From patchwork Tue Feb 25 01:53:24 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Quentin Perret X-Patchwork-Id: 13989174 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 359F0C021A4 for ; Tue, 25 Feb 2025 01:56:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:Cc:To:From: Subject:Message-ID:References:Mime-Version:In-Reply-To:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=NrlFCJQM+s/SC4GA9X2sl0022JOgPYCcRoZjBzdMN/w=; b=nYwyZAEy4nXqqWOkuedohvKwdn gdceyoXu1qumnvaGxWANaMrvMjMtfZyESrbiZq5klMjXzj26x2siw22lUf44/V6RMRC1IN17sG+ZY omdFdZowExKxO/1j3wje5PSYzlaGNrl+WUzoLx/Z9zxDXQP2vMHA834aU8d+ar/aaVJd0hyAgDGb3 9sfRn2iN+RXQ8XzDmAs8lkDHo7v5CK5288D5LqPd6PtnPYx7/1si5M30tv9KSwuJbtjWEt5yviGiE urVm7VeREuT8VdSUHcbm0MyBeAdhoOuaiSQzs+apZJESVSCoaK5EVZqAX+WX8qRP3tdkFa7SqzB1f kDGPBgfg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tmkBb-0000000FkhX-0QBL; Tue, 25 Feb 2025 01:56:39 +0000 Received: from mail-ej1-x64a.google.com ([2a00:1450:4864:20::64a]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tmk8c-0000000FkGC-1oDw for linux-arm-kernel@lists.infradead.org; Tue, 25 Feb 2025 01:53:35 +0000 Received: by mail-ej1-x64a.google.com with SMTP id a640c23a62f3a-ab7f6f6cd96so369782366b.2 for ; Mon, 24 Feb 2025 17:53:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740448412; x=1741053212; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=NrlFCJQM+s/SC4GA9X2sl0022JOgPYCcRoZjBzdMN/w=; b=cw0EDe3I2uvoDisKlb03qI004Dxl6dnlHTjclCq8zF2XIPQuuhwXWn2Ur5EzKgUJU3 oGdrld3BUvhniDg8Dg9PqtCB4w85ZncMZEe9h20oSWqgoW1dieFsJh/AWP2hmv8FHoe1 EhsXIr4chxkozta0wteQYxuqZixCvfDFWdwWz2tgs/fw8nJXxXff4ynYJSf3zNsAbXSJ Jsva95JqZ6+1MBUPhtEvAKenpgBSwsmCHQ4o7087R8FdfxK9BMv843iG7Mg11KEcQeBY ZA1/djTCqwMPKMZUUZl5/+u0QdkkIw2o89vXH7hTUXEVetJEbMzTWGaFpsdoAaNYX+c4 82Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740448412; x=1741053212; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=NrlFCJQM+s/SC4GA9X2sl0022JOgPYCcRoZjBzdMN/w=; b=sFbFcIIDjhxGrgqCkzDtVSy6VYyHhbly8enNtTnzcFZCzfDrssBB1eI9SGalWwY6st /Ayy+SJv4oyuFxQp7AR+c5QD5oXMvwN/FiaGkhzT99cOf2e1K7WJtmC8BdMPHf6AxJVj LmluXOwBuXRMHjNSAh6DDrd52/gwFA3kDj0Rp7AAGUPVu3XxDbGreoSB+45ltF1DKSb2 q68PKu6eHkN/4JdobODs3lM52a5gQ1usHdlqQMg97EIB3iq5YTnXEoEpkMCWjTnyd5Jk hdVQ1cS1fJnO1S52PW+G2N7mlabMypZ2kGjg/fPX2cG+EPYiKiztS6G2H5N5xsX0gTtv Hf4Q== X-Gm-Message-State: AOJu0YwYjIB7YtcOevH1YJOwQWjnm400lafG1nsXyKM4qyAwpoJAgmTJ XWVDONTvfcJpuOwNtVZkzUf52N76xlKHThzHEYwQXU0Hr7JNYbHSVmJhLqKznKySIddAkoFH/lO EiuegWw== X-Google-Smtp-Source: AGHT+IFg0MEAMnG3Wrp4miJYl1OKfv7vBcy37QYN3xqF0m8kAhUHahTRAESm+yjq5eaH5DT3if2TwSacRsJb X-Received: from ejcvw12.prod.google.com ([2002:a17:907:a70c:b0:abc:7db:4a27]) (user=qperret job=prod-delivery.src-stubby-dispatcher) by 2002:a17:906:6a15:b0:abe:c849:7aa7 with SMTP id a640c23a62f3a-abec84989c0mr309298366b.41.1740448411867; Mon, 24 Feb 2025 17:53:31 -0800 (PST) Date: Tue, 25 Feb 2025 01:53:24 +0000 In-Reply-To: <20250225015327.3708420-1-qperret@google.com> Mime-Version: 1.0 References: <20250225015327.3708420-1-qperret@google.com> X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: <20250225015327.3708420-2-qperret@google.com> Subject: [PATCH v2 1/4] KVM: arm64: Add .hyp.data section From: Quentin Perret To: Marc Zyngier , Oliver Upton , Joey Gouly , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, qperret@google.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250224_175334_473488_16784787 X-CRM114-Status: GOOD ( 17.98 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: David Brazdil The hypervisor has not needed its own .data section because all globals were either .rodata or .bss. To avoid having to initialize future data-structures at run-time, let's introduce add a .data section to the hypervisor. Signed-off-by: David Brazdil Signed-off-by: Quentin Perret --- arch/arm64/include/asm/sections.h | 1 + arch/arm64/kernel/image-vars.h | 2 ++ arch/arm64/kernel/vmlinux.lds.S | 18 +++++++++++++++--- arch/arm64/kvm/arm.c | 7 +++++++ arch/arm64/kvm/hyp/nvhe/hyp.lds.S | 2 ++ arch/arm64/kvm/hyp/nvhe/setup.c | 4 ++++ arch/arm64/kvm/pkvm.c | 1 + 7 files changed, 32 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/sections.h b/arch/arm64/include/asm/sections.h index 40971ac1303f..51b0d594239e 100644 --- a/arch/arm64/include/asm/sections.h +++ b/arch/arm64/include/asm/sections.h @@ -11,6 +11,7 @@ extern char __alt_instructions[], __alt_instructions_end[]; extern char __hibernate_exit_text_start[], __hibernate_exit_text_end[]; extern char __hyp_idmap_text_start[], __hyp_idmap_text_end[]; extern char __hyp_text_start[], __hyp_text_end[]; +extern char __hyp_data_start[], __hyp_data_end[]; extern char __hyp_rodata_start[], __hyp_rodata_end[]; extern char __hyp_reloc_begin[], __hyp_reloc_end[]; extern char __hyp_bss_start[], __hyp_bss_end[]; diff --git a/arch/arm64/kernel/image-vars.h b/arch/arm64/kernel/image-vars.h index ef3a69cc398e..7c675e61ae58 100644 --- a/arch/arm64/kernel/image-vars.h +++ b/arch/arm64/kernel/image-vars.h @@ -135,6 +135,8 @@ KVM_NVHE_ALIAS(__hyp_text_start); KVM_NVHE_ALIAS(__hyp_text_end); KVM_NVHE_ALIAS(__hyp_bss_start); KVM_NVHE_ALIAS(__hyp_bss_end); +KVM_NVHE_ALIAS(__hyp_data_start); +KVM_NVHE_ALIAS(__hyp_data_end); KVM_NVHE_ALIAS(__hyp_rodata_start); KVM_NVHE_ALIAS(__hyp_rodata_end); diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S index e73326bd3ff7..7c770053f072 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S @@ -13,7 +13,7 @@ *(__kvm_ex_table) \ __stop___kvm_ex_table = .; -#define HYPERVISOR_DATA_SECTIONS \ +#define HYPERVISOR_RODATA_SECTIONS \ HYP_SECTION_NAME(.rodata) : { \ . = ALIGN(PAGE_SIZE); \ __hyp_rodata_start = .; \ @@ -23,6 +23,15 @@ __hyp_rodata_end = .; \ } +#define HYPERVISOR_DATA_SECTION \ + HYP_SECTION_NAME(.data) : { \ + . = ALIGN(PAGE_SIZE); \ + __hyp_data_start = .; \ + *(HYP_SECTION_NAME(.data)) \ + . = ALIGN(PAGE_SIZE); \ + __hyp_data_end = .; \ + } + #define HYPERVISOR_PERCPU_SECTION \ . = ALIGN(PAGE_SIZE); \ HYP_SECTION_NAME(.data..percpu) : { \ @@ -51,7 +60,8 @@ #define SBSS_ALIGN PAGE_SIZE #else /* CONFIG_KVM */ #define HYPERVISOR_EXTABLE -#define HYPERVISOR_DATA_SECTIONS +#define HYPERVISOR_RODATA_SECTIONS +#define HYPERVISOR_DATA_SECTION #define HYPERVISOR_PERCPU_SECTION #define HYPERVISOR_RELOC_SECTION #define SBSS_ALIGN 0 @@ -190,7 +200,7 @@ SECTIONS /* everything from this point to __init_begin will be marked RO NX */ RO_DATA(PAGE_SIZE) - HYPERVISOR_DATA_SECTIONS + HYPERVISOR_RODATA_SECTIONS .got : { *(.got) } /* @@ -295,6 +305,8 @@ SECTIONS _sdata = .; RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN) + HYPERVISOR_DATA_SECTION + /* * Data written with the MMU off but read with the MMU on requires * cache lines to be invalidated, discarding up to a Cache Writeback diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index b8e55a441282..94d23b901b66 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -2568,6 +2568,13 @@ static int __init init_hyp_mode(void) goto out_err; } + err = create_hyp_mappings(kvm_ksym_ref(__hyp_data_start), + kvm_ksym_ref(__hyp_data_end), PAGE_HYP); + if (err) { + kvm_err("Cannot map .hyp.data section\n"); + goto out_err; + } + err = create_hyp_mappings(kvm_ksym_ref(__hyp_rodata_start), kvm_ksym_ref(__hyp_rodata_end), PAGE_HYP_RO); if (err) { diff --git a/arch/arm64/kvm/hyp/nvhe/hyp.lds.S b/arch/arm64/kvm/hyp/nvhe/hyp.lds.S index f4562f417d3f..d724f6d69302 100644 --- a/arch/arm64/kvm/hyp/nvhe/hyp.lds.S +++ b/arch/arm64/kvm/hyp/nvhe/hyp.lds.S @@ -25,5 +25,7 @@ SECTIONS { BEGIN_HYP_SECTION(.data..percpu) PERCPU_INPUT(L1_CACHE_BYTES) END_HYP_SECTION + HYP_SECTION(.bss) + HYP_SECTION(.data) } diff --git a/arch/arm64/kvm/hyp/nvhe/setup.c b/arch/arm64/kvm/hyp/nvhe/setup.c index d62bcb5634a2..46d9bd04348f 100644 --- a/arch/arm64/kvm/hyp/nvhe/setup.c +++ b/arch/arm64/kvm/hyp/nvhe/setup.c @@ -119,6 +119,10 @@ static int recreate_hyp_mappings(phys_addr_t phys, unsigned long size, if (ret) return ret; + ret = pkvm_create_mappings(__hyp_data_start, __hyp_data_end, PAGE_HYP); + if (ret) + return ret; + ret = pkvm_create_mappings(__hyp_rodata_start, __hyp_rodata_end, PAGE_HYP_RO); if (ret) return ret; diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c index 930b677eb9b0..5a75f9554e57 100644 --- a/arch/arm64/kvm/pkvm.c +++ b/arch/arm64/kvm/pkvm.c @@ -259,6 +259,7 @@ static int __init finalize_pkvm(void) * at, which would end badly once inaccessible. */ kmemleak_free_part(__hyp_bss_start, __hyp_bss_end - __hyp_bss_start); + kmemleak_free_part(__hyp_data_start, __hyp_data_end - __hyp_data_start); kmemleak_free_part(__hyp_rodata_start, __hyp_rodata_end - __hyp_rodata_start); kmemleak_free_part_phys(hyp_mem_base, hyp_mem_size); From patchwork Tue Feb 25 01:53:25 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Quentin Perret X-Patchwork-Id: 13989175 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 794DEC021B6 for ; Tue, 25 Feb 2025 01:58:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:Cc:To:From: Subject:Message-ID:References:Mime-Version:In-Reply-To:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=wgX4G/wyCIy27tIesuPjLRJPT0WJaWFAbFWUEeP8CW8=; b=hBCmKCLZ4aOIXdEp9Hm53puvcZ JDLCbI6pr++DAKuWEh/bQIrQNnDmRB90m94XpGCfsAt9GEj74EP7sONecPbkLYTag005Eb+F9EPBw 1DllJ0OBQqdAAmJCg4zFg3bVo8oT925Ktvv5FuW7oe1SGUZY49dWVdq9+SivXQoIp1ff4VQjvbER2 t4eRhFLJUgjxHqKgFLrMx37hDgo+L/VPtwBgGmnJ+Wd6QQXdNRa1FKaTFiYqlkw0ESXjCisWiNjw/ qH8egiFZhzi5ZQ+Xx1QuyMW6DFV6/dQI+P1m4aSPumyvgHY1NHpEUalu2sfCu5ahnuFZeTy0ATOsA LnjrYgQg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tmkD4-0000000Fkon-404X; Tue, 25 Feb 2025 01:58:10 +0000 Received: from mail-ej1-x64a.google.com ([2a00:1450:4864:20::64a]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tmk8d-0000000FkGp-2tCL for linux-arm-kernel@lists.infradead.org; Tue, 25 Feb 2025 01:53:36 +0000 Received: by mail-ej1-x64a.google.com with SMTP id a640c23a62f3a-abecbdb4272so80331466b.0 for ; Mon, 24 Feb 2025 17:53:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740448414; x=1741053214; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=wgX4G/wyCIy27tIesuPjLRJPT0WJaWFAbFWUEeP8CW8=; b=A0RH+2cESw8NzEVVPAE3LXGcobhB6sjBu88yZooTjEAga5n2doT5aez6Emgs5suLzl 9lqBi3f9OMzpEHm0cM8C2odz87qwFjB4Kn5gBriIrHv4U65ttoeWvjykYYPz5fP0tjmd IL4Q+VkXVDdNSq1rLX1gCTmim6M5MnAX+BBaBs/gcL8jKGFsknpSJtXBqm+q8EPt0hiB RD11uWqgycmHIjQw4mFJ34p6GmDDYhwJUKQCX59z6aHdSVoOWoQ0P4sgIG9S7JegW2WM pUMyIm16Feulao+exDP26QtRgvMbmW1Pu5WontJETuxzP+cG8oAKDnlZqU9qG4Uo2t3+ 8hNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740448414; x=1741053214; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=wgX4G/wyCIy27tIesuPjLRJPT0WJaWFAbFWUEeP8CW8=; b=sD+01BEk4/4YROuEWylQJt6ETZRuZ6jdVol3B9og2ZgDkuNGowAFYRutBi61sKvRJL f3hpRF9RkscZpWQHys/Uf7BcgGH3B+fkExasHloxeinVfIwIk9sLO6lUud/kk9TDXaj1 eFZ7FlInG5GF/RfctLnmMoqFx6L6vBrUQ12XsocP6wwZqJst62N1H85PD303h2QuPQRJ rjz4dVZ+hfixI4fyr3ijhCqXH+n4NdCtiSVJ1zm7jX20ZGyd1PMAd004SXXxxRK1A5lh JkwcUa5UamQMTxpA36ZbHHIq0v4xP9OhDLgLQgQnO8Cuc4IaSHQc76WfCtsQq4ApCayi 2KjQ== X-Gm-Message-State: AOJu0Yztoiecvx5jWILLH1oN7YTnCCS5ZHeuAuzz8mZm8utoBbNCKb5a AfoEWRu7UkXlnCsWHrWq8kV3ZWpfT3PGnroE+LTS11PntcZv+V5ZUpGuIk6UMDWVPtaICwNk8Ga zI6l29g== X-Google-Smtp-Source: AGHT+IHaEufhivqbAqPz8dmOr7ipMkvz7Mo3kJou3GygxqUP3Pfy+Ob1mNc3FS5PEksGnbTAMER6tHUCQA2u X-Received: from ejcux14.prod.google.com ([2002:a17:907:cf8e:b0:abb:b80e:12f4]) (user=qperret job=prod-delivery.src-stubby-dispatcher) by 2002:a17:906:3181:b0:ab7:e8d6:3b21 with SMTP id a640c23a62f3a-abed0d764demr127674066b.28.1740448414099; Mon, 24 Feb 2025 17:53:34 -0800 (PST) Date: Tue, 25 Feb 2025 01:53:25 +0000 In-Reply-To: <20250225015327.3708420-1-qperret@google.com> Mime-Version: 1.0 References: <20250225015327.3708420-1-qperret@google.com> X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: <20250225015327.3708420-3-qperret@google.com> Subject: [PATCH v2 2/4] KVM: arm64: Don't WARN from __pkvm_host_share_guest() From: Quentin Perret To: Marc Zyngier , Oliver Upton , Joey Gouly , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, qperret@google.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250224_175335_725248_93003267 X-CRM114-Status: GOOD ( 11.01 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org We currently WARN() if the host attempts to share a page that is not in an acceptable state with a guest. This isn't strictly necessary and makes testing much harder, so drop the WARN and fix the error code. Signed-off-by: Quentin Perret --- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c index 19c3c631708c..ae39abc7e604 100644 --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c @@ -912,7 +912,6 @@ int __pkvm_host_share_guest(u64 pfn, u64 gfn, struct pkvm_hyp_vcpu *vcpu, if (page->host_share_guest_count) break; /* Only host to np-guest multi-sharing is tolerated */ - WARN_ON(1); fallthrough; default: ret = -EPERM; From patchwork Tue Feb 25 01:53:26 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Quentin Perret X-Patchwork-Id: 13989176 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 627E4C021A4 for ; Tue, 25 Feb 2025 01:59:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:Cc:To:From: Subject:Message-ID:References:Mime-Version:In-Reply-To:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=mVBQg35LScynYQPBsFgs3dGrm+AD9n8KyZeHIALpKpg=; b=T9NMPi+C4ROAgquNbHVuE5updu