the microVM with the configured parameters. The VMM will attempt to take over
  * stdin/stdout to manage them on behalf of the process running inside the isolated environment,

src/arch/src/aarch64/macos/sysreg.rs

@@ -57,13 +57,24 @@ arm64_sys_reg!(SYSREG_ICC_PMR_EL1, 3, 0, 0, 4, 6);
 arm64_sys_reg!(SYSREG_ICC_SGI1R_EL1, 3, 0, 5, 12, 11);
 arm64_sys_reg!(SYSREG_ICC_SRE_EL1, 3, 0, 5, 12, 12);
 
+arm64_sys_reg!(SYSREG_CNTVOFF_EL2, 3, 4, 3, 14, 0);
+arm64_sys_reg!(SYSREG_CNTHCTL_EL2, 3, 4, 0, 14, 1);
+arm64_sys_reg!(SYSREG_CNTHP_TVAL_EL2, 3, 4, 0, 14, 2);
+arm64_sys_reg!(SYSREG_CNTHP_CTL_EL2, 3, 4, 1, 14, 2);
+arm64_sys_reg!(SYSREG_CNTHP_CVAL_EL2, 3, 4, 2, 14, 2);
+arm64_sys_reg!(SYSREG_CNTHV_TVAL_EL2, 3, 4, 0, 14, 3);
+arm64_sys_reg!(SYSREG_CNTHV_CTL_EL2, 3, 4, 1, 14, 3);
+arm64_sys_reg!(SYSREG_CNTHV_CVAL_EL2, 3, 4, 2, 14, 3);
+
+arm64_sys_reg!(SYSREG_LORC_EL1, 3, 0, 3, 10, 4);
+
 // ICC_CTLR_EL1 (https://developer.arm.com/documentation/ddi0595/2021-06/AArch64-Registers/ICC-CTLR-EL1--Interrupt-Controller-Control-Register--EL1-)
 pub const ICC_CTLR_EL1_RSS_SHIFT: u32 = 18;
 pub const ICC_CTLR_EL1_A3V_SHIFT: u32 = 15;
 pub const ICC_CTLR_EL1_ID_BITS_SHIFT: u32 = 11;
 pub const ICC_CTLR_EL1_PRI_BITS_SHIFT: u32 = 8;
 
-pub fn icc_reg_name(addr: u32) -> Option<&'static str> {
+pub fn sys_reg_name(addr: u32) -> Option<&'static str> {
     match addr {
         SYSREG_ICC_IAR0_EL1 => Some("SYSREG_ICC_IAR0_EL1"),
         SYSREG_ICC_IAR1_EL1 => Some("SYSREG_ICC_IAR1_EL1"),
@@ -89,6 +100,17 @@ pub fn icc_reg_name(addr: u32) -> Option<&'static str> {
         SYSREG_ICC_PMR_EL1 => Some("SYSREG_ICC_PMR_EL1"),
         SYSREG_ICC_SGI1R_EL1 => Some("SYSREG_ICC_SGI1R_EL1"),
         SYSREG_ICC_SRE_EL1 => Some("SYSREG_ICC_SRE_EL1"),
+
+        SYSREG_CNTVOFF_EL2 => Some("SYSREG_CNTVOFF_EL2"),
+        SYSREG_CNTHCTL_EL2 => Some("SYSREG_CNTHCTL_EL2"),
+        SYSREG_CNTHP_TVAL_EL2 => Some("SYSREG_CNTHP_TVAL_EL2"),
+        SYSREG_CNTHP_CTL_EL2 => Some("SYSREG_CNTHP_CTL_EL2"),
+        SYSREG_CNTHP_CVAL_EL2 => Some("SYSREG_CNTHP_CVAL_EL2"),
+        SYSREG_CNTHV_TVAL_EL2 => Some("SYSREG_CNTHV_TVAL_EL2"),
+        SYSREG_CNTHV_CTL_EL2 => Some("SYSREG_CNTHV_CTL_EL2"),
+        SYSREG_CNTHV_CVAL_EL2 => Some("SYSREG_CNTHV_CVAL_EL2"),
+
+        SYSREG_LORC_EL1 => Some("SYSREG_LORC_EL1"),
         _ => None,
     }
 }

src/devices/src/fdt.rs

@@ -286,7 +286,10 @@ fn create_psci_node(fdt: &mut FdtWriter) -> Result<()> {
     // Two methods available: hvc and smc.
     // As per documentation, PSCI calls between a guest and hypervisor may use the HVC conduit instead of SMC.
     // So, since we are using kvm, we need to use hvc.
+    #[cfg(target_os = "linux")]
     fdt.property_string("method", "hvc")?;
+    #[cfg(target_os = "macos")]
+    fdt.property_string("method", "smc")?;
     fdt.end_node(node)?;
 
     Ok(())

src/devices/src/legacy/vcpu.rs

@@ -146,6 +146,7 @@ impl Vcpus for VcpuList {
         }
 
         match reg {
+            SYSREG_CNTHCTL_EL2 => Some(0),
             SYSREG_ICC_IAR1_EL1 => Some(
                 self.vcpus[vcpuid as usize]
                     .lock()
@@ -206,12 +207,14 @@ impl Vcpus for VcpuList {
 
                 true
             }
-            SYSREG_ICC_EOIR1_EL1
+            SYSREG_CNTHCTL_EL2
+            | SYSREG_ICC_EOIR1_EL1
             | SYSREG_ICC_IGRPEN1_EL1
             | SYSREG_ICC_PMR_EL1
             | SYSREG_ICC_BPR1_EL1
             | SYSREG_ICC_CTLR_EL1
             | SYSREG_ICC_AP1R0_EL1
+            | SYSREG_LORC_EL1
             | SYSREG_OSLAR_EL1
             | SYSREG_OSDLR_EL1 => true,
             _ => false,