From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-21.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E296AC64E75 for ; Thu, 26 Nov 2020 15:54:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9309E21D40 for ; Thu, 26 Nov 2020 15:54:42 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="dbbWmaFG" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391323AbgKZPya (ORCPT ); Thu, 26 Nov 2020 10:54:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730181AbgKZPy3 (ORCPT ); Thu, 26 Nov 2020 10:54:29 -0500 Received: from mail-wr1-x441.google.com (mail-wr1-x441.google.com [IPv6:2a00:1450:4864:20::441]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE913C0613D4 for ; Thu, 26 Nov 2020 07:54:27 -0800 (PST) Received: by mail-wr1-x441.google.com with SMTP id e7so2640154wrv.6 for ; Thu, 26 Nov 2020 07:54:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=PYeJaSm88hY1OXHAOwbtBVxKGHgJPc5mwzbhhlyynEE=; b=dbbWmaFGzmEM/5ruz4/Z+DeG8I1QJ3E7BZZIUlz04xlmm5mpXCXyDNZuQEBkdhMaMl AS/3kbrq6ApEJVDa1EWQ7GE3Zv+43ZDFCu8ZgL6c2in1kkmdfc3Xfb56Nbw+I4tyzZ0d cZfOb5fGLtaLONRw5bxxovN0HifciY0MSOOaqB8tHbaiNFVZgbyB68yI7gdIxEcwWDkU vwfFPgrG7LFDXj1G/CIUMjwKu5AxT/h9i6BiTmLEmW3vf6euE0U8dVUGZT6nIdsbJnQD pwVKLM8IK4mJUYQTOBDyoBAyy+P1dvspXdNdJiZdnyOnj3LkxIwHH6CqJof5p6AlYAxA GNsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=PYeJaSm88hY1OXHAOwbtBVxKGHgJPc5mwzbhhlyynEE=; b=jj4GZ0DT135CUekbK7g19GM/Tugo0dw0DqaCOIfzNRJMuECymELEg3GCGUuw5Hta/0 zF3sOq+SQpXfYeBPbCR2HrG/n0CSr4Qavxxsdbjzw11bSYlQss5dYr/MfS+W34AMfkHY TJQLoePSnA1e8zFg01h48GCm6wYK/w2IlZEBMCmXZqsZQVwybuDJ9s8QpsiD4IPuJv5W 2rMrySfrGjau8+rlHROjZtnJTvJ9RPwo+ZWkahqh4QlNGjvmrUIJTHZa+dhlq8WrPsJK WEQjav/dvuqltnOnom16DrPyjFTtQg5QM/1IXUB72l+wyeYw5TwEo/8eIdvyu52SyqO0 bwcw== X-Gm-Message-State: AOAM530ptSjdRcb5bSLP7eRaodMf5UV3NtXYeDC2Qgymnma55SlhZofe ywWpasuRE6XC8JYTbs0SopWSQg== X-Google-Smtp-Source: ABdhPJw48M5ZmOT1FESI9opelMUihSUq3ZOHJRFXfPns+z2bHZ7YU5uZ5kH5mgL1y3kcqmMB5aOkvw== X-Received: by 2002:a5d:5604:: with SMTP id l4mr4564625wrv.127.1606406066449; Thu, 26 Nov 2020 07:54:26 -0800 (PST) Received: from localhost ([2a01:4b00:8523:2d03:f008:704d:8d4b:9951]) by smtp.gmail.com with ESMTPSA id r21sm9938901wrc.16.2020.11.26.07.54.24 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 26 Nov 2020 07:54:25 -0800 (PST) From: David Brazdil To: kvmarm@lists.cs.columbia.edu Cc: Jonathan Corbet , Catalin Marinas , Will Deacon , Marc Zyngier , James Morse , Julien Thierry , Suzuki K Poulose , Dennis Zhou , Tejun Heo , Christoph Lameter , Mark Rutland , Lorenzo Pieralisi , Sudeep Holla , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kernel-team@android.com, David Brazdil Subject: [PATCH v3 00/23] Opt-in always-on nVHE hypervisor Date: Thu, 26 Nov 2020 15:53:58 +0000 Message-Id: <20201126155421.14901-1-dbrazdil@google.com> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org As we progress towards being able to keep guest state private to the host running nVHE hypervisor, this series allows the hypervisor to install itself on newly booted CPUs before the host is allowed to run on them. All functionality