[RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Ard Biesheuvel]

KVM in nVHE mode divides up its VA space into two equal halves, and
picks the half that does not conflict with the HYP ID map to map its
linear region. This worked fine when the kernel's linear map itself was
guaranteed to cover precisely as many bits of VA space, but this was
changed by commit f4693c2716b35d08 ("arm64: mm: extend linear region for
52-bit VA configurations").

The result is that, depending on the placement of the ID map, kernel-VA
to hyp-VA translations may produce addresses that either conflict with
other HYP mappings (including the ID map itself) or generate addresses
outside of the 52-bit addressable range, neither of which is likely to
lead to anything useful.

Given that 52-bit capable cores are guaranteed to implement VHE, this
only affects configurations such as pKVM where we opt into non-VHE mode
even if the hardware is VHE capable. So just for these configurations,
let's limit the kernel linear map to 51 bits and work around the
problem.

Fixes:f4693c2716b35d08 ("arm64: mm: extend linear region for 52-bit VA configurations")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
NOTE: build tested only

 arch/arm64/mm/init.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 8490ed2917ff..542dad13e2fc 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
 
 void __init arm64_memblock_init(void)
 {
-	const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
+	s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
+
+	/*
+	 * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
+	 * be limited in their ability to support a linear map that exceeds 51
+	 * bits of VA space, depending on the placement of the ID map. Given
+	 * that the placement of the ID map may be randomized, let's simply
+	 * limit the kernel's linear map to 51 bits as well if we detect this
+	 * configuration.
+	 */
+	if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
+	    !is_kernel_in_hyp_mode()) {
+		pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
+		linear_region_size = BIT(51);
+	}
 
 	/* Handle linux,usable-memory-range property */
 	fdt_enforce_memory_region();
-- 
2.20.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Will Deacon]

On Tue, Aug 10, 2021 at 06:12:44PM +0200, Ard Biesheuvel wrote:
> KVM in nVHE mode divides up its VA space into two equal halves, and
> picks the half that does not conflict with the HYP ID map to map its
> linear region. This worked fine when the kernel's linear map itself was
> guaranteed to cover precisely as many bits of VA space, but this was
> changed by commit f4693c2716b35d08 ("arm64: mm: extend linear region for
> 52-bit VA configurations").
> 
> The result is that, depending on the placement of the ID map, kernel-VA
> to hyp-VA translations may produce addresses that either conflict with
> other HYP mappings (including the ID map itself) or generate addresses
> outside of the 52-bit addressable range, neither of which is likely to
> lead to anything useful.
> 
> Given that 52-bit capable cores are guaranteed to implement VHE, this
> only affects configurations such as pKVM where we opt into non-VHE mode
> even if the hardware is VHE capable. So just for these configurations,
> let's limit the kernel linear map to 51 bits and work around the
> problem.
> 
> Fixes:f4693c2716b35d08 ("arm64: mm: extend linear region for 52-bit VA configurations")
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> NOTE: build tested only
> 
>  arch/arm64/mm/init.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> index 8490ed2917ff..542dad13e2fc 100644
> --- a/arch/arm64/mm/init.c
> +++ b/arch/arm64/mm/init.c
> @@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
>  
>  void __init arm64_memblock_init(void)
>  {
> -	const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> +	s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> +
> +	/*
> +	 * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
> +	 * be limited in their ability to support a linear map that exceeds 51
> +	 * bits of VA space, depending on the placement of the ID map. Given
> +	 * that the placement of the ID map may be randomized, let's simply
> +	 * limit the kernel's linear map to 51 bits as well if we detect this
> +	 * configuration.
> +	 */
> +	if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
> +	    !is_kernel_in_hyp_mode()) {
> +		pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
> +		linear_region_size = BIT(51);
> +	}

Slight nit, but to avoid having to think about PAGE_END I think this would
be a little clearer as:

	if (IS_ENABLED(CONFIG_KVM) && !is_kernel_in_hyp_mode())
		linear_region_size = min_t(u64, linear_region_size, BIT(51));

Will

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Ard Biesheuvel]