p1Yf2p2W60jfYkJfwWZfouLwm06bn4k+sf+vc2pmu9fwfIrwtCCZRW6Otm4viY5eOdm1BiFR/QAIf 0IUKC9f/M1+/5wD2VFjg5Da64Ye0x0J/7/fSnsFgeeFLnn3P9R0sU5eIKoOWsBl2j3ezKxmGgELuf qo93/8k1d61I1fVyC5hELLYlqdiWMDBB7kIU9yRyZAwfq0DVtTiALKhWQrXp+5T8vbquBl69mlPEO jpwoKhXJKaJ7dIQ20mpmcBYR9A+QqynWvL/Y58ErTAkK/TI8YkkJVzYNZFmq96QcnA2S7rPU+pW2n ENk7Cilg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tmkEY-0000000FkwX-2QkI; Tue, 25 Feb 2025 01:59:42 +0000 Received: from mail-ej1-x649.google.com ([2a00:1450:4864:20::649]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tmk8g-0000000FkHq-1tRg for linux-arm-kernel@lists.infradead.org; Tue, 25 Feb 2025 01:53:40 +0000 Received: by mail-ej1-x649.google.com with SMTP id a640c23a62f3a-abba896add9so394047966b.1 for ; Mon, 24 Feb 2025 17:53:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740448416; x=1741053216; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=mVBQg35LScynYQPBsFgs3dGrm+AD9n8KyZeHIALpKpg=; b=lap1RaCW8l1DR8cYXJODOWn3sROCqi4Oqc5UlkkPGRtZGvhNrVIUdcwwa5K1bYu/i9 qR5EBCXkCwBKOeIrh8k4wQvaJprTK8Ls74GaBqR91mis1CvCSlxw4CK6r8qkc76kfhpX yc1OBQ9ctHmzyXmywC+8if9VPahPLj1Xhoh8kbd1na8Ju56rnPW54VD8LBSsUJdWkD8i 9asoq+SgPzulHNrOKCuKNPA0N0QFstpDmVzv8Wn9fKAYTepoNK8eVRhC/Bhu9L4C409E njXJ4Fy4UUuVGzIvt1rwMVKZyQf9jkPZu/EbXZRQW4Hsczpj0xE7oZ9zNSxwX5an3OAE U1mQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740448416; x=1741053216; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=mVBQg35LScynYQPBsFgs3dGrm+AD9n8KyZeHIALpKpg=; b=a4+7y+6QEeOEelXehahduCgQxOnaj5dzoNVQvAKpw440pohZA8T+6V73APGoBx1VWy jvx+wQHbTZV+t8iaTxuW/mEEMRXtmjHF+2/xdZIS0FznBoSuhj+tkyTDhQiTLy1WHUOr 2ZFsbFBHv5F9XU2vZxjsU0bXW70IlM2olccLaUSm8lKgmlLIj8rCav0TrjoKyFP9vUXG 9Vy3CNgUwrnGJYGLfhycCuUPGikfFgcthvPcfd5Sc+gXd3hmnnJVblZuI8IxqcyJ66+t GKiHcJ7BcaSPNDiP8hRSNblyBJRLpDtQBthZURjpjsdltpaj7lekxo+imyfQhmeTfdhM fcfg== X-Gm-Message-State: AOJu0Yz4zpTJWrmEZGQYWqVTNsOErO1GEGnz5vx1tmnbkabIsff/rK12 y4h1dwZ3Ky/UQ7YNAIzfA8Y1speZ4b7o8GvCjCNOGZbKN4OGuofutl/a0rnODcOTk9eVc3WMAwK 6gacPyw== X-Google-Smtp-Source: AGHT+IEOA9rIjA6uekoY3WihM+tF/K0vVRrG2dIyIogwJ20oRerMsyDc12AtygClhb6MD/mhH+yOzfP2W+Kp X-Received: from ejcvg17.prod.google.com ([2002:a17:907:d311:b0:abb:78a9:ce4a]) (user=qperret job=prod-delivery.src-stubby-dispatcher) by 2002:a17:907:7801:b0:aa6:7737:199c with SMTP id a640c23a62f3a-abc09a079d1mr1474527866b.15.1740448416319; Mon, 24 Feb 2025 17:53:36 -0800 (PST) Date: Tue, 25 Feb 2025 01:53:26 +0000 In-Reply-To: <20250225015327.3708420-1-qperret@google.com> Mime-Version: 1.0 References: <20250225015327.3708420-1-qperret@google.com> X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: <20250225015327.3708420-4-qperret@google.com> Subject: [PATCH v2 3/4] KVM: arm64: Selftest for pKVM transitions From: Quentin Perret To: Marc Zyngier , Oliver Upton , Joey Gouly , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, qperret@google.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250224_175338_494372_76FA784A X-CRM114-Status: GOOD ( 15.42 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org We have recently found a bug [1] in the pKVM memory ownership transitions by code inspection, but it could have been caught with a test. Introduce a boot-time selftest exercising all the known pKVM memory transitions and importantly checks the rejection of illegal transitions. The new test is hidden behind a new Kconfig option separate from CONFIG_EL2_NVHE_DEBUG on purpose as that has side effects on the transition checks ([1] doesn't reproduce with EL2 debug enabled). [1] https://lore.kernel.org/kvmarm/20241128154406.602875-1-qperret@google.com/ Suggested-by: Will Deacon Signed-off-by: Quentin Perret --- arch/arm64/kvm/Kconfig | 10 ++ arch/arm64/kvm/hyp/include/nvhe/mem_protect.h | 6 + arch/arm64/kvm/hyp/nvhe/mem_protect.c | 111 ++++++++++++++++++ arch/arm64/kvm/hyp/nvhe/setup.c | 2 + 4 files changed, 129 insertions(+) diff --git a/arch/arm64/kvm/Kconfig b/arch/arm64/kvm/Kconfig index ead632ad01b4..038d7f52232c 100644 --- a/arch/arm64/kvm/Kconfig +++ b/arch/arm64/kvm/Kconfig @@ -46,6 +46,7 @@ menuconfig KVM config NVHE_EL2_DEBUG bool "Debug mode for non-VHE EL2 object" depends on KVM + select PKVM_SELFTESTS help Say Y here to enable the debug mode for the non-VHE KVM EL2 object. Failure reports will BUG() in the hypervisor. This is intended for @@ -53,6 +54,15 @@ config NVHE_EL2_DEBUG If unsure, say N. +config PKVM_SELFTESTS + bool "Protected KVM hypervisor