linux.git/arch/arm64/kvm/hyp/nvhe/stacktrace.c, branch master

KVM: arm64: Add PKVM_DISABLE_STAGE2_ON_PANIC

2026-03-11T08:51:16+00:00

On NVHE_EL2_DEBUG, when using pKVM, the host stage-2 is relaxed to grant
the kernel access to the stacktrace, hypervisor bug table and text to
symbolize addresses. This is unsafe for production. In preparation for
adding more debug options to NVHE_EL2_DEBUG, decouple the stage-2
relaxation into a separate option.

While at it, rename PROTECTED_NVHE_STACKTRACE into PKVM_STACKTRACE,
following the same naming scheme as PKVM_DISABLE_STAGE2_ON_PANIC.

Reviewed-by: Kalesh Singh 
Signed-off-by: Vincent Donnefort 
Link: https://patch.msgid.link/20260309162516.2623589-20-vdonnefort@google.com
Signed-off-by: Marc Zyngier

arm64: kvm: Introduce nvhe stack size constants

2025-01-08T11:25:28+00:00

Refactor nvhe stack code to use NVHE_STACK_SIZE/SHIFT constants,
instead of directly using PAGE_SIZE/SHIFT. This makes the code a bit
easier to read, without introducing any functional changes.

Cc: Marc Zyngier 
Cc: Mark Brown 
Cc: Mark Rutland 
Cc: Will Deacon 
Signed-off-by: Kalesh Singh 
Link: https://lore.kernel.org/r/20241112003336.1375584-1-kaleshsingh@google.com
Signed-off-by: Marc Zyngier

arm64: stacktrace: track hyp stacks in unwinder's address space

2022-09-09T11:30:08+00:00

Currently unwind_next_frame_record() has an optional callback to convert
the address space of the FP. This is necessary for the NVHE unwinder,
which tracks the stacks in the hyp VA space, but accesses the frame
records in the kernel VA space.

This is a bit unfortunate since it clutters unwind_next_frame_record(),
which will get in the way of future rework.

Instead, this patch changes the NVHE unwinder to track the stacks in the
kernel's VA space and translate to FP prior to calling
unwind_next_frame_record(). This removes the need for the translate_fp()
callback, as all unwinders consistently track stacks in the native
address space of the unwinder.

At the same time, this patch consolidates the generation of the stack
addresses behind the stackinfo_get_*() helpers.

Signed-off-by: Mark Rutland 
Reviewed-by: Kalesh Singh 
Reviewed-by: Madhavan T. Venkataraman 
Reviewed-by: Mark Brown 
Cc: Fuad Tabba 
Cc: Marc Zyngier 
Cc: Will Deacon 
Link: https://lore.kernel.org/r/20220901130646.1316937-10-mark.rutland@arm.com
Signed-off-by: Catalin Marinas

arm64: stacktrace: track all stack boundaries explicitly

2022-09-09T11:30:08+00:00

Currently we call an on_accessible_stack() callback for each step of the
unwinder, requiring redundant work to be performed in the core of the
unwind loop (e.g. disabling preemption around accesses to per-cpu
variables containing stack boundaries). To prevent unwind loops which go
through a stack multiple times, we have to track the set of unwound
stacks, requiring a stack_type enum which needs to cater for all the
stacks of all possible callees. To prevent loops within a stack, we must
track the prior FP values.

This patch reworks the unwinder to minimize the work in the core of the
unwinder, and to remove the need for the stack_type enum. The set of
accessible stacks (and their boundaries) are determined at the start of
the unwind, and the current stack is tracked during the unwind, with
completed stacks removed from the set of accessible stacks. This makes
the boundary checks more accurate (e.g. detecting overlapped frame
records), and removes the need for separate tracking of the prior FP and
visited stacks.

Signed-off-by: Mark Rutland 
Reviewed-by: Kalesh Singh 
Reviewed-by: Madhavan T. Venkataraman 
Reviewed-by: Mark Brown 
Cc: Fuad Tabba 
Cc: Marc Zyngier 
Cc: Will Deacon 
Link: https://lore.kernel.org/r/20220901130646.1316937-9-mark.rutland@arm.com
Signed-off-by: Catalin Marinas

arm64: stacktrace: rework stack boundary discovery

2022-09-09T11:30:07+00:00

In subsequent patches we'll want to acquire the stack boundaries
ahead-of-time, and we'll need to be able to acquire the relevant
stack_info regardless of whether we have an object the happens to be on
the stack.

This patch replaces the on_XXX_stack() helpers with stackinfo_get_XXX()
helpers, with the caller being responsible for the checking whether an
object is on a relevant stack. For the moment this is moved into the
on_accessible_stack() functions, making these slightly larger;
subsequent patches will remove the on_accessible_stack() functions and
simplify the logic.