On Tue, 24 Aug 2021 at 12:59, Will Deacon <will@kernel.org> wrote:
>
> On Tue, Aug 10, 2021 at 06:12:44PM +0200, Ard Biesheuvel wrote:
> > KVM in nVHE mode divides up its VA space into two equal halves, and
> > picks the half that does not conflict with the HYP ID map to map its
> > linear region. This worked fine when the kernel's linear map itself was
> > guaranteed to cover precisely as many bits of VA space, but this was
> > changed by commit f4693c2716b35d08 ("arm64: mm: extend linear region for
> > 52-bit VA configurations").
> >
> > The result is that, depending on the placement of the ID map, kernel-VA
> > to hyp-VA translations may produce addresses that either conflict with
> > other HYP mappings (including the ID map itself) or generate addresses
> > outside of the 52-bit addressable range, neither of which is likely to
> > lead to anything useful.
> >
> > Given that 52-bit capable cores are guaranteed to implement VHE, this
> > only affects configurations such as pKVM where we opt into non-VHE mode
> > even if the hardware is VHE capable. So just for these configurations,
> > let's limit the kernel linear map to 51 bits and work around the
> > problem.
> >
> > Fixes:f4693c2716b35d08 ("arm64: mm: extend linear region for 52-bit VA configurations")
> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > ---
> > NOTE: build tested only
> >
> >  arch/arm64/mm/init.c | 16 +++++++++++++++-
> >  1 file changed, 15 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> > index 8490ed2917ff..542dad13e2fc 100644
> > --- a/arch/arm64/mm/init.c
> > +++ b/arch/arm64/mm/init.c
> > @@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
> >
> >  void __init arm64_memblock_init(void)
> >  {
> > -     const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > +     s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > +
> > +     /*
> > +      * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
> > +      * be limited in their ability to support a linear map that exceeds 51
> > +      * bits of VA space, depending on the placement of the ID map. Given
> > +      * that the placement of the ID map may be randomized, let's simply
> > +      * limit the kernel's linear map to 51 bits as well if we detect this
> > +      * configuration.
> > +      */
> > +     if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
> > +         !is_kernel_in_hyp_mode()) {
> > +             pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
> > +             linear_region_size = BIT(51);
> > +     }
>
> Slight nit, but to avoid having to think about PAGE_END I think this would
> be a little clearer as:
>
>         if (IS_ENABLED(CONFIG_KVM) && !is_kernel_in_hyp_mode())
>                 linear_region_size = min_t(u64, linear_region_size, BIT(51));
>

Fair enough.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Catalin Marinas]

On Tue, Aug 24, 2021 at 02:56:22PM +0200, Ard Biesheuvel wrote:
> On Tue, 24 Aug 2021 at 12:59, Will Deacon <will@kernel.org> wrote:
> > On Tue, Aug 10, 2021 at 06:12:44PM +0200, Ard Biesheuvel wrote:
> > > diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> > > index 8490ed2917ff..542dad13e2fc 100644
> > > --- a/arch/arm64/mm/init.c
> > > +++ b/arch/arm64/mm/init.c
> > > @@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
> > >
> > >  void __init arm64_memblock_init(void)
> > >  {
> > > -     const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > > +     s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > > +
> > > +     /*
> > > +      * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
> > > +      * be limited in their ability to support a linear map that exceeds 51
> > > +      * bits of VA space, depending on the placement of the ID map. Given
> > > +      * that the placement of the ID map may be randomized, let's simply
> > > +      * limit the kernel's linear map to 51 bits as well if we detect this
> > > +      * configuration.
> > > +      */
> > > +     if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
> > > +         !is_kernel_in_hyp_mode()) {
> > > +             pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
> > > +             linear_region_size = BIT(51);
> > > +     }
> >
> > Slight nit, but to avoid having to think about PAGE_END I think this would
> > be a little clearer as:
> >
> >         if (IS_ENABLED(CONFIG_KVM) && !is_kernel_in_hyp_mode())
> >                 linear_region_size = min_t(u64, linear_region_size, BIT(51));
> >
> 
> Fair enough.

