From: Marc Zyngier <marc.zyngier@arm.com> To: linux-arm-kernel@lists.infradead.org, kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu Cc: Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will.deacon@arm.com> Subject: [PATCH v4 00/19] KVM/arm64: Randomise EL2 mappings Date: Thu, 4 Jan 2018 18:43:15 +0000 [thread overview] Message-ID: <20180104184334.16571-1-marc.zyngier@arm.com> (raw) Whilst KVM benefits from the kernel randomisation via KASLR, there is no additional randomisation when the kernel is running at EL1, as we directly use a fixed offset from the linear mapping. This is not necessarily a problem, but we could do a bit better by independently randomizing the HYP placement. This series proposes to randomise the offset by inserting a few random bits between the MSB of the RAM linear mapping and the top of the HYP VA (VA_BITS - 2). That's not a lot of random bits (on my Mustang, I get 13 bits), but that's better than nothing. In order to achieve this, we need to be able to patch dynamic values in the kernel text. This results in a bunch of changes to the alternative framework, the insn library, and a few more hacks in KVM itself (we get a new way to map the GIC at EL2). This series used to depend on a number of cleanups in asm-offsets, which is not the case anymore. I'm still including them as I think they are still pretty useful. This has been tested on the FVP model, Seattle (both 39 and 48bit VA), Mustang and Thunder-X. I've also done a sanity check on 32bit (which is only impacted by the HYP IO VA stuff). Thanks, M. * From v3: - Reworked the alternative code to leave the actual patching to the callback function. This should allow for more flexibility should someone or something require it - Now detects underflows in the IOVA allocator - Moved the VA patching code to va_layout.c * From v2: - Fixed a crapload of bugs in the immediate generation patch I now have a test harness for it, making sure it generates the same thing as GAS... - Fixed a bug in the asm-offsets.h exclusion patch - Reworked the alternative_cb code to be nicer and avoid generating pointless nops * From v1: - Now works correctly with KASLR - Dropped the callback field from alt_instr, and reuse one of the existing fields to store an offset to the callback - Fix HYP teardown path (depends on fixes previously posted) - Dropped the VA offset macros Marc Zyngier (19): arm64: asm-offsets: Avoid clashing DMA definitions arm64: asm-offsets: Remove unused definitions arm64: asm-offsets: Remove potential circular dependency arm64: alternatives: Enforce alignment of struct alt_instr arm64: alternatives: Add dynamic patching feature arm64: insn: Add N immediate encoding arm64: insn: Add encoder for bitwise operations using literals arm64: KVM: Dynamically patch the kernel/hyp VA mask arm64: cpufeatures: Drop the ARM64_HYP_OFFSET_LOW feature flag KVM: arm/arm64: Do not use kern_hyp_va() with kvm_vgic_global_state KVM: arm/arm64: Demote HYP VA range display to being a debug feature KVM: arm/arm64: Move ioremap calls to create_hyp_io_mappings KVM: arm/arm64: Keep GICv2 HYP VAs in kvm_vgic_global_state KVM: arm/arm64: Move HYP IO VAs to the "idmap" range arm64; insn: Add encoder for the EXTR instruction arm64: insn: Allow ADD/SUB (immediate) with LSL #12 arm64: KVM: Dynamically compute the HYP VA mask arm64: KVM: Introduce EL2 VA randomisation arm64: Update the KVM memory map documentation Documentation/arm64/memory.txt | 8 +- arch/arm/include/asm/kvm_hyp.h | 6 + arch/arm/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/alternative.h | 49 ++++++-- arch/arm64/include/asm/alternative_types.h | 17 +++ arch/arm64/include/asm/asm-offsets.h | 2 + arch/arm64/include/asm/cpucaps.h | 2 +- arch/arm64/include/asm/insn.h | 16 +++ arch/arm64/include/asm/kvm_hyp.h | 9 ++ arch/arm64/include/asm/kvm_mmu.h | 57 ++++----- arch/arm64/kernel/alternative.c | 43 +++++-- arch/arm64/kernel/asm-offsets.c | 17 +-- arch/arm64/kernel/cpufeature.c | 19 --- arch/arm64/kernel/insn.c | 190 ++++++++++++++++++++++++++++- arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/va_layout.c | 144 ++++++++++++++++++++++ arch/arm64/mm/cache.S | 4 +- include/kvm/arm_vgic.h | 12 +- virt/kvm/arm/hyp/vgic-v2-sr.c | 12 +- virt/kvm/arm/mmu.c | 95 +++++++++++---- virt/kvm/arm/vgic/vgic-init.c | 6 - virt/kvm/arm/vgic/vgic-v2.c | 40 ++---- 22 files changed, 589 insertions(+), 165 deletions(-) create mode 100644 arch/arm64/include/asm/alternative_types.h create mode 100644 arch/arm64/kvm/va_layout.c -- 2.14.2
WARNING: multiple messages have this Message-ID (diff)
