From: Will Deacon <will@kernel.org>
To: kvmarm@lists.linux.dev
Cc: "Will Deacon" <will@kernel.org>,
"Sean Christopherson" <seanjc@google.com>,
"Vincent Donnefort" <vdonnefort@google.com>,
"Alexandru Elisei" <alexandru.elisei@arm.com>,
"Catalin Marinas" <catalin.marinas@arm.com>,
"Philippe Mathieu-Daudé" <philmd@linaro.org>,
"James Morse" <james.morse@arm.com>,
"Chao Peng" <chao.p.peng@linux.intel.com>,
"Quentin Perret" <qperret@google.com>,
"Suzuki K Poulose" <suzuki.poulose@arm.com>,
"Mark Rutland" <mark.rutland@arm.com>,
"Fuad Tabba" <tabba@google.com>,
"Oliver Upton" <oliver.upton@linux.dev>,
"Marc Zyngier" <maz@kernel.org>,
kernel-team@android.com, kvm@vger.kernel.org,
linux-arm-kernel@lists.infradead.org
Subject: [PATCH v6 21/26] KVM: arm64: Unmap 'kvm_arm_hyp_percpu_base' from the host
Date: Thu, 10 Nov 2022 19:02:54 +0000 [thread overview]
Message-ID: <20221110190259.26861-22-will@kernel.org> (raw)
In-Reply-To: <20221110190259.26861-1-will@kernel.org>
From: Quentin Perret <qperret@google.com>
When pKVM is enabled, the hypervisor at EL2 does not trust the host at
EL1 and must therefore prevent it from having unrestricted access to
internal hypervisor state.
The 'kvm_arm_hyp_percpu_base' array holds the offsets for hypervisor
per-cpu allocations, so move this this into the nVHE code where it
cannot be modified by the untrusted host at EL1.
Tested-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
---
arch/arm64/include/asm/kvm_asm.h | 4 ++--
arch/arm64/kernel/image-vars.h | 3 ---
arch/arm64/kvm/arm.c | 9 ++++-----
arch/arm64/kvm/hyp/nvhe/hyp-smp.c | 2 ++
4 files changed, 8 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index de52ba775d48..43c3bc0f9544 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -109,7 +109,7 @@ enum __kvm_host_smccc_func {
#define per_cpu_ptr_nvhe_sym(sym, cpu) \
({ \
unsigned long base, off; \
- base = kvm_arm_hyp_percpu_base[cpu]; \
+ base = kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu]; \
off = (unsigned long)&CHOOSE_NVHE_SYM(sym) - \
(unsigned long)&CHOOSE_NVHE_SYM(__per_cpu_start); \
base ? (typeof(CHOOSE_NVHE_SYM(sym))*)(base + off) : NULL; \
@@ -214,7 +214,7 @@ DECLARE_KVM_HYP_SYM(__kvm_hyp_vector);
#define __kvm_hyp_init CHOOSE_NVHE_SYM(__kvm_hyp_init)
#define __kvm_hyp_vector CHOOSE_HYP_SYM(__kvm_hyp_vector)
-extern unsigned long kvm_arm_hyp_percpu_base[NR_CPUS];
+extern unsigned long kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[];
DECLARE_KVM_NVHE_SYM(__per_cpu_start);
DECLARE_KVM_NVHE_SYM(__per_cpu_end);
diff --git a/arch/arm64/kernel/image-vars.h b/arch/arm64/kernel/image-vars.h
index 7f4e43bfaade..ae8f37f4aa8c 100644
--- a/arch/arm64/kernel/image-vars.h
+++ b/arch/arm64/kernel/image-vars.h
@@ -89,9 +89,6 @@ KVM_NVHE_ALIAS(gic_nonsecure_priorities);
KVM_NVHE_ALIAS(__start___kvm_ex_table);
KVM_NVHE_ALIAS(__stop___kvm_ex_table);
-/* Array containing bases of nVHE per-CPU memory regions. */
-KVM_NVHE_ALIAS(kvm_arm_hyp_percpu_base);
-
/* PMU available static key */
#ifdef CONFIG_HW_PERF_EVENTS
KVM_NVHE_ALIAS(kvm_arm_pmu_available);
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index f78eefa02f6b..25467f24803d 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -51,7 +51,6 @@ DEFINE_STATIC_KEY_FALSE(kvm_protected_mode_initialized);
DECLARE_KVM_HYP_PER_CPU(unsigned long, kvm_hyp_vector);
DEFINE_PER_CPU(unsigned long, kvm_arm_hyp_stack_page);
-unsigned long kvm_arm_hyp_percpu_base[NR_CPUS];
DECLARE_KVM_NVHE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params);
static bool vgic_present;
@@ -1857,13 +1856,13 @@ static void teardown_hyp_mode(void)
free_hyp_pgds();
for_each_possible_cpu(cpu) {
free_page(per_cpu(kvm_arm_hyp_stack_page, cpu));
- free_pages(kvm_arm_hyp_percpu_base[cpu], nvhe_percpu_order());
+ free_pages(kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu], nvhe_percpu_order());
}
}
static int do_pkvm_init(u32 hyp_va_bits)
{
- void *per_cpu_base = kvm_ksym_ref(kvm_arm_hyp_percpu_base);
+ void *per_cpu_base = kvm_ksym_ref(kvm_nvhe_sym(kvm_arm_hyp_percpu_base));
int ret;
preempt_disable();
@@ -1967,7 +1966,7 @@ static int init_hyp_mode(void)
page_addr = page_address(page);
memcpy(page_addr, CHOOSE_NVHE_SYM(__per_cpu_start), nvhe_percpu_size());
- kvm_arm_hyp_percpu_base[cpu] = (unsigned long)page_addr;
+ kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu] = (unsigned long)page_addr;
}
/*
@@ -2060,7 +2059,7 @@ static int init_hyp_mode(void)
}
for_each_possible_cpu(cpu) {
- char *percpu_begin = (char *)kvm_arm_hyp_percpu_base[cpu];
+ char *percpu_begin = (char *)kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu];
