Commit 86364832 authored by Marc Zyngier's avatar Marc Zyngier Committed by Oliver Upton
Browse files

KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit 



We set PSTATE.PAN to 1 on exiting from a guest if PAN support has
been compiled in and that it exists on the HW. However, this is not
necessarily correct.

In a nVHE configuration, there is no notion of PAN at EL2, so setting
PSTATE.PAN to anything is pointless.

Furthermore, not setting PAN to 0 when CONFIG_ARM64_PAN isn't set
means we run with the *guest's* PSTATE.PAN (which might be set to 1),
and we will explode on the next userspace access. Yes, the architecture
is delightful in that particular corner.

Fix the whole thing by always setting PAN to something when running
VHE (which implies PAN support), and only ignore it when running nVHE.

Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260107124600.2736328-1-maz@kernel.org


Signed-off-by: default avatarOliver Upton <oupton@kernel.org>
parent 9e27085c

arch/arm64/include/asm/kvm_asm.h

+2 −0
Original line number Diff line number Diff line
@@ -300,6 +300,8 @@ void kvm_get_kimage_voffset(struct alt_instr *alt, 
	__le32 *origptr, __le32 *updptr, int nr_inst);

void kvm_compute_final_ctr_el0(struct alt_instr *alt,

	__le32 *origptr, __le32 *updptr, int nr_inst);

void kvm_pan_patch_el2_entry(struct alt_instr *alt,

			     __le32 *origptr, __le32 *updptr, int nr_inst);

void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr, u64 elr_virt,

	u64 elr_phys, u64 par, uintptr_t vcpu, u64 far, u64 hpfar);

arch/arm64/include/asm/sysreg.h

+2 −1
Original line number Diff line number Diff line
@@ -91,7 +91,8 @@ 
 */

#define pstate_field(op1, op2)		((op1) << Op1_shift | (op2) << Op2_shift)

#define PSTATE_Imm_shift		CRm_shift

#define SET_PSTATE(x, r)		__emit_inst(0xd500401f | PSTATE_ ## r | ((!!x) << PSTATE_Imm_shift))

#define ENCODE_PSTATE(x, r)		(0xd500401f | PSTATE_ ## r | ((!!x) << PSTATE_Imm_shift))

#define SET_PSTATE(x, r)		__emit_inst(ENCODE_PSTATE(x, r))



#define PSTATE_PAN			pstate_field(0, 4)

#define PSTATE_UAO			pstate_field(0, 3)

arch/arm64/kernel/image-vars.h

+1 −0
Original line number Diff line number Diff line
@@ -86,6 +86,7 @@ KVM_NVHE_ALIAS(kvm_patch_vector_branch); 
KVM_NVHE_ALIAS(kvm_update_va_mask);

KVM_NVHE_ALIAS(kvm_get_kimage_voffset);

KVM_NVHE_ALIAS(kvm_compute_final_ctr_el0);

KVM_NVHE_ALIAS(kvm_pan_patch_el2_entry);

KVM_NVHE_ALIAS(spectre_bhb_patch_loop_iter);

KVM_NVHE_ALIAS(spectre_bhb_patch_loop_mitigation_enable);

KVM_NVHE_ALIAS(spectre_bhb_patch_wa3);

arch/arm64/kvm/hyp/entry.S

+3 −1
Original line number Diff line number Diff line
@@ -126,7 +126,9 @@ SYM_INNER_LABEL(__guest_exit, SYM_L_GLOBAL) 


	add	x1, x1, #VCPU_CONTEXT



	ALTERNATIVE(nop, SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)

	alternative_cb ARM64_ALWAYS_SYSTEM, kvm_pan_patch_el2_entry

	nop

	alternative_cb_end



	// Store the guest regs x2 and x3

	stp	x2, x3,   [x1, #CPU_XREG_OFFSET(2)]

arch/arm64/kvm/va_layout.c

+28 −0
Original line number Diff line number Diff line
@@ -296,3 +296,31 @@ void kvm_compute_final_ctr_el0(struct alt_instr *alt, 
	generate_mov_q(read_sanitised_ftr_reg(SYS_CTR_EL0),

		       origptr, updptr, nr_inst);

}



void kvm_pan_patch_el2_entry(struct alt_instr *alt,

			     __le32 *origptr, __le32 *updptr, int nr_inst)

{

	/*

	 * If we're running at EL1 without hVHE, then SCTLR_EL2.SPAN means

	 * nothing to us (it is RES1), and we don't need to set PSTATE.PAN

	 * to anything useful.

	 */

	if (!is_kernel_in_hyp_mode() && !cpus_have_cap(ARM64_KVM_HVHE))

		return;



	/*

	 * Leap of faith: at this point, we must be running VHE one way or

	 * another, and FEAT_PAN is required to be implemented. If KVM

	 * explodes at runtime because your system does not abide by this

	 * requirement, call your favourite HW vendor, they have screwed up.

	 *

	 * We don't expect hVHE to access any userspace mapping, so always

	 * set PSTATE.PAN on enty. Same thing if we have PAN enabled on an

	 * EL2 kernel. Only force it to 0 if we have not configured PAN in

	 * the kernel (and you know this is really silly).

	 */

	if (cpus_have_cap(ARM64_KVM_HVHE) || IS_ENABLED(CONFIG_ARM64_PAN))

		*updptr = cpu_to_le32(ENCODE_PSTATE(1, PAN));

	else

		*updptr = cpu_to_le32(ENCODE_PSTATE(0, PAN));

}