@@ -4,6 +4,7 @@
* Author: Christoffer Dall <c.dall@virtualopensystems.com>
*/
+#include <linux/acpi.h>
#include <linux/bug.h>
#include <linux/cpu_pm.h>
#include <linux/entry-kvm.h>
@@ -12,6 +13,7 @@
#include <linux/kvm_host.h>
#include <linux/list.h>
#include <linux/module.h>
+#include <linux/of.h>
#include <linux/vmalloc.h>
#include <linux/fs.h>
#include <linux/mman.h>
@@ -1913,6 +1915,48 @@ static bool init_psci_relay(void)
return true;
}
+static void disown_reserved_memory(struct device_node *node)
+{
+ int addr_cells = of_n_addr_cells(node);
+ int size_cells = of_n_size_cells(node);
+ const __be32 *reg, *end;
+ int len;
+
+ reg = of_get_property(node, "reg", &len);
+ if (len % (4 * (addr_cells + size_cells)))
+ return;
+
+ end = reg + (len / 4);
+ while (reg != end) {
+ u64 addr, size;
+
+ addr = of_read_number(reg, addr_cells);
+ reg += addr_cells;
+ size = of_read_number(reg, size_cells);
+ reg += size_cells;
+
+ kvm_call_hyp_nvhe(__pkvm_disown_pages, addr, size);
+ }
+}
+
+static void kvm_reserved_memory_init(void)
+{
+ struct device_node *parent, *node;
+
+ if (!acpi_disabled || !is_protected_kvm_enabled())
+ return;
+
+ parent = of_find_node_by_path("/reserved-memory");
+ if (!parent)
+ return;
+
+ for_each_child_of_node(parent, node) {
+ if (!of_get_property(node, "compatible", NULL) &&
+ of_get_property(node, "no-map", NULL))
+ disown_reserved_memory(node);
+ }
+}
+
static int init_subsystems(void)
{
int err = 0;
@@ -1953,6 +1997,8 @@ static int init_subsystems(void)
kvm_register_perf_callbacks(NULL);
+ kvm_reserved_memory_init();
+
out:
if (err || !is_protected_kvm_enabled())
on_each_cpu(_kvm_arch_hardware_disable, NULL, 1);
The meaning of no-map on a reserved-memory node is as follows: Indicates the operating system must not create a virtual mapping of the region as part of its standard mapping of system memory, nor permit speculative access to it under any circumstances other than under the control of the device driver using the region. If there is no compatible property, there is no device driver, so the host kernel has no business accessing the reserved-memory region. Since these regions may represent a route through which the host kernel can gain additional privileges, disown any such memory regions before deprivileging ourselves. Signed-off-by: Peter Collingbourne <pcc@google.com> --- arch/arm64/kvm/arm.c | 46 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+)