From patchwork Thu Sep 23 11:22:51 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Will Deacon X-Patchwork-Id: 12512423 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8EAAC433F5 for ; Thu, 23 Sep 2021 11:25:17 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AC47B61107 for ; Thu, 23 Sep 2021 11:25:17 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org AC47B61107 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=NKPD5joaUQKkAgV7+iFb488/a96Ftzrzy9gOn0R8Cbs=; b=Tg3fG8iPcezQVe Uc9XJx8B3GO8k6K9fnz70y0dvIDX3QrPe/Q0h+T2EyCOxBHmEZAC7vGVz5OX0PjQZsLqQSdoBl6i5 JZyIlZz92Qrxq/nL4KzmTb/+uFyiaPTw4YcADdgX4zpz9ZIMn4hhpkzMc0TJbQ5HyufSTUn/fql/r uglEjxLUKOF2F9+EQ3NT/ypTFCV63c0MHWiTTH+rLSuSeN4DS4+8SpSWG/kt481ETWgMkfNTlZW+a F0Hs0VJh/T11SftdMou/BU7eyhFuscRw4rDRj4/XUo8jOIUW2b99nrqa0awmvG/4Lndj8hxIleRyz gx6dZfZEQ6LVNzaaBWnw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mTMok-00B4mt-V0; Thu, 23 Sep 2021 11:23:07 +0000 Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mTMoh-00B4lI-Co for linux-arm-kernel@lists.infradead.org; Thu, 23 Sep 2021 11:23:04 +0000 Received: by mail.kernel.org (Postfix) with ESMTPSA id 33FF860EC0; Thu, 23 Sep 2021 11:23:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1632396182; bh=Lf3j0RI6dBAAadEUBstWTKcsG6r3BLFrYbLMIIdq9rI=; h=From:To:Cc:Subject:Date:From; b=nX69TkQH8ABpT3mauT5UkvOP0zX03qI6KiAt1zfmGl2dsK10sAfCojDPznQwCx0Y8 nv+kBGyFQGzlfJQhPCEYLw7WRHhHNEZ669mpf4DvLA0BYw2YRYWRH1FRtdeQ9QLP8H py84L6nM+XyN6orHFTyWxaf1tL9A+8AvK0MFizcX3VpEnXgVSyf1TvATTPnUHMUXRL W3DeXBS+jD/jlDJFQEyCmx2Ge9U/jsw+Da8OV7oDTWfo/ots072ukRZpjl/ZbxKwd+ kt8QmM5H2iOCRhACtfQ1s+KoLJ4ngLbd8FpDNyB01FX4m3za/guuqFCcWdcPAa7bZF yhqd1oNjQDwHg== From: Will Deacon To: linux-arm-kernel@lists.infradead.org Cc: Will Deacon , Marc Zyngier , Quentin Perret , Catalin Marinas , Alexandru Elisei , Suzuki K Poulose , kvmarm@lists.cs.columbia.edu Subject: [PATCH 0/5] KVM: arm64: Restrict host hypercalls when pKVM is enabled Date: Thu, 23 Sep 2021 12:22:51 +0100 Message-Id: <20210923112256.15767-1-will@kernel.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210923_042303_498573_4DFFA724 X-CRM114-Status: UNSURE ( 9.92 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi folks, This series restricts the hypercalls available to the KVM host on arm64 when pKVM is enabled so that it is not possible for the host to use them to replace the EL2 component with something else. This occurs in two stages: when switching to the pKVM vectors, the stub hypercalls are removed and then later when pKVM is finalised, the pKVM init hypercalls are removed. There are still a few dubious calls remaining in terms of protecting the guest (e.g. __kvm_adjust_pc) but these will be dealt with later when we have more VM state at EL2 to play with. Patches based on -rc2. Feedback welcome. Cheers, Will Cc: Marc Zyngier Cc: Quentin Perret Cc: Catalin Marinas Cc: Alexandru Elisei Cc: Suzuki K Poulose Cc: kvmarm@lists.cs.columbia.edu --->8 Will Deacon (5): arm64: Prevent kexec and hibernation if is_protected_kvm_enabled() KVM: arm64: Reject stub hypercalls after pKVM has been initialised KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall KVM: arm64: Prevent re-finalisation of pKVM for a given CPU KVM: arm64: Disable privileged hypercalls after pKVM finalisation arch/arm64/include/asm/kvm_asm.h | 43 ++++++++++--------- arch/arm64/kernel/smp.c | 3 +- arch/arm64/kvm/arm.c | 61 ++++++++++++++++++--------- arch/arm64/kvm/hyp/nvhe/host.S | 26 ++++++++---- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 26 +++++++----- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 3 ++ 6 files changed, 103 insertions(+), 59 deletions(-)