Ard, do you plan to post a new version? I can make the change myself
locally as well.

-- 
Catalin

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Ard Biesheuvel]

On Thu, 26 Aug 2021 at 14:16, Catalin Marinas <catalin.marinas@arm.com> wrote:
>
> On Tue, Aug 24, 2021 at 02:56:22PM +0200, Ard Biesheuvel wrote:
> > On Tue, 24 Aug 2021 at 12:59, Will Deacon <will@kernel.org> wrote:
> > > On Tue, Aug 10, 2021 at 06:12:44PM +0200, Ard Biesheuvel wrote:
> > > > diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> > > > index 8490ed2917ff..542dad13e2fc 100644
> > > > --- a/arch/arm64/mm/init.c
> > > > +++ b/arch/arm64/mm/init.c
> > > > @@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
> > > >
> > > >  void __init arm64_memblock_init(void)
> > > >  {
> > > > -     const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > > > +     s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > > > +
> > > > +     /*
> > > > +      * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
> > > > +      * be limited in their ability to support a linear map that exceeds 51
> > > > +      * bits of VA space, depending on the placement of the ID map. Given
> > > > +      * that the placement of the ID map may be randomized, let's simply
> > > > +      * limit the kernel's linear map to 51 bits as well if we detect this
> > > > +      * configuration.
> > > > +      */
> > > > +     if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
> > > > +         !is_kernel_in_hyp_mode()) {
> > > > +             pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
> > > > +             linear_region_size = BIT(51);
> > > > +     }
> > >
> > > Slight nit, but to avoid having to think about PAGE_END I think this would
> > > be a little clearer as:
> > >
> > >         if (IS_ENABLED(CONFIG_KVM) && !is_kernel_in_hyp_mode())
> > >                 linear_region_size = min_t(u64, linear_region_size, BIT(51));
> > >
> >
> > Fair enough.
>
> Ard, do you plan to post a new version? I can make the change myself
> locally as well.
>

If you don't mind doing so, please go ahead.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Catalin Marinas]

On Tue, Aug 24, 2021 at 11:59:20AM +0100, Will Deacon wrote:
> On Tue, Aug 10, 2021 at 06:12:44PM +0200, Ard Biesheuvel wrote:
> > KVM in nVHE mode divides up its VA space into two equal halves, and
> > picks the half that does not conflict with the HYP ID map to map its
> > linear region. This worked fine when the kernel's linear map itself was
> > guaranteed to cover precisely as many bits of VA space, but this was
> > changed by commit f4693c2716b35d08 ("arm64: mm: extend linear region for
> > 52-bit VA configurations").
> > 
> > The result is that, depending on the placement of the ID map, kernel-VA
> > to hyp-VA translations may produce addresses that either conflict with
> > other HYP mappings (including the ID map itself) or generate addresses
> > outside of the 52-bit addressable range, neither of which is likely to
> > lead to anything useful.
> > 
> > Given that 52-bit capable cores are guaranteed to implement VHE, this
> > only affects configurations such as pKVM where we opt into non-VHE mode
> > even if the hardware is VHE capable. So just for these configurations,
> > let's limit the kernel linear map to 51 bits and work around the
> > problem.
> > 
> > Fixes:f4693c2716b35d08 ("arm64: mm: extend linear region for 52-bit VA configurations")
> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > ---
> > NOTE: build tested only
> > 
> >  arch/arm64/mm/init.c | 16 +++++++++++++++-
> >  1 file changed, 15 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> > index 8490ed2917ff..542dad13e2fc 100644
> > --- a/arch/arm64/mm/init.c
> > +++ b/arch/arm64/mm/init.c
> > @@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
> >  
> >  void __init arm64_memblock_init(void)
> >  {
> > -	const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > +	s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > +
> > +	/*
> > +	 * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
> > +	 * be limited in their ability to support a linear map that exceeds 51
> > +	 * bits of VA space, depending on the placement of the ID map. Given
> > +	 * that the placement of the ID map may be randomized, let's simply
> > +	 * limit the kernel's linear map to 51 bits as well if we detect this
> > +	 * configuration.
> > +	 */
> > +	if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
> > +	    !is_kernel_in_hyp_mode()) {
> > +		pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
> > +		linear_region_size = BIT(51);
> > +	}
> 
> Slight nit, but to avoid having to think about PAGE_END I think this would
> be a little clearer as:
> 
> 	if (IS_ENABLED(CONFIG_KVM) && !is_kernel_in_hyp_mode())
> 		linear_region_size = min_t(u64, linear_region_size, BIT(51));

BTW, do we also need to check is_hyp_mode_available() (instead of just
CONFIG_KVM)? We don't need this reduction for a guest.

