feat: add unmap page api

Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>

Author: andreiltd

src/hyperlight_common/src/arch/aarch64/layout.rs

@@ -6,6 +6,8 @@
 pub const SCRATCH_TOP_GVA: usize = 0x0000_ffff_ffff_dfff;
 pub const SNAPSHOT_PT_GVA_MIN: usize = 0x0000_8000_0000_0000;
 pub const SNAPSHOT_PT_GVA_MAX: usize = 0x0000_80ff_ffff_ffff;
+pub const VIRTQ_BUFFER_GVA_START: u64 = 0x0000_fc00_0000_0000;
+pub const VIRTQ_BUFFER_GVA_END: u64 = 0x0000_fd00_0000_0000;
 pub const SCRATCH_TOP_GPA: usize = 0x0000_000f_ffff_bfff;
 
 pub const IO_PAGE_GVA: u64 = 0x0000_ffff_ffff_e000;

src/hyperlight_common/src/arch/amd64/layout.rs

@@ -11,6 +11,8 @@
 pub const SCRATCH_TOP_GVA: usize = 0xffff_ffff_ffff_efff;
 pub const SNAPSHOT_PT_GVA_MIN: usize = 0xffff_8000_0000_0000;
 pub const SNAPSHOT_PT_GVA_MAX: usize = 0xffff_80ff_ffff_ffff;
+pub const VIRTQ_BUFFER_GVA_START: u64 = 0xffff_fc00_0000_0000;
+pub const VIRTQ_BUFFER_GVA_END: u64 = 0xffff_fd00_0000_0000;
 
 /// We assume 36-bit IPAs for now, since every amd64 processor
 /// supports at least 36 bits.  Almost all of them support at least 40

src/hyperlight_common/src/layout.rs

@@ -9,7 +9,8 @@ use core::num::{NonZeroU16, NonZeroUsize};
 mod arch;
 
 pub use arch::{
-    SCRATCH_TOP_GPA, SCRATCH_TOP_GVA, SNAPSHOT_PT_GVA_MAX, SNAPSHOT_PT_GVA_MIN, io_page,
+    SCRATCH_TOP_GPA, SCRATCH_TOP_GVA, SNAPSHOT_PT_GVA_MAX, SNAPSHOT_PT_GVA_MIN,
+    VIRTQ_BUFFER_GVA_END, VIRTQ_BUFFER_GVA_START, io_page,
 };
 
 use crate::virtq;
@@ -100,6 +101,21 @@ const _: () = {
     assert!(SCRATCH_TOP_H2G_POOL_PAGES_OFFSET == 0x60);
     assert!(SCRATCH_TOP_H2G_BUFFER_SIZE_OFFSET == 0x68);
     assert!(SCRATCH_TOP_EXN_STACK_OFFSET == 0x70);
+
+    assert!(VIRTQ_BUFFER_GVA_START < VIRTQ_BUFFER_GVA_END);
+    assert!((VIRTQ_BUFFER_GVA_START as usize).is_multiple_of(crate::vmem::PAGE_SIZE));
+    assert!((VIRTQ_BUFFER_GVA_END as usize).is_multiple_of(crate::vmem::PAGE_SIZE));
+    assert!(VIRTQ_BUFFER_GVA_START > SNAPSHOT_PT_GVA_MAX as u64);
+
+    #[cfg(target_arch = "x86_64")]
+    assert!(VIRTQ_BUFFER_GVA_START >> 47 == 0x1ffff);
+    #[cfg(target_arch = "x86_64")]
+    assert!((VIRTQ_BUFFER_GVA_END - 1) >> 47 == 0x1ffff);
+    #[cfg(target_arch = "aarch64")]
+    assert!(VIRTQ_BUFFER_GVA_END <= 1 << 48);
+
+    assert!(VIRTQ_BUFFER_GVA_END < scratch_base_gva(16 * 1024 * 1024 * 1024));
+    assert!((SCRATCH_TOP_GPA as u64) < VIRTQ_BUFFER_GVA_END - VIRTQ_BUFFER_GVA_START);
 };
 