described below is opt-in, guarded by an early param 'kvm-arm.protected'. Future patches specific to the new "protected" mode should be hidden behind the same param. The hypervisor starts trapping host SMCs and intercepting host's PSCI CPU_ON/SUSPEND calls. It replaces the host's entry point with its own, initializes the EL2 state of the new CPU and installs the nVHE hyp vector before ERETing to the host's entry point. The kernel checks new cores' features against the finalized system capabilities. To avoid the need to move this code/data to EL2, the implementation only allows to boot cores that were online at the time of KVM initialization and therefore had been checked already. Other PSCI SMCs are forwarded to EL3, though only the known set of SMCs implemented in the kernel is allowed. Non-PSCI SMCs are also forwarded to EL3. Future changes will need to ensure the safety of all SMCs wrt. private guests. The host is still allowed to reset EL2 back to the stub vector, eg. for hibernation or kexec, but will not disable nVHE when there are no VMs. Tested on Rock Pi 4B, based on kvmarm/queue, itself on top of 5.10-rc4. Patches also available at: https://android-kvm.googlesource.com/linux topic/psci-on-master_v3 changes since v2: * avoid non-spec error in CPU_SUSPEND * refuse to init without PSCI * compute hyp VA args of hyp-init in hyp instead of using params struct * use hyp_symbol_addr in per-cpu calls * simplify memory.h/sysreg.h includes * rebase on kvmarm/queue, use trap handler args macros changes since v1: * early param sets a capability instead of a static key * assume SMCCC v1.2 for host SMC forwarding * fix reserved SMC ID range for PSCI * split init_el2_state into smaller macros, move to el2_setup.h * many small cleanups changes since RFC: * add early param to make features opt-in * simplify CPU_ON/SUSPEND implementation * replace spinlocks with CAS atomic * make cpu_logical_map ro_after_init David Brazdil (23): psci: Support psci_ops.get_version for v0.1 psci: Accessor for configured PSCI function IDs arm64: Make cpu_logical_map() take unsigned int arm64: Move MAIR_EL1_SET to asm/memory.h arm64: Extract parts of el2_setup into a macro kvm: arm64: Add kvm-arm.protected early kernel parameter kvm: arm64: Initialize MAIR_EL2 using a constant kvm: arm64: Remove vector_ptr param of hyp-init kvm: arm64: Move hyp-init params to a per-CPU struct kvm: arm64: Add .hyp.data..ro_after_init ELF section kvm: arm64: Support per_cpu_ptr in nVHE hyp code kvm: arm64: Create nVHE copy of cpu_logical_map kvm: arm64: Add SMC handler in nVHE EL2 kvm: arm64: Bootstrap PSCI SMC handler in nVHE EL2 kvm: arm64: Add offset for hyp VA <-> PA conversion kvm: arm64: Forward safe PSCI SMCs coming from host kvm: arm64: Extract __do_hyp_init into a helper function kvm: arm64: Add function to enter host from KVM nVHE hyp code kvm: arm64: Intercept host's CPU_ON SMCs kvm: arm64: Intercept host's CPU_SUSPEND PSCI SMCs kvm: arm64: Keep nVHE EL2 vector installed kvm: arm64: Trap host SMCs in protected mode kvm: arm64: Fix EL2 mode availability checks .../admin-guide/kernel-parameters.txt | 5 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/el2_setup.h | 182 +++++++++++ arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_asm.h | 8 +- arch/arm64/include/asm/kvm_hyp.h | 4 +- arch/arm64/include/asm/kvm_mmu.h | 26 +- arch/arm64/include/asm/memory.h | 13 + arch/arm64/include/asm/percpu.h | 6 + arch/arm64/include/asm/sections.h | 1 + arch/arm64/include/asm/smp.h | 4 +- arch/arm64/include/asm/virt.h | 26 ++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 29 ++ arch/arm64/kernel/head.S | 144 +-------- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/setup.c | 2 +- arch/arm64/kernel/vmlinux.lds.S | 10 + arch/arm64/kvm/arm.c | 101 ++++-- .../arm64/kvm/hyp/include/nvhe/trap_handler.h | 18 ++ arch/arm64/kvm/hyp/nvhe/Makefile | 3 +- arch/arm64/kvm/hyp/nvhe/host.S | 47 +++ arch/arm64/kvm/hyp/nvhe/hyp-init.S | 97 +++++- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 45 ++- arch/arm64/kvm/hyp/nvhe/hyp-smp.c | 40 +++ arch/arm64/kvm/hyp/nvhe/hyp.lds.S | 1 + arch/arm64/kvm/hyp/nvhe/psci-relay.c | 296 ++++++++++++++++++ arch/arm64/kvm/hyp/nvhe/switch.c | 5 +- arch/arm64/kvm/va_layout.c | 30 +- arch/arm64/mm/proc.S | 15 +- drivers/firmware/psci/psci.c | 23 +- include/linux/psci.h | 10 + 32 files changed, 999 insertions(+), 202 deletions(-) create mode 100644 arch/arm64/include/asm/el2_setup.h create mode 100644 arch/arm64/kvm/hyp/include/nvhe/trap_handler.h create mode 100644 arch/arm64/kvm/hyp/nvhe/hyp-smp.c create mode 100644 arch/arm64/kvm/hyp/nvhe/psci-relay.c -- 2.29.2.454.gaff20da3a2-goog From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A81BCC63697 for ; Thu, 26 Nov 2020 15:54:35 +0000 (UTC) Received: from mm01.cs.columbia.edu (mm01.cs.columbia.edu [128.59.11.253]) by mail.kernel.org (Postfix) with ESMTP id 153CF21D7E for ; Thu, 26 Nov 2020 15:54:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="dbbWmaFG" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 153CF21D7E Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvmarm-bounces@lists.cs.columbia.edu Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id B710A4B914; Thu, 26 Nov 2020 10:54:34 -0500 (EST) X-Virus-Scanned: at lists.cs.columbia.edu Authentication-Results: mm01.cs.columbia.edu (amavisd-new); dkim=softfail (fail, message has been altered) header.i=@google.com Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fXQXR1g1qVeP; Thu, 26 Nov 2020 10:54:33 -0500 (EST) Received: from mm01.cs.columbia.edu (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 3F1464BEC3; Thu, 26 Nov 2020 10:54:32 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id E55CE4BAFE for ; Thu, 26 Nov 2020 10:54:30 -0500 (EST) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PBUM8G9JDG9y for ; Thu, 26 Nov 2020 10:54:29 -0500 (EST) Received: from mail-wr1-f66.google.com (mail-wr1-f66.google.com [209.85.221.66]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id 853E04B5D3 for ; Thu, 26 Nov 2020 10:54:29 -0500 (EST) Received: by mail-wr1-f66.google.com with SMTP id e7so2640242wrv.6 for ; Thu, 26 Nov 2020 