From patchwork Mon Nov 16 20:42:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Brazdil X-Patchwork-Id: 11910803 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E495FC55ABD for ; Mon, 16 Nov 2020 20:44:04 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 92E852223D for ; Mon, 16 Nov 2020 20:44:04 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="KKGhHsTz"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="va51Yehh" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 92E852223D Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=ZGHLBXeFjGUS6Ks4jo96IJL/DwTW3XTI3LbV8Lfbklc=; b=KKGhHsTzi1najuT9IklKo1TPFf sE4IWiYhPdpMlVR81Hqg4jtqVXokkI/BXIdX/VkV1VMlZGrXu9EzVFjBL+6Di/qpWU3BZsZ3CX9xi 7hA3TfuLRcZJF3h0fL8ln7CBFurNFiEmh85mqNMxkB+NFTU7K6yFw15JI09UDC/JCWW9jpo7rD+Jc Tjo8iiq2OVVcuWr+hcVzQ5zswFFwVi3XXEKzigSCO3/3UFK0qep6ngngPrXjwVYgnKrGri8fc9Y21 iSUmzvr+tDJOmR0L8cDLajicEiK1U6LxZwZsuvYyP9asANviBNq4W8CWLAvJnYLGFvA+hqEpj5slQ YyjnI/yw==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kelLU-0007dZ-83; Mon, 16 Nov 2020 20:43:28 +0000 Received: from mail-wr1-x444.google.com ([2a00:1450:4864:20::444]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kelLQ-0007cl-UT for linux-arm-kernel@lists.infradead.org; Mon, 16 Nov 2020 20:43:26 +0000 Received: by mail-wr1-x444.google.com with SMTP id s8so20251430wrw.10 for ; Mon, 16 Nov 2020 12:43:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ez4ezJGM8Jye68W6k3JKSGLh1n6D0kATjez8aR9Nk54=; b=va51YehhJ8FuXErziEVWdMd9wXcAcl4xZugOQZ9QYh78uUUBQf4izOIsceIj+DHENe nVjDRANKSDKWBZZ21bMns1g3Mz+TdXqyIxJfNgMgv/p5XDCwEVQo99V2HiPBEcWCwAdd GyZB3uAV/RqwGwjUDJMSBuywaXNBBJWNLAKST1NG0orO5Lqa0jG9vv9eTNvMQYHEGvcd MdAPMiuE89gOqAp+ue95nMTLAI4gmZx2aADaKMGLS24JNy0bmghOh0zHYvF4Zzat+XBJ rKsI7VCFh+MhIsPDmV+KrXxZAL6DvY7HQ1k9Omh3EdNbRSNfQIAkJr17/gEx9SiUt1+G Eq4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ez4ezJGM8Jye68W6k3JKSGLh1n6D0kATjez8aR9Nk54=; b=nl/5rLVuzNIcq2EZXONOfQ1K1TOKsf6Yz7bOgPuPKrh2LqSGN/0nqr9opznzA3XHFq lWDLPB/D6sARukQdjqmT2i3bNhDnzomsLEfnc3BD8fYdntbdaWQVGgdCYjgOH+XPnLza Vfdtwhylex4DBniwL/f+YizxjEnQ53XYDLLNJbiAUxm3kIIc9G0mUjhO1dpk/ZcSbUhM uhP/EdDsnul9ypmr2L+aAYGeIHp02ErsXeK5S7hd38SVZo0g4bNYpgBUug0XMfh/Yejo xnzss7gGtZqaQtc680UzA487q8EmesY3gJY2AJdz6V61/OL6PZuDQaBFLaNACOkWzsaC CWGQ== X-Gm-Message-State: AOAM530wGxxDlEkYyPAduxKXijTKkCDoOffhamYhukbVnitbAvjEaBcJ 1zFkreN6zfj64Kfbb8I8Z5o5zQ== X-Google-Smtp-Source: ABdhPJzjQSGFtJU+tB0SjZoeZ35rs2S4wU4sI06EPwHTB2KSFHgQdm+IXGMc26iCRHlhPIq+4sBJLg== X-Received: by 2002:a05:6000:345:: with SMTP id e5mr20485510wre.333.1605559402826; Mon, 16 Nov 2020 12:43:22 -0800 (PST) Received: from localhost ([2a01:4b00:8523:2d03:bc40:bd71:373a:1b33]) by smtp.gmail.com with ESMTPSA id l24sm566784wmi.7.2020.11.16.12.43.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 16 Nov 2020 12:43:21 -0800 (PST) From: David Brazdil To: kvmarm@lists.cs.columbia.edu Subject: [PATCH v2 00/24] Opt-in always-on nVHE hypervisor Date: Mon, 16 Nov 2020 20:42:54 +0000 Message-Id: <20201116204318.63987-1-dbrazdil@google.com> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201116_154325_689518_C5D92D86 X-CRM114-Status: GOOD ( 20.30 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , kernel-team@android.com, Lorenzo Pieralisi , Andrew Walbran , Suzuki K Poulose , Marc Zyngier , Quentin Perret , linux-kernel@vger.kernel.org, James Morse , linux-arm-kernel@lists.infradead.org, Catalin Marinas , Tejun Heo , Dennis Zhou , Christoph Lameter , David Brazdil , Will Deacon , Julien Thierry , Andrew Scull Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org As we progress towards being able to keep guest state private to the host running nVHE hypervisor, this series allows the hypervisor to install itself on newly booted CPUs before the host is allowed to run on them. All functionality described below is opt-in, guarded by an early param 'kvm-arm.protected'. Future patches specific to the new "protected" mode should be hidden behind the same param. The hypervisor starts trapping