From patchwork Mon Aug 9 15:24:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Quentin Perret X-Patchwork-Id: 12426829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C540DC4338F for ; Mon, 9 Aug 2021 15:39:22 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 74FF160F8F for ; Mon, 9 Aug 2021 15:39:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 74FF160F8F Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:References: Mime-Version:Message-Id:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=rlCOMJMK0RgnQrIQqaHPMFByqdMJpil3oGy5DER7Lvo=; b=q/aBwW4uBB5vq5AYJ4bok8gZ3t 9ltF1/hbd3FNf7WTJYxoyyZ0pjJPzvk6HtETWAA+DjehgMFVY+LuF1ezh+zPsKj5yc+bMgVJz5E+p DS20n7hqAp209RLJe4N4vW9ATRL/CYiSCYNnLvru8xaMprT1iN6R1+iUqAsgLI04eOD7h9mh2X01z h55msL7NquEmY6bxExnB+tJeYrMB7/rpAY7bgE1OKRknhKuAUn+acsGd+/9+vLOpYZGvofn53AoB6 b218llSF0rzprZ42ANx43S/Q/8+QeMvMybgg7jHOB9S+gXgkgen+IdV4+/31YwKlj3x0dHex/QlOr xO1h2hpQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mD7KY-001Cja-Dw; Mon, 09 Aug 2021 15:36:47 +0000 Received: from mail-ej1-x649.google.com ([2a00:1450:4864:20::649]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mD79f-00182L-DW for linux-arm-kernel@lists.infradead.org; Mon, 09 Aug 2021 15:25:33 +0000 Received: by mail-ej1-x649.google.com with SMTP id v19-20020a170906b013b02905b2f1bbf8f3so579304ejy.6 for ; Mon, 09 Aug 2021 08:25:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=dKAdWq+um7+5WCTr7spdVMqonShc4XNlQTBou41SonA=; b=X5MaIqpMDpsgElSyO+XEpl5K8TmNOlWy9iyRmNdtwE3HyEvHRuU55AsAcW15E0tQE+ jA7MindYid7mLIBWyt24HUfu2l9pN2kywv5tYtKGVJmJSXG3gEPe8HQuJ1uE3t82jb2R R6I208HaQXPyBO8Gljjafvuzdzjrx0AwC2KgLjl1Or4B38Z2ft0Z6BYxVAt6gyfpwqgX w/kusFQ9wey4B0Z5v7QvjKeXWm8jUbg0/0P+Q1bns7OQUUAjlTXjCQ02a2bo96MuFmHS bWb4AiP60ALuRjZ7a9zAqWfFUrcREzLPOMvxQHN87KICnFZF4oBK0KjWIxyjZ+LcJyBH yhMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=dKAdWq+um7+5WCTr7spdVMqonShc4XNlQTBou41SonA=; b=hPQil4sHFkEfB6PTRsV/QXgBKls1l35AulRWeTGBOAnE4lTRFuTWRP9Yb2p51ug1yd QvLLUXwNHLEe/G+UkD1kV+6bHmdWurDESSAtiNbTx5/X7jnwK0zGrFh+DttlgxERRocQ Rl08pDqKW9S7RQ6iJNG1T2BEzrznP+nOmr2074ONrye/xWtjCEfJI3uVSz82muiQYEPI aMdmQC+JpB28SbxKT+WM6OCyh13pjRO3rJKG5UJiGtAyHUEzoTj6fXKWsYfA7AYYtgY0 uGJJeYwW9WHv/wLJh5Da319ExwWW0/+pS99kw1wCiChLKQcKmGNROlWt3Fz6zZYjLmRh FOpg== X-Gm-Message-State: AOAM532I8m2rIJCAX1MSdiBmYCK2bhwP1UdFEhl+aYDmmN8oc7BwWs55 5ghvnuDwZQ/BM6gyFy6YTBfPt1nuBuC6 X-Google-Smtp-Source: ABdhPJzPp9qFi5jNPXGgwRFOFgI/f0ff/7l9UlxcQ8qnZH4O21lc+UlEQ/M6EMuoSsJAxxc6uAUQfLyq71O/ X-Received: from luke.lon.corp.google.com ([2a00:79e0:d:210:b0e8:d460:758b:a0ae]) (user=qperret job=sendgmr) by 2002:aa7:cd9a:: with SMTP id x26mr30279924edv.26.1628522728841; Mon, 09 Aug 2021 08:25:28 -0700 (PDT) Date: Mon, 9 Aug 2021 16:24:44 +0100 In-Reply-To: <20210809152448.1810400-1-qperret@google.com> Message-Id: <20210809152448.1810400-18-qperret@google.com> Mime-Version: 1.0 References: <20210809152448.1810400-1-qperret@google.com> X-Mailer: git-send-email 2.32.0.605.g8dce9f2422-goog Subject: [PATCH v4 17/21] KVM: arm64: Mark host bss and rodata section as shared From: Quentin Perret To: maz@kernel.org, james.morse@arm.com, alexandru.elisei@arm.com, suzuki.poulose@arm.com, catalin.marinas@arm.com, will@kernel.org Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, linux-kernel@vger.kernel.org, ardb@kernel.org, qwandor@google.com, tabba@google.com, dbrazdil@google.com, kernel-team@android.com, qperret@google.