From: marc.zyngier@arm.com (Marc Zyngier) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v4 00/19] KVM/arm64: Randomise EL2 mappings Date: Thu, 4 Jan 2018 18:43:15 +0000 [thread overview] Message-ID: <20180104184334.16571-1-marc.zyngier@arm.com> (raw) Whilst KVM benefits from the kernel randomisation via KASLR, there is no additional randomisation when the kernel is running at EL1, as we directly use a fixed offset from the linear mapping. This is not necessarily a problem, but we could do a bit better by independently randomizing the HYP placement. This series proposes to randomise the offset by inserting a few random bits between the MSB of the RAM linear mapping and the top of the HYP VA (VA_BITS - 2). That's not a lot of random bits (on my Mustang, I get 13 bits), but that's better than nothing. In order to achieve this, we need to be able to patch dynamic values in the kernel text. This results in a bunch of changes to the alternative framework, the insn library, and a few more hacks in KVM itself (we get a new way to map the GIC at EL2). This series used to depend on a number of cleanups in asm-offsets, which is not the case anymore. I'm still including them as I think they are still pretty useful. This has been tested on the FVP model, Seattle (both 39 and 48bit VA), Mustang and Thunder-X. I've also done a sanity check on 32bit (which is only impacted by the HYP IO VA stuff). Thanks, M. * From v3: - Reworked the alternative code to leave the actual patching to the callback function. This should allow for more flexibility should someone or something require it - Now detects underflows in the IOVA allocator - Moved the VA patching code to va_layout.c * From v2: - Fixed a crapload of bugs in the immediate generation patch I now have a test harness for it, making sure it generates the same thing as GAS... - Fixed a bug in the asm-offsets.h exclusion patch - Reworked the alternative_cb code to be nicer and avoid generating pointless nops * From v1: - Now works correctly with KASLR - Dropped the callback field from alt_instr, and reuse one of the existing fields to store an offset to the callback - Fix HYP teardown path (depends on fixes previously posted) - Dropped the VA offset macros Marc Zyngier (19): arm64: asm-offsets: Avoid clashing DMA definitions arm64: asm-offsets: Remove unused definitions arm64: asm-offsets: Remove potential circular dependency arm64: alternatives: Enforce alignment of struct alt_instr arm64: alternatives: Add dynamic patching feature arm64: insn: Add N immediate encoding arm64: insn: Add encoder for bitwise operations using literals arm64: KVM: Dynamically patch the kernel/hyp VA mask arm64: cpufeatures: Drop the ARM64_HYP_OFFSET_LOW feature flag KVM: arm/arm64: Do not use kern_hyp_va() with kvm_vgic_global_state KVM: arm/arm64: Demote HYP VA range display to being a debug feature KVM: arm/arm64: Move ioremap calls to create_hyp_io_mappings KVM: arm/arm64: Keep GICv2 HYP VAs in kvm_vgic_global_state KVM: arm/arm64: Move HYP IO VAs to the "idmap" range arm64; insn: Add encoder for the EXTR instruction arm64: insn: Allow ADD/SUB (immediate) with LSL #12 arm64: KVM: Dynamically compute the HYP VA mask arm64: KVM: Introduce EL2 VA randomisation arm64: Update the KVM memory map documentation Documentation/arm64/memory.txt | 8 +- arch/arm/include/asm/kvm_hyp.h | 6 + arch/arm/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/alternative.h | 49 ++++++-- arch/arm64/include/asm/alternative_types.h | 17 +++ arch/arm64/include/asm/asm-offsets.h | 2 + arch/arm64/include/asm/cpucaps.h | 2 +- arch/arm64/include/asm/insn.h | 16 +++ arch/arm64/include/asm/kvm_hyp.h | 9 ++ arch/arm64/include/asm/kvm_mmu.h | 57 ++++----- arch/arm64/kernel/alternative.c | 43 +++++-- arch/arm64/kernel/asm-offsets.c | 17 +-- arch/arm64/kernel/cpufeature.c | 19 --- arch/arm64/kernel/insn.c | 190 ++++++++++++++++++++++++++++- arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/va_layout.c | 144 ++++++++++++++++++++++ arch/arm64/mm/cache.S | 4 +- include/kvm/arm_vgic.h | 12 +- virt/kvm/arm/hyp/vgic-v2-sr.c | 12 +- virt/kvm/arm/mmu.c | 95 +++++++++++---- virt/kvm/arm/vgic/vgic-init.c | 6 - virt/kvm/arm/vgic/vgic-v2.c | 40 ++---- 22 files changed, 589 insertions(+), 165 deletions(-) create mode 100644 arch/arm64/include/asm/alternative_types.h create mode 100644 arch/arm64/kvm/va_layout.c -- 2.14.2