 /// Exclusive upper GPA boundary for dynamic scratch allocations.
@@ -110,7 +126,7 @@ pub const fn scratch_allocator_limit_gpa() -> u64 {
 pub fn scratch_base_gpa(size: usize) -> u64 {
     (SCRATCH_TOP_GPA - size + 1) as u64
 }
-pub fn scratch_base_gva(size: usize) -> u64 {
+pub const fn scratch_base_gva(size: usize) -> u64 {
     (SCRATCH_TOP_GVA - size + 1) as u64
 }
 

src/hyperlight_guest/src/arch/aarch64/paging.rs

@@ -129,6 +129,33 @@ pub unsafe fn modify_mapping(
     }
 }
 
+/// Unmap one page and invalidate its translations.
+/// An absent page is skipped without allocating page tables.
+///
+/// # Safety
+/// `virt` must name an aligned 4 KiB page with no live views.
+/// Use initialized guest tables without contiguous hints and serialize table access.
+/// Keep paging controls stable. Every root accessing the page must share its leaf.
+pub unsafe fn unmap_page(virt: *mut u8) {
+    if virt_to_phys(virt as u64).next().is_none() {
+        return;
+    }
+
+    // SAFETY: The caller permits removing this present leaf across all accessing roots.
+    unsafe {
+        map_region(0, virt, vmem::PAGE_SIZE as u64, vmem::MappingKind::Unmapped);
+
+        core::arch::asm!(
+            "dsb ishst",
+            "tlbi vaae1is, {}",
+            "dsb ish",
+            "isb",
+            in(reg) (virt as u64 >> 12),
+            options(nostack, preserves_flags),
+        );
+    }
+}
+
 pub fn virt_to_phys(gva: vmem::VirtAddr) -> impl Iterator<Item = vmem::Mapping> {
     unsafe { vmem::virt_to_phys::<_>(GuestMappingOperations::new(), gva, 1) }
 }

src/hyperlight_guest/src/arch/amd64/paging.rs

@@ -144,6 +144,45 @@ pub unsafe fn modify_mapping(
     }
 }
 
+/// Unmap one page and invalidate its translations.
+/// An absent page is skipped without allocating page tables.
+///
+/// # Safety
+/// `virt` must name an aligned 4 KiB page with no live views.
+/// Use initialized four-level guest tables and serialize all page-table access.
+/// Keep paging controls stable. Every root accessing the page must share its leaf.
+pub unsafe fn unmap_page(virt: *mut u8) {
+    if virt_to_phys(virt as u64).next().is_none() {
+        return;
+    }
+
+    // SAFETY: The caller permits removing this present leaf.
+    unsafe { map_region(0, virt, vmem::PAGE_SIZE as u64, vmem::MappingKind::Unmapped) };
+
+    let cr4: u64;
+
+    // SAFETY: The initialized guest runs at CPL0 with stable paging controls.
+    unsafe { asm!("mov {}, cr4", out(reg) cr4, options(nostack, preserves_flags)) };
+
+    if cr4 & (1 << 17) == 0 {
+        // SAFETY: INVLPG invalidates the page without dereferencing its address.
+        unsafe { asm!("invlpg [{}]", in(reg) virt, options(nostack, preserves_flags)) };
+    } else {
+        // A PGE transition invalidates all PCIDs and globals.
+        // Intel SDM 5.10.4.1 and AMD APM 5.5.3 specify this.
+        // SAFETY: Only PGE changes, and CR4 is restored before guest code resumes.
+        unsafe {
+            asm!(
+                "mov cr4, {toggled}",
+                "mov cr4, {original}",
+                toggled = in(reg) (cr4 ^ (1 << 7)),
+                original = in(reg) cr4,
+                options(nostack, preserves_flags),
+            );
+        }
+    }
+}
+
 pub fn virt_to_phys(gva: vmem::VirtAddr) -> impl Iterator<Item = vmem::Mapping> {
     unsafe { vmem::virt_to_phys::<_>(GuestMappingOperations::new(), gva, 1) }
 }

src/hyperlight_guest/src/paging.rs

@@ -7,7 +7,7 @@
 #[cfg_attr(target_arch = "aarch64", path = "arch/aarch64/paging.rs")]
 mod arch;
 
-pub use arch::{map_region, modify_mapping, phys_to_virt, virt_to_phys};
+pub use arch::{map_region, modify_mapping, phys_to_virt, unmap_page, virt_to_phys};
 /// Barriers that other code may need to use when updating page tables
 pub mod barrier {
     /// Call this function when a virtual address has had its

src/hyperlight_guest_bin/src/arch/amd64/layout.rs

@@ -10,3 +10,8 @@
 /// a VA that will survive the snapshot process. Since we don't have a
 /// useful virtual allocator yet, we just put them here...
 pub const PROC_CONTROL_GVA: u64 = 0xffff_fd00_0000_0000;
+
+const _: () = assert!(
+    hyperlight_common::layout::VIRTQ_BUFFER_GVA_END <= PROC_CONTROL_GVA,
+    "transport aliases overlap processor control"
+);