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210809_082531_529391_F88EDEF7 X-CRM114-Status: GOOD ( 20.48 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org As the hypervisor maps the host's .bss and .rodata sections in its stage-1, make sure to tag them as shared in hyp and host page-tables. But since the hypervisor relies on the presence of these mappings, we cannot let the host in complete control of the memory regions -- it must not unshare or donate them to another entity for example. To prevent this, let's transfer the ownership of those ranges to the hypervisor itself, and share the pages back with the host. Signed-off-by: Quentin Perret Reviewed-by: Fuad Tabba --- arch/arm64/kvm/hyp/nvhe/setup.c | 82 +++++++++++++++++++++++++++++---- 1 file changed, 74 insertions(+), 8 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/setup.c b/arch/arm64/kvm/hyp/nvhe/setup.c index 0b574d106519..57c27846320f 100644 --- a/arch/arm64/kvm/hyp/nvhe/setup.c +++ b/arch/arm64/kvm/hyp/nvhe/setup.c @@ -58,6 +58,7 @@ static int recreate_hyp_mappings(phys_addr_t phys, unsigned long size, { void *start, *end, *virt = hyp_phys_to_virt(phys); unsigned long pgt_size = hyp_s1_pgtable_pages() << PAGE_SHIFT; + enum kvm_pgtable_prot prot; int ret, i; /* Recreate the hyp page-table using the early page allocator */ @@ -83,10 +84,6 @@ static int recreate_hyp_mappings(phys_addr_t phys, unsigned long size, if (ret) return ret; - ret = pkvm_create_mappings(__start_rodata, __end_rodata, PAGE_HYP_RO); - if (ret) - return ret; - ret = pkvm_create_mappings(__hyp_rodata_start, __hyp_rodata_end, PAGE_HYP_RO); if (ret) return ret; @@ -95,10 +92,6 @@ static int recreate_hyp_mappings(phys_addr_t phys, unsigned long size, if (ret) return ret; - ret = pkvm_create_mappings(__hyp_bss_end, __bss_stop, PAGE_HYP_RO); - if (ret) - return ret; - ret = pkvm_create_mappings(virt, virt + size, PAGE_HYP); if (ret) return ret; @@ -117,6 +110,24 @@ static int recreate_hyp_mappings(phys_addr_t phys, unsigned long size, return ret; } + /* + * Map the host's .bss and .rodata sections RO in the hypervisor, but + * transfer the ownership from the host to the hypervisor itself to + * make sure it can't be donated or shared with another entity. + * + * The ownership transition requires matching changes in the host + * stage-2. This will be done later (see finalize_host_mappings()) once + * the hyp_vmemmap is addressable. + */ + prot = pkvm_mkstate(PAGE_HYP_RO, PKVM_PAGE_SHARED_OWNED); + ret = pkvm_create_mappings(__start_rodata, __end_rodata, prot); + if (ret) + return ret; + + ret = pkvm_create_mappings(__hyp_bss_end, __bss_stop, prot); + if (ret) + return ret; + return 0; } @@ -148,6 +159,57 @@ static void hpool_put_page(void *addr) hyp_put_page(&hpool, addr); } +static int finalize_host_mappings_walker(u64 addr, u64 end, u32 level, + kvm_pte_t *ptep, + enum kvm_pgtable_walk_flags flag, + void * const arg) +{ + enum kvm_pgtable_prot prot; + enum pkvm_page_state state; + kvm_pte_t pte = *ptep; + phys_addr_t phys; + + if (!kvm_pte_valid(pte)) + return 0; + + if (level != (KVM_PGTABLE_MAX_LEVELS - 1)) + return -EINVAL; + + phys = kvm_pte_to_phys(pte); + if (!addr_is_memory(phys)) + return 0; + + /* + * Adjust the host stage-2 mappings to match the ownership attributes + * configured in the hypervisor stage-1. + */ + state = pkvm_getstate(kvm_pgtable_hyp_pte_prot(pte)); + switch (state) { + case PKVM_PAGE_OWNED: + return host_stage2_set_owner_locked(phys, PAGE_SIZE, pkvm_hyp_id); + case PKVM_PAGE_SHARED_OWNED: + prot = pkvm_mkstate(PKVM_HOST_MEM_PROT, PKVM_PAGE_SHARED_BORROWED); + break; + case PKVM_PAGE_SHARED_BORROWED: + prot = pkvm_mkstate(PKVM_HOST_MEM_PROT, PKVM_PAGE_SHARED_OWNED); + break; + default: + return -EINVAL; + } + + return host_stage2_idmap_locked(phys, PAGE_SIZE, prot); +} + +static int finalize_host_mappings(void) +{ + struct kvm_pgtable_walker walker = { + .cb = finalize_host_mappings_walker, + .flags = KVM_PGTABLE_WALK_LEAF, + }; + + return kvm_pgtable_walk(&pkvm_pgtable, 0, BIT(pkvm_pgtable.ia_bits), &walker); +} + void __noreturn __pkvm_init_finalise(void) { struct kvm_host_data *host_data = this_cpu_ptr(&kvm_host_data); @@ -167,6 +229,10 @@ void __noreturn __pkvm_init_finalise(void) if (ret) goto out; + ret = finalize_host_mappings(); + if (ret) + goto out; + pkvm_pgtable_mm_ops = (struct kvm_pgtable_mm_ops) { .zalloc_page = hyp_zalloc_hyp_page, .phys_to_virt = hyp_phys_to_virt,