linux-kernel - [RFC PATCH 00/26] kvm: arm64: Always-on nVHE hypervisor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20201104183630.27513-1-dbrazdil@google.com>
Date:   Wed,  4 Nov 2020 18:36:04 +0000
From:   David Brazdil <dbrazdil@...gle.com>
To:     kvmarm@...ts.cs.columbia.edu
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Marc Zyngier <maz@...nel.org>,
        James Morse <james.morse@....com>,
        Julien Thierry <julien.thierry.kdev@...il.com>,
        Suzuki K Poulose <suzuki.poulose@....com>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will@...nel.org>, Dennis Zhou <dennis@...nel.org>,
        Tejun Heo <tj@...nel.org>, Christoph Lameter <cl@...ux.com>,
        Mark Rutland <mark.rutland@....com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Quentin Perret <qperret@...gle.com>,
        Andrew Scull <ascull@...gle.com>, kernel-team@...roid.com,
        David Brazdil <dbrazdil@...gle.com>
Subject: [RFC PATCH 00/26] kvm: arm64: Always-on nVHE hypervisor

As we progress towards being able to keep guest state private to the
host running nVHE hypervisor, this series allows the hypervisor to
install itself on newly booted CPUs before the host is allowed to run
on them.

To this end, the hypervisor starts trapping host SMCs and intercepting
host's PSCI CPU_ON/OFF/SUSPEND calls. It replaces the host's entry point
with its own, initializes the EL2 state of the new CPU and installs
the nVHE hyp vector before ERETing to the host's entry point.

Other PSCI SMCs are forwarded to EL3, though only the known set of SMCs
implemented in the kernel is allowed. Non-PSCI SMCs are also forwarded
to EL3. Future changes will need to ensure the safety of all SMCs wrt.
private guests.

The host is still allowed to reset EL2 back to the stub vector, eg. for
hibernation or kexec, but will not disable nVHE when there are no VMs.

Tested on Rock Pi 4b.


Sending this as an RFC to get feedback on the following decisions:

1) The kernel checks new cores' features against the finalized system
capabilities. To avoid the need to move this code/data to EL2, the
implementation only allows to boot cores that were online at the time of
KVM initialization.

2) Trapping and forwarding SMCs cannot be switched off. This could cause
issues eg. if EL3 always returned to EL1. A kernel command line flag may
be needed to turn the feature off on such platforms.

  -David

David Brazdil (25):
  psci: Export configured PSCI version
  psci: Export configured PSCI function IDs
  psci: Export psci_cpu_suspend_feature
  arm64: Move MAIR_EL1_SET to asm/memory.h
  kvm: arm64: Initialize MAIR_EL2 using a constant
  kvm: arm64: Add .hyp.data ELF section
  kvm: arm64: Support per_cpu_ptr in nVHE hyp code
  kvm: arm64: Create nVHE copy of cpu_logical_map
  kvm: arm64: Move hyp-init params to a per-CPU struct
  kvm: arm64: Refactor handle_trap to use a switch
  kvm: arm64: Extract parts of el2_setup into a macro
  kvm: arm64: Add SMC handler in nVHE EL2
  kvm: arm64: Bootstrap PSCI SMC handler in nVHE EL2
  kvm: arm64: Forward safe PSCI SMCs coming from host
  kvm: arm64: Add offset for hyp VA <-> PA conversion
  kvm: arm64: Bootstrap PSCI power state of host CPUs
  kvm: arm64: Intercept PSCI_CPU_OFF host SMC calls
  kvm: arm64: Extract __do_hyp_init into a helper function
  kvm: arm64: Add CPU entry point in nVHE hyp
  kvm: arm64: Add function to enter host from KVM nVHE hyp code
  kvm: arm64: Intercept PSCI_CPU_ON host SMC calls
  kvm: arm64: Intercept host's CPU_SUSPEND PSCI SMCs
  kvm: arm64: Keep nVHE EL2 vector installed
  kvm: arm64: Trap host SMCs
  kvm: arm64: Fix EL2 mode availability checks

Will Deacon (1):
  arm64: kvm: Add standalone ticket spinlock implementation for use at
    hyp

 arch/arm64/include/asm/kvm_arm.h           |   3 +-
 arch/arm64/include/asm/kvm_asm.h           | 142 +++++++++
 arch/arm64/include/asm/kvm_hyp.h           |  10 +
 arch/arm64/include/asm/memory.h            |  13 +
 arch/arm64/include/asm/percpu.h            |   6 +
 arch/arm64/include/asm/sections.h          |   1 +
 arch/arm64/include/asm/virt.h              |  16 +
 arch/arm64/kernel/asm-offsets.c            |   5 +
 arch/arm64/kernel/head.S                   | 140 +--------
 arch/arm64/kernel/image-vars.h             |   3 +
 arch/arm64/kernel/vmlinux.lds.S            |  10 +
 arch/arm64/kvm/arm.c                       | 109 ++++++-
 arch/arm64/kvm/hyp/include/nvhe/spinlock.h |  96 ++++++
 arch/arm64/kvm/hyp/nvhe/Makefile           |   3 +-
 arch/arm64/kvm/hyp/nvhe/host.S             |   9 +
 arch/arm64/kvm/hyp/nvhe/hyp-init.S         |  82 ++++-
 arch/arm64/kvm/hyp/nvhe/hyp-main.c         |  57 +++-
 arch/arm64/kvm/hyp/nvhe/hyp.lds.S          |   3 +
 arch/arm64/kvm/hyp/nvhe/percpu.c           |  38 +++
 arch/arm64/kvm/hyp/nvhe/psci.c             | 333 +++++++++++++++++++++
 arch/arm64/mm/proc.S                       |  13 -
 drivers/firmware/psci/psci.c               |  27 +-
 include/linux/psci.h                       |  20 ++
 include/uapi/linux/psci.h                  |   8 +
 24 files changed, 948 insertions(+), 199 deletions(-)
 create mode 100644 arch/arm64/kvm/hyp/include/nvhe/spinlock.h
 create mode 100644 arch/arm64/kvm/hyp/nvhe/percpu.c
 create mode 100644 arch/arm64/kvm/hyp/nvhe/psci.c

--
2.29.1.341.ge80a0c044ae-goog