The on_irq_stack() and on_task_stack() helpers are kept as these are
used by IRQ entry sequences and stackleak respectively. As they're only
used as predicates, the stack_info pointer parameter is removed in both
cases.

As the on_accessible_stack() functions are always passed a non-NULL info
pointer, these now update info unconditionally. When updating the type
to STACK_TYPE_UNKNOWN, the low/high bounds are also modified, but as
these will not be consumed this should have no adverse affect.

There should be no functional change as a result of this patch.

Signed-off-by: Mark Rutland 
Reviewed-by: Kalesh Singh 
Reviewed-by: Madhavan T. Venkataraman 
Reviewed-by: Mark Brown 
Cc: Fuad Tabba 
Cc: Marc Zyngier 
Cc: Will Deacon 
Link: https://lore.kernel.org/r/20220901130646.1316937-7-mark.rutland@arm.com
Signed-off-by: Catalin Marinas

arm64: stacktrace: rename unwind_next_common() -> unwind_next_frame_record()

2022-09-09T11:30:07+00:00

The unwind_next_common() function unwinds a single frame record. There
are other unwind steps (e.g. unwinding through trampolines) which are
handled in the regular kernel unwinder, and in future there may be other
common unwind helpers.

Clarify the purpose of unwind_next_common() by renaming it to
unwind_next_frame_record(). At the same time, add commentary, and delete
the redundant comment at the top of asm/stacktrace/common.h.

There should be no functional change as a result of this patch.

Signed-off-by: Mark Rutland 
Reviewed-by: Kalesh Singh 
Reviewed-by: Madhavan T. Venkataraman 
Reviewed-by: Mark Brown 
Cc: Fuad Tabba 
Cc: Marc Zyngier 
Cc: Will Deacon 
Link: https://lore.kernel.org/r/20220901130646.1316937-4-mark.rutland@arm.com
Signed-off-by: Catalin Marinas

arm64: stacktrace: simplify unwind_next_common()

2022-09-09T11:30:07+00:00

Currently unwind_next_common() takes a pointer to a stack_info which is
only ever used within unwind_next_common().

Make it a local variable and simplify callers.

There should be no functional change as a result of this patch.

Signed-off-by: Mark Rutland 
Reviewed-by: Kalesh Singh 
Reviewed-by: Madhavan T. Venkataraman 
Reviewed-by: Mark Brown 
Cc: Fuad Tabba 
Cc: Marc Zyngier 
Cc: Will Deacon 
Link: https://lore.kernel.org/r/20220901130646.1316937-3-mark.rutland@arm.com
Signed-off-by: Catalin Marinas

KVM: arm64: Don't open code ARRAY_SIZE()

2022-07-27T17:18:38+00:00

Use ARRAY_SIZE() instead of an open-coded version.

Signed-off-by: Oliver Upton 
Signed-off-by: Marc Zyngier 
Reviewed-by: Kalesh Singh 
Tested-by: Kalesh Singh 
Link: https://lore.kernel.org/r/20220727142906.1856759-6-maz@kernel.org

KVM: arm64: Make unwind()/on_accessible_stack() per-unwinder functions

2022-07-27T17:18:03+00:00

Having multiple versions of on_accessible_stack() (one per unwinder)
makes it very hard to reason about what is used where due to the
complexity of the various includes, the forward declarations, and
the reliance on everything being 'inline'.

Instead, move the code back where it should be. Each unwinder
implements:

- on_accessible_stack() as well as the helpers it depends on,

- unwind()/unwind_next(), as they pass on_accessible_stack as
  a parameter to unwind_next_common() (which is the only common
  code here)

This hardly results in any duplication, and makes it much
easier to reason about the code.

Signed-off-by: Marc Zyngier 
Reviewed-by: Kalesh Singh 
Tested-by: Kalesh Singh 
Reviewed-by: Oliver Upton 
Link: https://lore.kernel.org/r/20220727142906.1856759-4-maz@kernel.org

KVM: arm64: Save protected-nVHE (pKVM) hyp stacktrace

2022-07-26T09:51:17+00:00

In protected nVHE mode, the host cannot access private owned hypervisor
memory. Also the hypervisor aims to remains simple to reduce the attack
surface and does not provide any printk support.

For the above reasons, the approach taken to provide hypervisor stacktraces
in protected mode is:
   1) Unwind and save the hyp stack addresses in EL2 to a shared buffer
      with the host (done in this patch).
   2) Delegate the dumping and symbolization of the addresses to the
      host in EL1 (later patch in the series).

On hyp_panic(), the hypervisor prepares the stacktrace before returning to
the host.

Signed-off-by: Kalesh Singh 
Signed-off-by: Marc Zyngier 
Link: https://lore.kernel.org/r/20220726073750.3219117-16-kaleshsingh@google.com