host SMCs and intercepting host's PSCI CPU_ON/SUSPEND calls. It replaces the host's entry point with its own, initializes the EL2 state of the new CPU and installs the nVHE hyp vector before ERETing to the host's entry point. The kernel checks new cores' features against the finalized system capabilities. To avoid the need to move this code/data to EL2, the implementation only allows to boot cores that were online at the time of KVM initialization and therefore had been checked already. Other PSCI SMCs are forwarded to EL3, though only the known set of SMCs implemented in the kernel is allowed. Non-PSCI SMCs are also forwarded to EL3. Future changes will need to ensure the safety of all SMCs wrt. private guests. The host is still allowed to reset EL2 back to the stub vector, eg. for hibernation or kexec, but will not disable nVHE when there are no VMs. Tested on Rock Pi 4b, based on 5.10-rc4. changes since v1: * early param sets a capability instead of a static key * assume SMCCC v1.2 for host SMC forwarding * fix reserved SMC ID range for PSCI * split init_el2_state into smaller macros, move to el2_setup.h * many small cleanups changes since RFC: * add early param to make features opt-in * simplify CPU_ON/SUSPEND implementation * replace spinlocks with CAS atomic * make cpu_logical_map ro_after_init David Brazdil (24): psci: Support psci_ops.get_version for v0.1 psci: Accessor for configured PSCI function IDs arm64: Make cpu_logical_map() take unsigned int arm64: Move MAIR_EL1_SET to asm/memory.h kvm: arm64: Initialize MAIR_EL2 using a constant kvm: arm64: Move hyp-init params to a per-CPU struct kvm: arm64: Refactor handle_trap to use a switch kvm: arm64: Add SMC handler in nVHE EL2 kvm: arm64: Add .hyp.data..ro_after_init ELF section kvm: arm64: Support per_cpu_ptr in nVHE hyp code kvm: arm64: Create nVHE copy of cpu_logical_map kvm: arm64: Bootstrap PSCI SMC handler in nVHE EL2 kvm: arm64: Add offset for hyp VA <-> PA conversion kvm: arm64: Forward safe PSCI SMCs coming from host kvm: arm64: Extract parts of el2_setup into a macro kvm: arm64: Extract __do_hyp_init into a helper function kvm: arm64: Add CPU entry point in nVHE hyp kvm: arm64: Add function to enter host from KVM nVHE hyp code kvm: arm64: Intercept host's PSCI_CPU_ON SMCs kvm: arm64: Intercept host's CPU_SUSPEND PSCI SMCs kvm: arm64: Add kvm-arm.protected early kernel parameter kvm: arm64: Keep nVHE EL2 vector installed kvm: arm64: Trap host SMCs in protected mode. kvm: arm64: Fix EL2 mode availability checks arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/el2_setup.h | 185 +++++++++++++++++ arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_asm.h | 16 +- arch/arm64/include/asm/kvm_hyp.h | 8 + arch/arm64/include/asm/memory.h | 29 ++- arch/arm64/include/asm/percpu.h | 6 + arch/arm64/include/asm/sections.h | 1 + arch/arm64/include/asm/smp.h | 4 +- arch/arm64/include/asm/sysreg.h | 30 +++ arch/arm64/include/asm/virt.h | 26 +++ arch/arm64/kernel/asm-offsets.c | 5 + arch/arm64/kernel/cpufeature.c | 29 +++ arch/arm64/kernel/head.S | 144 ++----------- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/setup.c | 2 +- arch/arm64/kernel/vmlinux.lds.S | 10 + arch/arm64/kvm/arm.c | 94 +++++++-- arch/arm64/kvm/hyp/nvhe/Makefile | 3 +- arch/arm64/kvm/hyp/nvhe/host.S | 47 +++++ arch/arm64/kvm/hyp/nvhe/hyp-init.S | 90 +++++++-- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 47 ++++- arch/arm64/kvm/hyp/nvhe/hyp-smp.c | 40 ++++ arch/arm64/kvm/hyp/nvhe/hyp.lds.S | 1 + arch/arm64/kvm/hyp/nvhe/psci-relay.c | 289 +++++++++++++++++++++++++++ arch/arm64/kvm/hyp/nvhe/switch.c | 5 +- arch/arm64/kvm/va_layout.c | 30 ++- arch/arm64/mm/proc.S | 15 +- drivers/firmware/psci/psci.c | 21 +- include/linux/psci.h | 10 + 30 files changed, 977 insertions(+), 217 deletions(-) create mode 100644 arch/arm64/include/asm/el2_setup.h create mode 100644 arch/arm64/kvm/hyp/nvhe/hyp-smp.c create mode 100644 arch/arm64/kvm/hyp/nvhe/psci-relay.c --- 2.29.2.299.gdc1121823c-goog