07:54:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=PYeJaSm88hY1OXHAOwbtBVxKGHgJPc5mwzbhhlyynEE=; b=dbbWmaFGzmEM/5ruz4/Z+DeG8I1QJ3E7BZZIUlz04xlmm5mpXCXyDNZuQEBkdhMaMl AS/3kbrq6ApEJVDa1EWQ7GE3Zv+43ZDFCu8ZgL6c2in1kkmdfc3Xfb56Nbw+I4tyzZ0d cZfOb5fGLtaLONRw5bxxovN0HifciY0MSOOaqB8tHbaiNFVZgbyB68yI7gdIxEcwWDkU vwfFPgrG7LFDXj1G/CIUMjwKu5AxT/h9i6BiTmLEmW3vf6euE0U8dVUGZT6nIdsbJnQD pwVKLM8IK4mJUYQTOBDyoBAyy+P1dvspXdNdJiZdnyOnj3LkxIwHH6CqJof5p6AlYAxA GNsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=PYeJaSm88hY1OXHAOwbtBVxKGHgJPc5mwzbhhlyynEE=; b=ZwQy4RIY/vkcWTbj2WfTmso9h6H+zAQo7PZxY7ok+lWqOlIOnPhOXGmKhbPjhKxLAG LzcJKxpzRSLRdWROYVklvkZGDGCu/Ja79yAX6W/xcf+PjflQRTU5o0Id8Mj9TCwAWnIy lMg27b5+rD+O7izrwuDcfDWn8vyzALkly7cNDrDv2rrbIfoj16iZkSJDK0TQ9ICdzIQV 0RkIwzEdiwqhuVLdd0WUpdOvFhPt7QpqdqG89h5wi5qw9GQ1GPWSm9AaXhKH6KZbsk1V rQgBN8VR9XPTgYtDWNRO3GkaoORPzEduqOkb8NmUYyNekW2y7FuZuQza6jsFPkiYRTRt nAqA== X-Gm-Message-State: AOAM533SAjtLHxbxnCgpmKOrN49wCXebpJLT7vJBzTaRPG5QYa1zzTZW jlPFz4QJOJjm7dpr8zksFtXazQCsc2MIWgWv X-Google-Smtp-Source: ABdhPJw48M5ZmOT1FESI9opelMUihSUq3ZOHJRFXfPns+z2bHZ7YU5uZ5kH5mgL1y3kcqmMB5aOkvw== X-Received: by 2002:a5d:5604:: with SMTP id l4mr4564625wrv.127.1606406066449; Thu, 26 Nov 2020 07:54:26 -0800 (PST) Received: from localhost ([2a01:4b00:8523:2d03:f008:704d:8d4b:9951]) by smtp.gmail.com with ESMTPSA id r21sm9938901wrc.16.2020.11.26.07.54.24 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 26 Nov 2020 07:54:25 -0800 (PST) From: David Brazdil To: kvmarm@lists.cs.columbia.edu Subject: [PATCH v3 00/23] Opt-in always-on nVHE hypervisor Date: Thu, 26 Nov 2020 15:53:58 +0000 Message-Id: <20201126155421.14901-1-dbrazdil@google.com> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 Cc: Lorenzo Pieralisi , kernel-team@android.com, Jonathan Corbet , Catalin Marinas , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Sudeep Holla , linux-arm-kernel@lists.infradead.org, Marc Zyngier , Tejun Heo , Dennis Zhou , Christoph Lameter , Will Deacon X-BeenThere: kvmarm@lists.cs.columbia.edu X-Mailman-Version: 2.1.14 Precedence: list List-Id: Where KVM/ARM decisions are made List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu As we progress towards being able to keep guest state private to the host running nVHE hypervisor, this series allows the hypervisor to install itself on newly booted CPUs before the host is allowed to run on them. All functionality described below is opt-in, guarded by an early param 'kvm-arm.protected'. Future patches specific to the new "protected" mode should be hidden behind the same param. The hypervisor starts trapping host SMCs and intercepting host's PSCI CPU_ON/SUSPEND calls. It replaces the host's entry point with its own, initializes the EL2 state of the new CPU and installs the nVHE hyp vector before ERETing to the host's entry point. The kernel checks new cores' features against the finalized system capabilities. To avoid the need to move this code/data to EL2, the implementation only allows to boot cores that were online at the time of KVM initialization and therefore had been checked already. Other PSCI SMCs are forwarded to EL3, though only the known set of SMCs implemented in the kernel is allowed. Non-PSCI SMCs are also forwarded to EL3. Future changes will need to ensure the safety of all SMCs wrt. private guests. The host is still allowed to reset EL2 back to the stub vector, eg. for hibernation or kexec, but will not disable nVHE when there are no VMs. Tested on Rock Pi 4B, based on kvmarm/queue, itself on top of 5.10-rc4. Patches also available at: https://android-kvm.googlesource.com/linux topic/psci-on-master_v3 changes since v2: * avoid non-spec error in CPU_SUSPEND * refuse to init without PSCI * compute hyp VA args of hyp-init in hyp instead of using params struct * use hyp_symbol_addr in per-cpu calls * simplify memory.h/sysreg.h includes * rebase on kvmarm/queue, use trap handler args macros changes since v1: * early param sets a capability instead of a static key * assume SMCCC v1.2 for host SMC forwarding * fix reserved SMC ID range for PSCI * split init_el2_state into smaller macros, move to el2_setup.h * many small cleanups changes since RFC: * add early param to make features opt-in * simplify CPU_ON/SUSPEND implementation * replace spinlocks with CAS atomic * make cpu_logical_map ro_after_init David Brazdil (23): psci: Support psci_ops.get_version for v0.1 psci: Accessor for configured PSCI function IDs arm64: Make cpu_logical_map() take unsigned int arm64: Move MAIR_EL1_SET to asm/memory.h arm64: Extract parts of el2_setup into a macro kvm: arm64: Add kvm-arm.protected early kernel parameter kvm: arm64: Initialize MAIR_EL2 using a constant kvm: arm64: Remove vector_ptr param of hyp-init kvm: arm64: Move hyp-init params to a per-CPU struct kvm: arm64: Add .hyp.data..ro_after_init ELF section kvm: arm64: Support per_cpu_ptr in nVHE hyp code kvm: arm64: Create nVHE copy of cpu_logical_map kvm: arm64: Add SMC handler in nVHE EL2 kvm: arm64: Bootstrap PSCI SMC handler in nVHE EL2 kvm: arm64: Add offset for hyp VA <-> PA conversion kvm: arm64: Forward safe PSCI SMCs coming from host kvm: arm64: Extract __do_hyp_init into a helper function kvm: arm64: Add function to enter host from KVM nVHE hyp code kvm: arm64: Intercept host's CPU_ON SMCs kvm: arm64: Intercept host's CPU_SUSPEND PSCI SMCs kvm: arm64: Keep nVHE EL2 vector installed kvm: arm64: Trap host SMCs in protected mode kvm: arm64: Fix EL2 mode availability checks .../admin-guide/kernel-parameters.txt | 5 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/el2_setup.h | 182 +++++++++++ arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_asm.h | 8 +- arch/arm64/include/asm/kvm_hyp.h | 4 +- arch/arm64/include/asm/kvm_mmu.h | 26 +- arch/arm64/include/asm/memory.h | 13 + arch/arm64/include/asm/percpu.h | 6 + arch/arm64/include/asm/sections.h | 1 + arch/arm64/include/asm/smp.h | 4 +- arch/arm64/include/asm/virt.h | 26 ++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 29 ++ arch/arm64/kernel/head.S | 144 +-------- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/setup.c | 2 +- arch/arm64/kernel/vmlinux.lds.S | 10 + arch/arm64/kvm/arm.c | 101 ++++-- .../arm64/kvm/hyp/include/nvhe/trap_handler.h | 18 ++ arch/arm64/kvm/hyp/nvhe/Makefile | 3 +- arch/arm64/kvm/hyp/nvhe/host.S | 47 +++ arch/arm64/kvm/hyp/nvhe/hyp-init.S | 97 +++++- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 45 ++- arch/arm64/kvm/hyp/nvhe/hyp-smp.c | 40 +++ arch/arm64/kvm/hyp/nvhe/hyp.lds.S | 1 + arch/arm64/kvm/hyp/nvhe/psci-relay.c | 296 ++++++++++++++++++ arch/arm64/kvm/hyp/nvhe/switch.c | 5 +- arch/arm64/kvm/va_layout.c | 30 +- arch/arm64/mm/proc.S | 15 +- drivers/firmware/psci/psci.c | 23 +- include/linux/psci.h | 10 + 32 files changed, 999 insertions(+), 202 deletions(-) create mode 100644 arch/arm64/include/asm/el2_setup.h create mode 100644 arch/arm64/kvm/hyp/include/nvhe/trap_handler.h create mode 100644 arch/arm64/kvm/hyp/nvhe/hyp-smp.c create mode 100644 arch/arm64/kvm/hyp/nvhe/psci-relay.c -- 2.29.2.454.gaff20da3a2-goog _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59269C63697 for ; Thu, 26 Nov 2020 15:56:28 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A3B7821D1A for ; Thu, 26 Nov 2020 15:56:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="tFVgvJQ2"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="dbbWmaFG" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A3B7821D1A Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=55qD0eHaP59uVXC+ZoAxdXI1UpR1XhX47908ZrW5mGU=; b=tFVgvJQ287q5U17wqTmUpUzxDK 96z2iBPIiG39M03FKIP70RU93A1h9Av6qae1b3A0hdGtvLUxOp2PhmQaTXulGH/ZItw+XPF69T84y PQy28ZupjkLsuUR4sgAMaavz3D18vtmzyXgWbRwnq0ox9Whl8RpHYm7XmebbqzP0w/IQS3I7UbnRn lufCUqwucO2JQpRdzrZYqDCWREl02SZ8hoxnEH+RkWcWoijUhb8zivgXxOQjK1qjYUzAlP4wcOoXl 7DQslC/BtP9PX1R0H1/bWujBBbZMJG/7bPbMam61+DnAu5WY79amRmWCU/vMP5eta3uq4mK6o2iMJ l5TYHw7Q==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kiJbM-0007f1-Mu; Thu, 26 Nov 2020 15:54:32 +0000 Received: from mail-wr1-x442.google.com ([2a00:1450:4864:20::442]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kiJbJ-0007dL-Oe for linux-arm-kernel@lists.infradead.org; Thu, 26 Nov 2020 15:54:30 +0000 Received: by mail-wr1-x442.google.com with SMTP id u12so2662744wrt.0 for ; Thu, 26 Nov 2020 07:54:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=PYeJaSm88hY1OXHAOwbtBVxKGHgJPc5mwzbhhlyynEE=; b=dbbWmaFGzmEM/5ruz4/Z+DeG8I1QJ3E7BZZIUlz04xlmm5mpXCXyDNZuQEBkdhMaMl AS/3kbrq6ApEJVDa1EWQ7GE3Zv+43ZDFCu8ZgL6c2in1kkmdfc3Xfb56Nbw+I4tyzZ0d cZfOb5fGLtaLONRw5bxxovN0HifciY0MSOOaqB8tHbaiNFVZgbyB68yI7gdIxEcwWDkU vwfFPgrG7LFDXj1G/CIUMjwKu5AxT/h9i6BiTmLEmW3vf6euE0U8dVUGZT6nIdsbJnQD pwVKLM8IK4mJUYQTOBDyoBAyy+P1dvspXdNdJiZdnyOnj3LkxIwHH6CqJof5p6AlYAxA GNsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=PYeJaSm88hY1OXHAOwbtBVxKGHgJPc5mwzbhhlyynEE=; b=hexJZ9OmO1al+SgbsEZGUrKdTUb9U6cEZA3u5JxLGtj+qIkP5bXyfOJJ6GIwfvhdSo wr1NB+ul13K7kFD0weCyYkVqtyz2WNIHeG56sig1ksyVC1pDfQtJGLTnQeTQ9t/NWhV+ 1x3vttOQipGkyzHoSwgoL/yw/Sgniz8Nk3c5yhJns2lAPlj/kNZGKWgHTqT0HGKhg+sO wdlgh8gWGCS3ds+hZnoka29GDjNH0d+ZTwibJul4BOTwhpvdTyJ70TCE77WL3AdsKrXD A7845w4tMv/FNqKdI9YWI6KNFDbupI16OSajRnouucYehNN1AM05gUAaky4Zc77StwEk gy0A== X-Gm-Message-State: AOAM5332N8uYk+ERqVXMoUA3Om4AfiWMFPztaTHMNijKJBHqkr/705iz