char *percpu_end = percpu_begin + nvhe_percpu_size();
/* Map Hyp percpu pages */
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-smp.c b/arch/arm64/kvm/hyp/nvhe/hyp-smp.c
index 9f54833af400..04d194583f1e 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-smp.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-smp.c
@@ -23,6 +23,8 @@ u64 cpu_logical_map(unsigned int cpu)
return hyp_cpu_logical_map[cpu];
}
+unsigned long __ro_after_init kvm_arm_hyp_percpu_base[NR_CPUS];
+
unsigned long __hyp_per_cpu_offset(unsigned int cpu)
{
unsigned long *cpu_base_array;
--
2.38.1.431.g37b22c650d-goog
next prev parent reply other threads:[~2022-11-10 19:04 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-10 19:02 [PATCH v6 00/26] KVM: arm64: Introduce pKVM hyp VM and vCPU state at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 01/26] KVM: arm64: Move hyp refcount manipulation helpers to common header file Will Deacon
2022-11-10 19:02 ` [PATCH v6 02/26] KVM: arm64: Allow attaching of non-coalescable pages to a hyp pool Will Deacon
2022-11-10 19:02 ` [PATCH v6 03/26] KVM: arm64: Back the hypervisor 'struct hyp_page' array for all memory Will Deacon
2022-11-10 19:02 ` [PATCH v6 04/26] KVM: arm64: Fix-up hyp stage-1 refcounts for all pages mapped at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 05/26] KVM: arm64: Unify identifiers used to distinguish host and hypervisor Will Deacon
2022-11-10 19:02 ` [PATCH v6 06/26] KVM: arm64: Implement do_donate() helper for donating memory Will Deacon
2022-11-10 19:02 ` [PATCH v6 07/26] KVM: arm64: Prevent the donation of no-map pages Will Deacon
2022-11-10 19:02 ` [PATCH v6 08/26] KVM: arm64: Add helpers to pin memory shared with the hypervisor at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 09/26] KVM: arm64: Include asm/kvm_mmu.h in nvhe/mem_protect.h Will Deacon
2022-11-10 19:02 ` [PATCH v6 10/26] KVM: arm64: Add hyp_spinlock_t static initializer Will Deacon
2022-11-10 19:02 ` [PATCH v6 11/26] KVM: arm64: Rename 'host_kvm' to 'host_mmu' Will Deacon
2022-11-10 19:02 ` [PATCH v6 12/26] KVM: arm64: Add infrastructure to create and track pKVM instances at EL2 Will Deacon
2022-11-11 17:11 ` Marc Zyngier
2022-11-10 19:02 ` [PATCH v6 13/26] KVM: arm64: Instantiate pKVM hypervisor VM and vCPU structures from EL1 Will Deacon
2022-11-10 19:02 ` [PATCH v6 14/26] KVM: arm64: Add per-cpu fixmap infrastructure at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 15/26] KVM: arm64: Initialise hypervisor copies of host symbols unconditionally Will Deacon
2022-11-10 19:02 ` [PATCH v6 16/26] KVM: arm64: Provide I-cache invalidation by virtual address at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 17/26] KVM: arm64: Add generic hyp_memcache helpers Will Deacon
2022-11-10 19:02 ` [PATCH v6 18/26] KVM: arm64: Consolidate stage-2 initialisation into a single function Will Deacon
2022-11-10 19:02 ` [PATCH v6 19/26] KVM: arm64: Instantiate guest stage-2 page-tables at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 20/26] KVM: arm64: Return guest memory from EL2 via dedicated teardown memcache Will Deacon
2022-11-10 19:02 ` Will Deacon [this message]
2022-11-10 19:02 ` [PATCH v6 22/26] KVM: arm64: Maintain a copy of 'kvm_arm_vmid_bits' at EL2 Will Deacon
2022-11-10 19:02 ` [PATCH v6 23/26] KVM: arm64: Explicitly map 'kvm_vgic_global_state' " Will Deacon
2022-11-10 19:02 ` [PATCH v6 24/26] KVM: arm64: Don't unnecessarily map host kernel sections " Will Deacon
2022-11-10 19:02 ` [PATCH v6 25/26] KVM: arm64: Clean out the odd handling of completer_addr Will Deacon
2022-11-10 19:02 ` [RFC PATCH v6 26/26] KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run() Will Deacon
2022-11-11 16:54 ` [PATCH v6 00/26] KVM: arm64: Introduce pKVM hyp VM and vCPU state at EL2 Marc Zyngier
2022-11-11 19:42 ` Oliver Upton
2022-11-14 18:19 ` Will Deacon
2022-11-11 19:06 ` Marc Zyngier
2022-11-11 20:08 ` Oliver Upton
2022-11-12 11:34 ` Marc Zyngier
2022-11-14 19:30 ` Will Deacon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221110190259.26861-22-will@kernel.org \
--to=will@kernel.org \
--cc=alexandru.elisei@arm.com \
--cc=catalin.marinas@arm.com \
--cc=chao.p.peng@linux.intel.com \
--cc=james.morse@arm.com \
--cc=kernel-team@android.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=oliver.upton@linux.dev \
--cc=philmd@linaro.org \
--cc=qperret@google.com \
--cc=seanjc@google.com \
--cc=suzuki.poulose@arm.com \
--cc=tabba@google.com \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).