KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit

We set PSTATE.PAN to 1 on exiting from a guest if PAN support has
been compiled in and that it exists on the HW. However, this is not
necessarily correct.

In a nVHE configuration, there is no notion of PAN at EL2, so setting
PSTATE.PAN to anything is pointless.

Furthermore, not setting PAN to 0 when CONFIG_ARM64_PAN isn't set
means we run with the *guest's* PSTATE.PAN (which might be set to 1),
and we will explode on the next userspace access. Yes, the architecture
is delightful in that particular corner.

Fix the whole thing by always setting PAN to something when running
VHE (which implies PAN support), and only ignore it when running nVHE.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260107124600.2736328-1-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>

diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index a1ad12c72ebf14f81379aa0a0ac8727ec28a2982..ce516d8187b1baf314d0813de0323773112aab11 100644 (file)
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -300,6 +300,8 @@ void kvm_get_kimage_voffset(struct alt_instr *alt,
        __le32 *origptr, __le32 *updptr, int nr_inst);
 void kvm_compute_final_ctr_el0(struct alt_instr *alt,
        __le32 *origptr, __le32 *updptr, int nr_inst);
+void kvm_pan_patch_el2_entry(struct alt_instr *alt,
+                            __le32 *origptr, __le32 *updptr, int nr_inst);
 void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr, u64 elr_virt,
        u64 elr_phys, u64 par, uintptr_t vcpu, u64 far, u64 hpfar);
 

diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 9df51accbb025b41dfc451d6c44cdeed77667d33..106b15eb232a46eee9aa95a216cfe064dd74d83d 100644 (file)
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -91,7 +91,8 @@
  */
 #define pstate_field(op1, op2)         ((op1) << Op1_shift | (op2) << Op2_shift)
 #define PSTATE_Imm_shift               CRm_shift
-#define SET_PSTATE(x, r)               __emit_inst(0xd500401f | PSTATE_ ## r | ((!!x) << PSTATE_Imm_shift))
+#define ENCODE_PSTATE(x, r)            (0xd500401f | PSTATE_ ## r | ((!!x) << PSTATE_Imm_shift))
+#define SET_PSTATE(x, r)               __emit_inst(ENCODE_PSTATE(x, r))
 
 #define PSTATE_PAN                     pstate_field(0, 4)
 #define PSTATE_UAO                     pstate_field(0, 3)

diff --git a/arch/arm64/kernel/image-vars.h b/arch/arm64/kernel/image-vars.h
index 85bc629270bd9ec6996eb698d58d38526f97692c..211f0e2e55e211d08b89364e03062ed00dda82de 100644 (file)
--- a/arch/arm64/kernel/image-vars.h
+++ b/arch/arm64/kernel/image-vars.h
@@ -86,6 +86,7 @@ KVM_NVHE_ALIAS(kvm_patch_vector_branch);
 KVM_NVHE_ALIAS(kvm_update_va_mask);
 KVM_NVHE_ALIAS(kvm_get_kimage_voffset);
 KVM_NVHE_ALIAS(kvm_compute_final_ctr_el0);
+KVM_NVHE_ALIAS(kvm_pan_patch_el2_entry);
 KVM_NVHE_ALIAS(spectre_bhb_patch_loop_iter);
 KVM_NVHE_ALIAS(spectre_bhb_patch_loop_mitigation_enable);
 KVM_NVHE_ALIAS(spectre_bhb_patch_wa3);

diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S
index 9f4e8d68ab505cf4a7aa8673643d9b47ca1bc7cb..d1ccddf9e87d9702c06266351be91ba8ebaaf6c0 100644 (file)
--- a/arch/arm64/kvm/hyp/entry.S
+++ b/arch/arm64/kvm/hyp/entry.S
@@ -126,7 +126,9 @@ SYM_INNER_LABEL(__guest_exit, SYM_L_GLOBAL)
 
        add     x1, x1, #VCPU_CONTEXT
 
-       ALTERNATIVE(nop, SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
+       alternative_cb ARM64_ALWAYS_SYSTEM, kvm_pan_patch_el2_entry
+       nop
+       alternative_cb_end
 
        // Store the guest regs x2 and x3
        stp     x2, x3,   [x1, #CPU_XREG_OFFSET(2)]

diff --git a/arch/arm64/kvm/va_layout.c b/arch/arm64/kvm/va_layout.c
index 91b22a014610b22ffcc2883c9b499151d8e77f26..bf888d150dc792dc25ebec72a52712bac5173fe1 100644 (file)
--- a/arch/arm64/kvm/va_layout.c
+++ b/arch/arm64/kvm/va_layout.c
@@ -296,3 +296,31 @@ void kvm_compute_final_ctr_el0(struct alt_instr *alt,
        generate_mov_q(read_sanitised_ftr_reg(SYS_CTR_EL0),
                       origptr, updptr, nr_inst);
 }
+
+void kvm_pan_patch_el2_entry(struct alt_instr *alt,
+                            __le32 *origptr, __le32 *updptr, int nr_inst)
+{
+       /*
+        * If we're running at EL1 without hVHE, then SCTLR_EL2.SPAN means
+        * nothing to us (it is RES1), and we don't need to set PSTATE.PAN
+        * to anything useful.
+        */
+       if (!is_kernel_in_hyp_mode() && !cpus_have_cap(ARM64_KVM_HVHE))
+               return;
+
+       /*
+        * Leap of faith: at this point, we must be running VHE one way or
+        * another, and FEAT_PAN is required to be implemented. If KVM
+        * explodes at runtime because your system does not abide by this
+        * requirement, call your favourite HW vendor, they have screwed up.
+        *
+        * We don't expect hVHE to access any userspace mapping, so always
+        * set PSTATE.PAN on enty. Same thing if we have PAN enabled on an
+        * EL2 kernel. Only force it to 0 if we have not configured PAN in
+        * the kernel (and you know this is really silly).
+        */
+       if (cpus_have_cap(ARM64_KVM_HVHE) || IS_ENABLED(CONFIG_ARM64_PAN))
+               *updptr = cpu_to_le32(ENCODE_PSTATE(1, PAN));
+       else
+               *updptr = cpu_to_le32(ENCODE_PSTATE(0, PAN));
+}