BCD6GbZnjdC3uUCQiQ6ykFg87Q== X-Google-Smtp-Source: ABdhPJw48M5ZmOT1FESI9opelMUihSUq3ZOHJRFXfPns+z2bHZ7YU5uZ5kH5mgL1y3kcqmMB5aOkvw== X-Received: by 2002:a5d:5604:: with SMTP id l4mr4564625wrv.127.1606406066449; Thu, 26 Nov 2020 07:54:26 -0800 (PST) Received: from localhost ([2a01:4b00:8523:2d03:f008:704d:8d4b:9951]) by smtp.gmail.com with ESMTPSA id r21sm9938901wrc.16.2020.11.26.07.54.24 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 26 Nov 2020 07:54:25 -0800 (PST) From: David Brazdil To: kvmarm@lists.cs.columbia.edu Subject: [PATCH v3 00/23] Opt-in always-on nVHE hypervisor Date: Thu, 26 Nov 2020 15:53:58 +0000 Message-Id: <20201126155421.14901-1-dbrazdil@google.com> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201126_105429_869029_D41C2CFC X-CRM114-Status: GOOD ( 21.36 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Lorenzo Pieralisi , kernel-team@android.com, Jonathan Corbet , Catalin Marinas , Suzuki K Poulose , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Sudeep Holla , James Morse , linux-arm-kernel@lists.infradead.org, Marc Zyngier , Tejun Heo , Dennis Zhou , Christoph Lameter , David Brazdil , Will Deacon , Julien Thierry Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org As we progress towards being able to keep guest state private to the host running nVHE hypervisor, this series allows the hypervisor to install itself on newly booted CPUs before the host is allowed to run on them. All functionality described below is opt-in, guarded by an early param 'kvm-arm.protected'. Future patches specific to the new "protected" mode should be hidden behind the same param. The hypervisor starts trapping host SMCs and intercepting host's PSCI CPU_ON/SUSPEND calls. It replaces the host's entry point with its own, initializes the EL2 state of the new CPU and installs the nVHE hyp vector before ERETing to the host's entry point. The kernel checks new cores' features against the finalized system capabilities. To avoid the need to move this code/data to EL2, the implementation only allows to boot cores that were online at the time of KVM initialization and therefore had been checked already. Other PSCI SMCs are forwarded to EL3, though only the known set of SMCs implemented in the kernel is allowed. Non-PSCI SMCs are also forwarded to EL3. Future changes will need to ensure the safety of all SMCs wrt. private guests. The host is still allowed to reset EL2 back to the stub vector, eg. for hibernation or kexec, but will not disable nVHE when there are no VMs. Tested on Rock Pi 4B, based on kvmarm/queue, itself on top of 5.10-rc4. Patches also available at: https://android-kvm.googlesource.com/linux topic/psci-on-master_v3 changes since v2: * avoid non-spec error in CPU_SUSPEND * refuse to init without PSCI * compute hyp VA args of hyp-init in hyp instead of using params struct * use hyp_symbol_addr in per-cpu calls * simplify memory.h/sysreg.h includes * rebase on kvmarm/queue, use trap handler args macros changes since v1: * early param sets a capability instead of a static key * assume SMCCC v1.2 for host SMC