mbox series

[0/5] KVM: arm64: Restrict host hypercalls when pKVM is enabled

Message ID 20210923112256.15767-1-will@kernel.org (mailing list archive)
Headers show
Series KVM: arm64: Restrict host hypercalls when pKVM is enabled | expand

Message

Will Deacon Sept. 23, 2021, 11:22 a.m. UTC 
Hi folks,

This series restricts the hypercalls available to the KVM host on arm64
when pKVM is enabled so that it is not possible for the host to use them
to replace the EL2 component with something else.

This occurs in two stages: when switching to the pKVM vectors, the stub
hypercalls are removed and then later when pKVM is finalised, the pKVM
init hypercalls are removed.

There are still a few dubious calls remaining in terms of protecting the
guest (e.g. __kvm_adjust_pc) but these will be dealt with later when we
have more VM state at EL2 to play with.

Patches based on -rc2. Feedback welcome.

Cheers,

Will

Cc: Marc Zyngier <maz@kernel.org>
Cc: Quentin Perret <qperret@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: kvmarm@lists.cs.columbia.edu

--->8

Will Deacon (5):
  arm64: Prevent kexec and hibernation if is_protected_kvm_enabled()
  KVM: arm64: Reject stub hypercalls after pKVM has been initialised
  KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
  KVM: arm64: Prevent re-finalisation of pKVM for a given CPU
  KVM: arm64: Disable privileged hypercalls after pKVM finalisation

 arch/arm64/include/asm/kvm_asm.h      | 43 ++++++++++---------
 arch/arm64/kernel/smp.c               |  3 +-
 arch/arm64/kvm/arm.c                  | 61 ++++++++++++++++++---------
 arch/arm64/kvm/hyp/nvhe/host.S        | 26 ++++++++----
 arch/arm64/kvm/hyp/nvhe/hyp-main.c    | 26 +++++++-----
 arch/arm64/kvm/hyp/nvhe/mem_protect.c |  3 ++
 6 files changed, 103 insertions(+), 59 deletions(-)

Comments

Marc Zyngier Sept. 23, 2021, 12:21 p.m. UTC | #1 
On Thu, 23 Sep 2021 12:22:51 +0100,
Will Deacon <will@kernel.org> wrote:
> 
> Hi folks,
> 
> This series restricts the hypercalls available to the KVM host on arm64
> when pKVM is enabled so that it is not possible for the host to use them
> to replace the EL2 component with something else.
> 
> This occurs in two stages: when switching to the pKVM vectors, the stub
> hypercalls are removed and then later when pKVM is finalised, the pKVM
> init hypercalls are removed.
> 
> There are still a few dubious calls remaining in terms of protecting the
> guest (e.g. __kvm_adjust_pc) but these will be dealt with later when we
> have more VM state at EL2 to play with.

Yup. This particular one should have an equivalent at EL2 and pending
exceptions committed to the state before exiting to EL1.

	M.