selftests" + help + Say Y here to enable Protected KVM (pKVM) hypervisor selftests + during boot. Failure reports will panic the hypervisor. This is + intended for EL2 hypervisor development. + + If unsure, say N. + config PROTECTED_NVHE_STACKTRACE bool "Protected KVM hypervisor stacktraces" depends on NVHE_EL2_DEBUG diff --git a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h index 978f38c386ee..31a3f2cdf242 100644 --- a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h +++ b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h @@ -67,4 +67,10 @@ static __always_inline void __load_host_stage2(void) else write_sysreg(0, vttbr_el2); } + +#ifdef CONFIG_PKVM_SELFTESTS +void pkvm_ownership_selftest(void); +#else +static inline void pkvm_ownership_selftest(void) { } +#endif #endif /* __KVM_NVHE_MEM_PROTECT__ */ diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c index ae39abc7e604..46f3f4aeecc5 100644 --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c @@ -1083,3 +1083,114 @@ int __pkvm_host_mkyoung_guest(u64 gfn, struct pkvm_hyp_vcpu *vcpu) return 0; } + +#ifdef CONFIG_PKVM_SELFTESTS +struct pkvm_expected_state { + enum pkvm_page_state host; + enum pkvm_page_state hyp; +}; + +static struct pkvm_expected_state selftest_state; +static struct hyp_page *selftest_page; + +static void assert_page_state(void) +{ + void *virt = hyp_page_to_virt(selftest_page); + u64 size = PAGE_SIZE << selftest_page->order; + u64 phys = hyp_virt_to_phys(virt); + + host_lock_component(); + WARN_ON(__host_check_page_state_range(phys, size, selftest_state.host)); + host_unlock_component(); + + hyp_lock_component(); + WARN_ON(__hyp_check_page_state_range((u64)virt, size, selftest_state.hyp)); + hyp_unlock_component(); +} + +#define assert_transition_res(res, fn, ...) \ + do { \ + WARN_ON(fn(__VA_ARGS__) != res); \ + assert_page_state(); \ + } while (0) + +void pkvm_ownership_selftest(void) +{ + void *virt = hyp_alloc_pages(&host_s2_pool, 0); + u64 phys, size, pfn; + + WARN_ON(!virt); + selftest_page = hyp_virt_to_page(virt); + selftest_page->refcount = 0; + + size = PAGE_SIZE << selftest_page->order; + phys = hyp_virt_to_phys(virt); + pfn = hyp_phys_to_pfn(phys); + + selftest_state.host = PKVM_NOPAGE; + selftest_state.hyp = PKVM_PAGE_OWNED; + assert_page_state(); + assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_unshare_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_unshare_ffa, pfn, 1); + assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); + + selftest_state.host = PKVM_PAGE_OWNED; + selftest_state.hyp = PKVM_NOPAGE; + assert_transition_res(0, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_unshare_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_unshare_ffa, pfn, 1); + assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); + + selftest_state.host = PKVM_PAGE_SHARED_OWNED; + selftest_state.hyp = PKVM_PAGE_SHARED_BORROWED; + assert_transition_res(0, __pkvm_host_share_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + + assert_transition_res(0, hyp_pin_shared_mem, virt, virt + size); + assert_transition_res(0, hyp_pin_shared_mem, virt, virt + size); + hyp_unpin_shared_mem(virt, virt + size); + WARN_ON(hyp_page_count(virt) != 1); + assert_transition_res(-EBUSY, __pkvm_host_unshare_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + + hyp_unpin_shared_mem(virt, virt + size); + assert_page_state(); + WARN_ON(hyp_page_count(virt)); + + selftest_state.host = PKVM_PAGE_OWNED; + selftest_state.hyp = PKVM_NOPAGE; + assert_transition_res(0, __pkvm_host_unshare_hyp, pfn); + + selftest_state.host = PKVM_PAGE_SHARED_OWNED; + selftest_state.hyp = PKVM_NOPAGE; + assert_transition_res(0, __pkvm_host_share_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_unshare_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); + + selftest_state.host = PKVM_PAGE_OWNED; + selftest_state.hyp = PKVM_NOPAGE; + assert_transition_res(0, __pkvm_host_unshare_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_unshare_ffa, pfn, 1); + + selftest_state.host = PKVM_NOPAGE; + selftest_state.hyp = PKVM_PAGE_OWNED; + assert_transition_res(0, __pkvm_host_donate_hyp, pfn, 1); + + selftest_page->refcount = 1; + hyp_put_page(&host_s2_pool, virt); +} +#endif diff --git a/arch/arm64/kvm/hyp/nvhe/setup.c b/arch/arm64/kvm/hyp/nvhe/setup.c index 46d9bd04348f..54006f959e1b 100644 --- a/arch/arm64/kvm/hyp/nvhe/setup.c +++ b/arch/arm64/kvm/hyp/nvhe/setup.c @@ -308,6 +308,8 @@ void __noreturn __pkvm_init_finalise(void) goto out; pkvm_hyp_vm_table_init(vm_table_base); + + pkvm_ownership_selftest(); out: /* * We tail-called to here from handle___pkvm_init() and will not return, From patchwork Tue Feb 25 01:53:27 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Quentin Perret X-Patchwork-Id: 13989183 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2975FC021A4 for ; Tue, 25 Feb 2025 02:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:Cc:To:From: Subject:Message-ID:References:Mime-Version:In-Reply-To:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=m7dZmTdaF5BfvE12HLbTKAM/qU/qgzQacpIdfJS89lM=; b=Wd9XYMlDADKDnw+cOst1jCRvwu Jrvoy+XgYR4gV2Ku1ikOrcSFOmXqGH8GdWhujOvjelmpjAg6yzg+/i6+0vIpUJ0UjLy+bAr7E0IRM XIV+Quuog0hiMxrgMX1z6ShqBBXky8zzFXelwcQw+XOyfW5Bkk6ig4bBSOHCgwudHQkLlNR1m5U/I mlGxbjNFhxTystEek2o5I2SzBAfUSfApud+OUm0ohRmsfcW4HTfuBPseOpodWxlj7iCQ7V0kA0+3R XxpgChiB1Ud/xJxTG8XDeAZh8RBOaAG8wrKqUEk9EorzcXFBDfly/WxAbajdwm7ag1V53xUs7ikgS MB7V81/g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tmkG2-0000000Fl4X-1HOT; Tue, 25 Feb 2025 02:01:14 +0000 Received: from mail-ed1-x54a.google.com ([2a00:1450:4864:20::54a]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tmk8i-0000000FkIj-2p6c for linux-arm-kernel@lists.infradead.org; Tue, 25 Feb 2025 01:53:41 +0000 Received: by mail-ed1-x54a.google.com with SMTP id 4fb4d7f45d1cf-5e0bff433cbso2983487a12.2 for ; Mon, 24 Feb 2025 17:53:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740448418; x=1741053218; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=m7dZmTdaF5BfvE12HLbTKAM/qU/qgzQacpIdfJS89lM=; b=rN0nAcLvDNG34zFZJkXXF0x9959yAdv6A/4E3kIoUzi4HgI5zEnR5dm1v3CRGfmSMB NELNl74lfb7sPuZO/nnCwo+bwMr+DBcFSej98YZPdlbEi1MzkW8D91IQw9HC8PivK9BB gYKpYDCaFUdqu091Lii84oHKZEcm4wd1upiIZrztY2/PPd+VOpO/hq3xJ4OZTugQlB66 f3xrOAgP3Hw3JJUFqusWED/vWvlAcUO48bWo95Zgi1e2OnDqodmk5kLHegKH/+sX9qx4 E0Ji+4lciPEJVYlsfMb/57HLtFA3g3PW44/3QejRAAZ9anilmOmzq35kaGVrn3BxaXwH dAHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740448418; x=1741053218; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=m7dZmTdaF5BfvE12HLbTKAM/qU/qgzQacpIdfJS89lM=; b=Hy/Raa5wopvk0unvPI0UrS1HFJYMP9ch/pg8Q5rs/imRvnFpE5rZ6EnQGtnq7p3RQN 07e2qpTSVXC/fFj1Qqj5kiA6/zBnCCioPuCx42SG0RmCT104IY0uNeQtonI4PXloKvcz 6lC5chNlggKZePidbgl42F9BfhYncM64RSg0/BkmaRs/Pklw6BlpAAVRg5oqNkwVOq9I cLzgUQwLUlQsi4fNVIaQWYBGffruuFjABfdr07jh6oYLofmBoeVzNti/58DhHwKJgSS3 afIASG1m2WYkShcz9x3ngW3ShtxfUGPJwGJ2unU0O4/8o5CbzcSKRzVgKIMzV/7+Eg6S ISkQ== X-Gm-Message-State: AOJu0YwLu3BLJYLiPVj9GD+yBxMs2GqeAwm9XP58WHGrqIHvrHcZP4DA 1nNUYNbMPMFsuw9LORYR5U7jTzsu24BDRoJ5reoUwEn7xWbmPdVx0sWznwOWxX6rgIWdbleFvBc OqowZNQ== X-Google-Smtp-Source: AGHT+IGwggas76Qq6nVnBY8hQptDHcF9hAdQuXod8zicSSA+dENSbfVyJVzhiJxQLNjNL2CSji69tgz9i4oD X-Received: from edbig12.prod.google.com ([2002:a05:6402:458c:b0:5de:6e72:c13b]) (user=qperret job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:42c5:b0:5e0:87fb:72fb with SMTP id 4fb4d7f45d1cf-5e0b70b707dmr17770196a12.6.1740448418641; Mon, 24 Feb 2025 17:53:38 -0800 (PST) Date: Tue, 25 Feb 2025 01:53:27 +0000 In-Reply-To: <20250225015327.3708420-1-qperret@google.com> Mime-Version: 1.0 References: <20250225015327.3708420-1-qperret@google.com> X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: <20250225015327.3708420-5-qperret@google.com> Subject: [PATCH v2 4/4] KVM: arm64: Extend pKVM selftest for np-guests From: Quentin Perret To: Marc Zyngier , Oliver Upton , Joey Gouly , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, qperret@google.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250224_175340_716362_FE8D6398 X-CRM114-Status: GOOD ( 20.49 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The pKVM selftest intends to test as many memory 'transitions' as possible, so extend it to cover sharing pages with non-protected guests, including in the case of multi-sharing. Signed-off-by: Quentin Perret --- arch/arm64/include/asm/kvm_pkvm.h | 6 ++ arch/arm64/kvm/hyp/include/nvhe/mem_protect.h | 4 +- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 90 ++++++++++++++++++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/pkvm.c | 1 + 5 files changed, 104 insertions(+), 5 deletions(-) diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h index eb65f12e81d9..104b6b5ab6f5 100644 --- a/arch/arm64/include/asm/kvm_pkvm.h +++ b/arch/arm64/include/asm/kvm_pkvm.h @@ -134,6 +134,12 @@ static inline unsigned long host_s2_pgtable_pages(void) return res; } +#ifdef CONFIG_PKVM_SELFTESTS +static inline unsigned long pkvm_selftest_pages(void) { return 32; } +#else +static inline unsigned long pkvm_selftest_pages(void) { return 0; } +#endif + #define KVM_FFA_MBOX_NR_PAGES 1 static inline unsigned long hyp_ffa_proxy_pages(void) diff --git a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h index 31a3f2cdf242..dd53af947a58 100644 --- a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h +++ b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h @@ -69,8 +69,8 @@ static __always_inline void __load_host_stage2(void) } #ifdef CONFIG_PKVM_SELFTESTS -void pkvm_ownership_selftest(void); +void pkvm_ownership_selftest(void *base); #else -static inline void pkvm_ownership_selftest(void) { } +static inline void pkvm_ownership_selftest(void *base) { } #endif #endif /* __KVM_NVHE_MEM_PROTECT__ */ diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c index 46f3f4aeecc5..a03a2665e234 100644 --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c @@ -1088,16 +1088,60 @@ int __pkvm_host_mkyoung_guest(u64 gfn, struct pkvm_hyp_vcpu *vcpu) struct pkvm_expected_state { enum pkvm_page_state host; enum pkvm_page_state hyp; + enum pkvm_page_state guest[2]; /* [ gfn, gfn + 1 ] */ }; static struct pkvm_expected_state selftest_state; static struct hyp_page *selftest_page; +static struct pkvm_hyp_vm selftest_vm = { + .kvm = { + .arch = { + .mmu = { + .arch = &selftest_vm.kvm.arch, + .pgt = &selftest_vm.pgt, + }, + }, + }, +}; + +static struct pkvm_hyp_vcpu selftest_vcpu = { + .vcpu = { + .arch = { + .hw_mmu = &selftest_vm.kvm.arch.mmu, + }, + .kvm = &selftest_vm.kvm, + }, +}; + +static void init_selftest_vm(void *virt) +{ + struct hyp_page *p = hyp_virt_to_page(virt); + int i; + + selftest_vm.kvm.arch.mmu.vtcr = host_mmu.arch.mmu.vtcr; + WARN_ON(kvm_guest_prepare_stage2(&selftest_vm, virt)); + + for (i = 0; i < pkvm_selftest_pages(); i++) { + if (p[i].refcount) + continue; + p[i].refcount = 1; + hyp_put_page(&selftest_vm.pool, hyp_page_to_virt(&p[i])); + } +} + +static u64 selftest_ipa(void) +{ + return BIT(selftest_vm.pgt.ia_bits - 1); +} + static void assert_page_state(void) { void *virt = hyp_page_to_virt(selftest_page); u64 size = PAGE_SIZE << selftest_page->order; + struct pkvm_hyp_vcpu *vcpu = &selftest_vcpu; u64 phys = hyp_virt_to_phys(virt); + u64 ipa[2] = { selftest_ipa(), selftest_ipa() + PAGE_SIZE }; host_lock_component(); WARN_ON(__host_check_page_state_range(phys, size, selftest_state.host)); @@ -1106,6 +1150,11 @@ static void assert_page_state(void) hyp_lock_component(); WARN_ON(__hyp_check_page_state_range((u64)virt, size, selftest_state.hyp)); hyp_unlock_component(); + + guest_lock_component(&selftest_vm); + WARN_ON(__guest_check_page_state_range(vcpu, ipa[0], size, selftest_state.guest[0])); + WARN_ON(__guest_check_page_state_range(vcpu, ipa[1], size, selftest_state.guest[1])); + guest_unlock_component(&selftest_vm); } #define assert_transition_res(res, fn, ...) \ @@ -1114,21 +1163,27 @@ static void assert_page_state(void) assert_page_state(); \ } while (0) -void pkvm_ownership_selftest(void) +void pkvm_ownership_selftest(void *base) { + enum kvm_pgtable_prot prot = KVM_PGTABLE_PROT_RWX; void *virt = hyp_alloc_pages(&host_s2_pool, 0); - u64 phys, size, pfn; + struct pkvm_hyp_vcpu *vcpu = &selftest_vcpu; + struct pkvm_hyp_vm *vm = &selftest_vm; + u64 phys, size, pfn, gfn; WARN_ON(!virt); selftest_page = hyp_virt_to_page(virt); selftest_page->refcount = 0; + init_selftest_vm(base); size = PAGE_SIZE << selftest_page->order; phys = hyp_virt_to_phys(virt); pfn = hyp_phys_to_pfn(phys); + gfn = hyp_phys_to_pfn(selftest_ipa()); selftest_state.host = PKVM_NOPAGE; selftest_state.hyp = PKVM_PAGE_OWNED; + selftest_state.guest[0] = selftest_state.guest[1] = PKVM_NOPAGE; assert_page_state(); assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); @@ -1136,6 +1191,8 @@ void pkvm_ownership_selftest(void) assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); assert_transition_res(-EPERM, __pkvm_host_unshare_ffa, pfn, 1); assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); + assert_transition_res(-EPERM, __pkvm_host_share_guest, pfn, gfn, vcpu, prot); + assert_transition_res(-ENOENT, __pkvm_host_unshare_guest, gfn, vm); selftest_state.host = PKVM_PAGE_OWNED; selftest_state.hyp = PKVM_NOPAGE; @@ -1143,6 +1200,7 @@ void pkvm_ownership_selftest(void) assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); assert_transition_res(-EPERM, __pkvm_host_unshare_hyp, pfn); assert_transition_res(-EPERM, __pkvm_host_unshare_ffa, pfn, 1); + assert_transition_res(-ENOENT, __pkvm_host_unshare_guest, gfn, vm); assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); selftest_state.host = PKVM_PAGE_SHARED_OWNED; @@ -1152,6 +1210,8 @@ void pkvm_ownership_selftest(void) assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_guest, pfn, gfn, vcpu, prot); + assert_transition_res(-ENOENT, __pkvm_host_unshare_guest, gfn, vm); assert_transition_res(0, hyp_pin_shared_mem, virt, virt + size); assert_transition_res(0, hyp_pin_shared_mem, virt, virt + size); @@ -1162,6 +1222,8 @@ void pkvm_ownership_selftest(void) assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_guest, pfn, gfn, vcpu, prot); + assert_transition_res(-ENOENT, __pkvm_host_unshare_guest, gfn, vm); hyp_unpin_shared_mem(virt, virt + size); assert_page_state(); @@ -1179,6 +1241,8 @@ void pkvm_ownership_selftest(void) assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); assert_transition_res(-EPERM, __pkvm_host_unshare_hyp, pfn); assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_guest, pfn, gfn, vcpu, prot); + assert_transition_res(-ENOENT, __pkvm_host_unshare_guest, gfn, vm); assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); selftest_state.host = PKVM_PAGE_OWNED; @@ -1186,6 +1250,28 @@ void pkvm_ownership_selftest(void) assert_transition_res(0, __pkvm_host_unshare_ffa, pfn, 1); assert_transition_res(-EPERM, __pkvm_host_unshare_ffa, pfn, 1); + selftest_state.host = PKVM_PAGE_SHARED_OWNED; + selftest_state.guest[0] = PKVM_PAGE_SHARED_BORROWED; + assert_transition_res(0, __pkvm_host_share_guest, pfn, gfn, vcpu, prot); + assert_transition_res(-EPERM, __pkvm_host_share_guest, pfn, gfn, vcpu, prot); + assert_transition_res(-EPERM, __pkvm_host_share_ffa, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_donate_hyp, pfn, 1); + assert_transition_res(-EPERM, __pkvm_host_share_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_host_unshare_hyp, pfn); + assert_transition_res(-EPERM, __pkvm_hyp_donate_host, pfn, 1); + assert_transition_res(-EPERM, hyp_pin_shared_mem, virt, virt + size); + + selftest_state.guest[1] = PKVM_PAGE_SHARED_BORROWED; + assert_transition_res(0, __pkvm_host_share_guest, pfn, gfn + 1, vcpu, prot); + WARN_ON(hyp_virt_to_page(virt)->host_share_guest_count != 2); + + selftest_state.guest[0] = PKVM_NOPAGE; + assert_transition_res(0, __pkvm_host_unshare_guest, gfn, vm); + + selftest_state.guest[1] = PKVM_NOPAGE; + selftest_state.host = PKVM_PAGE_OWNED; + assert_transition_res(0, __pkvm_host_unshare_guest, gfn + 1, vm); + selftest_state.host = PKVM_NOPAGE; selftest_state.hyp = PKVM_PAGE_OWNED; assert_transition_res(0, __pkvm_host_donate_hyp, pfn, 1); diff --git a/arch/arm64/kvm/hyp/nvhe/setup.c b/arch/arm64/kvm/hyp/nvhe/setup.c index 54006f959e1b..814548134a83 100644 --- a/arch/arm64/kvm/hyp/nvhe/setup.c +++ b/arch/arm64/kvm/hyp/nvhe/setup.c @@ -28,6 +28,7 @@ static void *vmemmap_base; static void *vm_table_base; static void *hyp_pgt_base; static void *host_s2_pgt_base; +static void *selftest_base; static void *ffa_proxy_pages; static struct kvm_pgtable_mm_ops pkvm_pgtable_mm_ops; static struct hyp_pool hpool; @@ -38,6 +39,11 @@ static int divide_memory_pool(void *virt, unsigned long size) hyp_early_alloc_init(virt, size); + nr_pages = pkvm_selftest_pages(); + selftest_base = hyp_early_alloc_contig(nr_pages); + if (nr_pages && !selftest_base) + return -ENOMEM; + nr_pages = hyp_vmemmap_pages(sizeof(struct hyp_page)); vmemmap_base = hyp_early_alloc_contig(nr_pages); if (!vmemmap_base) @@ -309,7 +315,7 @@ void __noreturn __pkvm_init_finalise(void) pkvm_hyp_vm_table_init(vm_table_base); - pkvm_ownership_selftest(); + pkvm_ownership_selftest(selftest_base); out: /* * We tail-called to here from handle___pkvm_init() and will not return, diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c index 5a75f9554e57..728ae5f44da3 100644 --- a/arch/arm64/kvm/pkvm.c +++ b/arch/arm64/kvm/pkvm.c @@ -79,6 +79,7 @@ void __init kvm_hyp_reserve(void) hyp_mem_pages += host_s2_pgtable_pages(); hyp_mem_pages += hyp_vm_table_pages(); hyp_mem_pages += hyp_vmemmap_pages(STRUCT_HYP_PAGE_SIZE); + hyp_mem_pages += pkvm_selftest_pages(); hyp_mem_pages += hyp_ffa_proxy_pages(); /*