forwarding * fix reserved SMC ID range for PSCI * split init_el2_state into smaller macros, move to el2_setup.h * many small cleanups changes since RFC: * add early param to make features opt-in * simplify CPU_ON/SUSPEND implementation * replace spinlocks with CAS atomic * make cpu_logical_map ro_after_init David Brazdil (23): psci: Support psci_ops.get_version for v0.1 psci: Accessor for configured PSCI function IDs arm64: Make cpu_logical_map() take unsigned int arm64: Move MAIR_EL1_SET to asm/memory.h arm64: Extract parts of el2_setup into a macro kvm: arm64: Add kvm-arm.protected early kernel parameter kvm: arm64: Initialize MAIR_EL2 using a constant kvm: arm64: Remove vector_ptr param of hyp-init kvm: arm64: Move hyp-init params to a per-CPU struct kvm: arm64: Add .hyp.data..ro_after_init ELF section kvm: arm64: Support per_cpu_ptr in nVHE hyp code kvm: arm64: Create nVHE copy of cpu_logical_map kvm: arm64: Add SMC handler in nVHE EL2 kvm: arm64: Bootstrap PSCI SMC handler in nVHE EL2 kvm: arm64: Add offset for hyp VA <-> PA conversion kvm: arm64: Forward safe PSCI SMCs coming from host kvm: arm64: Extract __do_hyp_init into a helper function kvm: arm64: Add function to enter host from KVM nVHE hyp code kvm: arm64: Intercept host's CPU_ON SMCs kvm: arm64: Intercept host's CPU_SUSPEND PSCI SMCs kvm: arm64: Keep nVHE EL2 vector installed kvm: arm64: Trap host SMCs in protected mode kvm: arm64: Fix EL2 mode availability checks .../admin-guide/kernel-parameters.txt | 5 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/el2_setup.h | 182 +++++++++++ arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_asm.h | 8 +- arch/arm64/include/asm/kvm_hyp.h | 4 +- arch/arm64/include/asm/kvm_mmu.h | 26 +- arch/arm64/include/asm/memory.h | 13 + arch/arm64/include/asm/percpu.h | 6 + arch/arm64/include/asm/sections.h | 1 + arch/arm64/include/asm/smp.h | 4 +- arch/arm64/include/asm/virt.h | 26 ++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 29 ++ arch/arm64/kernel/head.S | 144 +-------- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/setup.c | 2 +- arch/arm64/kernel/vmlinux.lds.S | 10 + arch/arm64/kvm/arm.c | 101 ++++-- .../arm64/kvm/hyp/include/nvhe/trap_handler.h | 18 ++ arch/arm64/kvm/hyp/nvhe/Makefile | 3 +- arch/arm64/kvm/hyp/nvhe/host.S | 47 +++ arch/arm64/kvm/hyp/nvhe/hyp-init.S | 97 +++++- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 45 ++- arch/arm64/kvm/hyp/nvhe/hyp-smp.c | 40 +++ arch/arm64/kvm/hyp/nvhe/hyp.lds.S | 1 + arch/arm64/kvm/hyp/nvhe/psci-relay.c | 296 ++++++++++++++++++ arch/arm64/kvm/hyp/nvhe/switch.c | 5 +- arch/arm64/kvm/va_layout.c | 30 +- arch/arm64/mm/proc.S | 15 +- drivers/firmware/psci/psci.c | 23 +- include/linux/psci.h | 10 + 32 files changed, 999 insertions(+), 202 deletions(-) create mode 100644 arch/arm64/include/asm/el2_setup.h create mode 100644 arch/arm64/kvm/hyp/include/nvhe/trap_handler.h create mode 100644 arch/arm64/kvm/hyp/nvhe/hyp-smp.c create mode 100644 arch/arm64/kvm/hyp/nvhe/psci-relay.c -- 2.29.2.454.gaff20da3a2-goog _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel