KVM: arm64: Protect the .hyp sections from the host

Browse source

When KVM runs in nVHE protected mode, use the host stage 2 to unmap the
hypervisor sections by marking them as owned by the hypervisor itself.
The long-term goal is to ensure the EL2 code can remain robust
regardless of the host's state, so this starts by making sure the host
cannot e.g. write to the .hyp sections directly.

Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210319100146.1149909-39-qperret@google.com

...

This commit is contained in:

Quentin Perret 2021-03-19 10:01:46 +00:00 • committed by Marc Zyngier

parent 9589a38cdf

commit 90134ac9ca

5 changed files with 91 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

arch/arm64/include/asm/kvm_asm.h

View file

46

arch/arm64/kvm/arm.c

View file

2

arch/arm64/kvm/hyp/include/nvhe/mem_protect.h

View file

9

arch/arm64/kvm/hyp/nvhe/hyp-main.c

View file

33

arch/arm64/kvm/hyp/nvhe/mem_protect.c

View file