[RFC PATCH v1 05/26] xen/arm/cca: track Realm-owned granules

[Koichiro Den <den@xxxxxxxxxxxxx>]

Track pages once ownership has moved from Xen to the RMM. Teardown uses
these records to hand them back in the right RMI order.

Signed-off-by: Koichiro Den <den@xxxxxxxxxxxxx>
---
 xen/arch/arm/cca/state.c       | 19 ++++++++++++++++
 xen/arch/arm/include/asm/cca.h | 40 ++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/xen/arch/arm/cca/state.c b/xen/arch/arm/cca/state.c
index a47d9cd7b6fd..66375965a1b4 100644
--- a/xen/arch/arm/cca/state.c
+++ b/xen/arch/arm/cca/state.c
@@ -10,17 +10,36 @@
 
 static void arm_cca_reset_domain_state(struct domain *d)
 {
+    unsigned int i;
+
     d->arch.cca.realm_active = false;
     d->arch.cca.rd = INVALID_PADDR;
     d->arch.cca.rmi_features0 = 0;
     d->arch.cca.rmi_features1 = 0;
+    d->arch.cca.rd_page = NULL;
+    d->arch.cca.rtt_root_page = NULL;
+    d->arch.cca.nr_realm_sro_pages = 0;
+    d->arch.cca.rtts = NULL;
+    d->arch.cca.nr_rtts = 0;
+    d->arch.cca.data_pages = NULL;
+    d->arch.cca.nr_data_pages = 0;
+
+    for ( i = 0; i < ARRAY_SIZE(d->arch.cca.realm_sro_pages); ++i )
+        d->arch.cca.realm_sro_pages[i] = NULL;
 }
 
 static void arm_cca_reset_vcpu_state(struct vcpu *v)
 {
+    unsigned int i;
+
     v->arch.cca.rec = INVALID_PADDR;
     v->arch.cca.run = NULL;
     v->arch.cca.run_pa = INVALID_PADDR;
+    v->arch.cca.rec_page = NULL;
+    v->arch.cca.nr_aux = 0;
+
+    for ( i = 0; i < ARRAY_SIZE(v->arch.cca.aux_pages); ++i )
+        v->arch.cca.aux_pages[i] = NULL;
 }
 
 void arm_cca_domain_init(struct domain *d)
diff --git a/xen/arch/arm/include/asm/cca.h b/xen/arch/arm/include/asm/cca.h
index 1be43327119e..6bf644fbcee5 100644
--- a/xen/arch/arm/include/asm/cca.h
+++ b/xen/arch/arm/include/asm/cca.h
@@ -14,20 +14,60 @@
  */
 #define ARM_CCA_MAX_REC_AUX 16U
 
+/*
+ * Xen implementation cap for pages accepted by one memory-transferring SRO,
+ * not an RMI architectural limit.  Switch to dynamic tracking if a real RMM
+ * needs more.
+ */
+#define ARM_CCA_MAX_SRO_DONATION_PAGES 64U
+
 struct domain;
 struct vcpu;
+struct page_info;
+
+struct arm_cca_rtt_record {
+    paddr_t ipa;
+    paddr_t pa;
+    unsigned int level;
+};
+
+struct arm_cca_data_page_record {
+    paddr_t ipa;
+    paddr_t pa;
+};
 
 struct arm_cca_domain_state {
     bool realm_active;
     paddr_t rd;
     unsigned long rmi_features0;
     unsigned long rmi_features1;
+
+    /*
+     * Host references for granules whose RMM state is no longer represented
+     * by Xen's page allocator alone.  They let relinquish complete the
+     * reverse DEN0137 2.0-bet1 A2.3.6 transitions before the pages are
+     * returned to Xen.
+     */
+    struct page_info *rd_page;
+    struct page_info *rtt_root_page;
+    struct page_info *realm_sro_pages[ARM_CCA_MAX_SRO_DONATION_PAGES];
+    unsigned int nr_realm_sro_pages;
+
+    struct arm_cca_rtt_record *rtts;
+    unsigned int nr_rtts;
+
+    struct arm_cca_data_page_record *data_pages;
+    unsigned long nr_data_pages;
 };
 
 struct arm_cca_vcpu_state {
     paddr_t rec;
     void *run;
     paddr_t run_pa;
+
+    struct page_info *rec_page;
+    struct page_info *aux_pages[ARM_CCA_MAX_REC_AUX];
+    unsigned int nr_aux;
 };
 
 void arm_cca_domain_init(struct domain *d);
-- 
2.51.0