[PATCH v2 0/5] KVM: arm64: Restrict host hypercalls when pKVM is enabled

[Will Deacon]

Hi all,

This is version two of the patches I previously posted here:

  https://lore.kernel.org/r/20210923112256.15767-1-will@kernel.org

Changes since v2 include:

  - Add a comment about pkvm_prot_finalize() returning -EPERM
  - Fixed ordering of hypercalls in 'host_hcall' array
  - Added reviewed-by tags

Patches based on -rc2. Feedback welcome.

Cheers,

Will

Cc: Marc Zyngier <maz at kernel.org>
Cc: Quentin Perret <qperret at google.com>
Cc: Catalin Marinas <catalin.marinas at arm.com>
Cc: Alexandru Elisei <alexandru.elisei at arm.com>
Cc: Suzuki K Poulose <suzuki.poulose at arm.com>
Cc: Mark Rutland <mark.rutland at arm.com>
Cc: kvmarm at lists.cs.columbia.edu

--->8

Will Deacon (5):
  arm64: Prevent kexec and hibernation if is_protected_kvm_enabled()
  KVM: arm64: Reject stub hypercalls after pKVM has been initialised
  KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
  KVM: arm64: Prevent re-finalisation of pKVM for a given CPU
  KVM: arm64: Disable privileged hypercalls after pKVM finalisation

 arch/arm64/include/asm/kvm_asm.h      | 43 ++++++++++---------
 arch/arm64/kernel/smp.c               |  3 +-
 arch/arm64/kvm/arm.c                  | 61 ++++++++++++++++++---------
 arch/arm64/kvm/hyp/nvhe/host.S        | 26 ++++++++----
 arch/arm64/kvm/hyp/nvhe/hyp-main.c    | 37 +++++++++++-----
 arch/arm64/kvm/hyp/nvhe/mem_protect.c |  3 ++
 6 files changed, 113 insertions(+), 60 deletions(-)

-- 
2.33.0.800.g4c38ced690-goog