next reply other threads:[~2018-01-04 18:43 UTC|newest] Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-01-04 18:43 Marc Zyngier [this message] 2018-01-04 18:43 ` [PATCH v4 00/19] KVM/arm64: Randomise EL2 mappings Marc Zyngier 2018-01-04 18:43 ` [PATCH v4 01/19] arm64: asm-offsets: Avoid clashing DMA definitions Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-04 18:43 ` [PATCH v4 02/19] arm64: asm-offsets: Remove unused definitions Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-04 18:43 ` [PATCH v4 03/19] arm64: asm-offsets: Remove potential circular dependency Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 8:34 ` Christoffer Dall 2018-01-15 8:34 ` Christoffer Dall 2018-01-15 8:42 ` Marc Zyngier 2018-01-15 8:42 ` Marc Zyngier 2018-01-15 9:46 ` Christoffer Dall 2018-01-15 9:46 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 04/19] arm64: alternatives: Enforce alignment of struct alt_instr Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 9:11 ` Christoffer Dall 2018-01-15 9:11 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 05/19] arm64: alternatives: Add dynamic patching feature Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 11:26 ` Christoffer Dall 2018-01-15 11:26 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 06/19] arm64: insn: Add N immediate encoding Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 11:26 ` Christoffer Dall 2018-01-15 11:26 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 07/19] arm64: insn: Add encoder for bitwise operations using literals Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 11:26 ` Christoffer Dall 2018-01-15 11:26 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 08/19] arm64: KVM: Dynamically patch the kernel/hyp VA mask Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 11:47 ` Christoffer Dall 2018-01-15 11:47 ` Christoffer Dall 2018-02-15 13:11 ` Marc Zyngier 2018-02-15 13:11 ` Marc Zyngier 2018-02-16 9:02 ` Christoffer Dall 2018-02-16 9:02 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 09/19] arm64: cpufeatures: Drop the ARM64_HYP_OFFSET_LOW feature flag Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 11:48 ` Christoffer Dall 2018-01-15 11:48 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 10/19] KVM: arm/arm64: Do not use kern_hyp_va() with kvm_vgic_global_state Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 15:36 ` Christoffer Dall 2018-01-15 15:36 ` Christoffer Dall 2018-02-15 13:22 ` Marc Zyngier 2018-02-15 13:22 ` Marc Zyngier 2018-02-16 9:05 ` Christoffer Dall 2018-02-16 9:05 ` Christoffer Dall 2018-02-16 9:33 ` Marc Zyngier 2018-02-16 9:33 ` Marc Zyngier 2018-02-19 14:39 ` Christoffer Dall 2018-02-19 14:39 ` Christoffer Dall 2018-02-20 11:40 ` Marc Zyngier 2018-02-20 11:40 ` Marc Zyngier 2018-01-04 18:43 ` [PATCH v4 11/19] KVM: arm/arm64: Demote HYP VA range display to being a debug feature Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 15:54 ` Christoffer Dall 2018-01-15 15:54 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 12/19] KVM: arm/arm64: Move ioremap calls to create_hyp_io_mappings Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-15 18:07 ` Christoffer Dall 2018-01-15 18:07 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 13/19] KVM: arm/arm64: Keep GICv2 HYP VAs in kvm_vgic_global_state Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 14:39 ` Christoffer Dall 2018-01-18 14:39 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 14/19] KVM: arm/arm64: Move HYP IO VAs to the "idmap" range Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 14:39 ` Christoffer Dall 2018-01-18 14:39 ` Christoffer Dall 2018-02-15 13:52 ` Marc Zyngier 2018-02-15 13:52 ` Marc Zyngier 2018-02-16 9:25 ` Christoffer Dall 2018-02-16 9:25 ` Christoffer Dall 2018-02-16 15:20 ` Marc Zyngier 2018-02-16 15:20 ` Marc Zyngier 2018-01-04 18:43 ` [PATCH v4 15/19] arm64; insn: Add encoder for the EXTR instruction Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 20:27 ` Christoffer Dall 2018-01-18 20:27 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 16/19] arm64: insn: Allow ADD/SUB (immediate) with LSL #12 Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 20:28 ` Christoffer Dall 2018-01-18 20:28 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 17/19] arm64: KVM: Dynamically compute the HYP VA mask Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 20:28 ` Christoffer Dall 2018-01-18 20:28 ` Christoffer Dall 2018-02-15 13:58 ` Marc Zyngier 2018-02-15 13:58 ` Marc Zyngier 2018-01-04 18:43 ` [PATCH v4 18/19] arm64: KVM: Introduce EL2 VA randomisation Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 20:28 ` Christoffer Dall 2018-01-18 20:28 ` Christoffer Dall 2018-02-15 15:32 ` Marc Zyngier 2018-02-15 15:32 ` Marc Zyngier 2018-02-16 9:33 ` Christoffer Dall 2018-02-16 9:33 ` Christoffer Dall 2018-01-04 18:43 ` [PATCH v4 19/19] arm64: Update the KVM memory map documentation Marc Zyngier 2018-01-04 18:43 ` Marc Zyngier 2018-01-18 20:28 ` Christoffer Dall 2018-01-18 20:28 ` Christoffer Dall
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180104184334.16571-1-marc.zyngier@arm.com \ --to=marc.zyngier@arm.com \ --cc=catalin.marinas@arm.com \ --cc=kvm@vger.kernel.org \ --cc=kvmarm@lists.cs.columbia.edu \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.