-- 
Catalin

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [RFC PATCH] arm64: mm: limit linear region to 51 bits for KVM in nVHE mode

[Ard Biesheuvel]

On Thu, 26 Aug 2021 at 15:31, Catalin Marinas <catalin.marinas@arm.com> wrote:
>
> On Tue, Aug 24, 2021 at 11:59:20AM +0100, Will Deacon wrote:
> > On Tue, Aug 10, 2021 at 06:12:44PM +0200, Ard Biesheuvel wrote:
> > > KVM in nVHE mode divides up its VA space into two equal halves, and
> > > picks the half that does not conflict with the HYP ID map to map its
> > > linear region. This worked fine when the kernel's linear map itself was
> > > guaranteed to cover precisely as many bits of VA space, but this was
> > > changed by commit f4693c2716b35d08 ("arm64: mm: extend linear region for
> > > 52-bit VA configurations").
> > >
> > > The result is that, depending on the placement of the ID map, kernel-VA
> > > to hyp-VA translations may produce addresses that either conflict with
> > > other HYP mappings (including the ID map itself) or generate addresses
> > > outside of the 52-bit addressable range, neither of which is likely to
> > > lead to anything useful.
> > >
> > > Given that 52-bit capable cores are guaranteed to implement VHE, this
> > > only affects configurations such as pKVM where we opt into non-VHE mode
> > > even if the hardware is VHE capable. So just for these configurations,
> > > let's limit the kernel linear map to 51 bits and work around the
> > > problem.
> > >
> > > Fixes:f4693c2716b35d08 ("arm64: mm: extend linear region for 52-bit VA configurations")
> > > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > > ---
> > > NOTE: build tested only
> > >
> > >  arch/arm64/mm/init.c | 16 +++++++++++++++-
> > >  1 file changed, 15 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> > > index 8490ed2917ff..542dad13e2fc 100644
> > > --- a/arch/arm64/mm/init.c
> > > +++ b/arch/arm64/mm/init.c
> > > @@ -282,7 +282,21 @@ static void __init fdt_enforce_memory_region(void)
> > >
> > >  void __init arm64_memblock_init(void)
> > >  {
> > > -   const s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > > +   s64 linear_region_size = PAGE_END - _PAGE_OFFSET(vabits_actual);
> > > +
> > > +   /*
> > > +    * Corner case: 52-bit VA capable systems running KVM in nVHE mode may
> > > +    * be limited in their ability to support a linear map that exceeds 51
> > > +    * bits of VA space, depending on the placement of the ID map. Given
> > > +    * that the placement of the ID map may be randomized, let's simply
> > > +    * limit the kernel's linear map to 51 bits as well if we detect this
> > > +    * configuration.
> > > +    */
> > > +   if (IS_ENABLED(CONFIG_KVM) && vabits_actual == 52 &&
> > > +       !is_kernel_in_hyp_mode()) {
> > > +           pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
> > > +           linear_region_size = BIT(51);
> > > +   }
> >
> > Slight nit, but to avoid having to think about PAGE_END I think this would
> > be a little clearer as:
> >
> >       if (IS_ENABLED(CONFIG_KVM) && !is_kernel_in_hyp_mode())
> >               linear_region_size = min_t(u64, linear_region_size, BIT(51));
>
> BTW, do we also need to check is_hyp_mode_available() (instead of just
> CONFIG_KVM)? We don't need this reduction for a guest.
>

Hmm, good point. I'll respin with both suggestions incorporated.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel