KVM: arm64: Fix S1PTW handling on RO memslots

commit 406504c7b0405d74d74c15a667cd4c4620c3e7a9 upstream.

A recent development on the EFI front has resulted in guests having
their page tables baked in the firmware binary, and mapped into the
IPA space as part of a read-only memslot. Not only is this legitimate,
but it also results in added security, so thumbs up.

It is possible to take an S1PTW translation fault if the S1 PTs are
unmapped at stage-2. However, KVM unconditionally treats S1PTW as a
write to correctly handle hardware AF/DB updates to the S1 PTs.
Furthermore, KVM injects an exception into the guest for S1PTW writes.
In the aforementioned case this results in the guest taking an abort
it won't recover from, as the S1 PTs mapping the vectors suffer from
the same problem.

So clearly our handling is... wrong.

Instead, switch to a two-pronged approach:

- On S1PTW translation fault, handle the fault as a read

- On S1PTW permission fault, handle the fault as a write

This is of no consequence to SW that *writes* to its PTs (the write
will trigger a non-S1PTW fault), and SW that uses RO PTs will not
use HW-assisted AF/DB anyway, as that'd be wrong.

Only in the case described in 2540b1eeaecf ("KVM: arm64: Assume write
fault on S1PTW permission fault on instruction fetch") do we end-up
with two back-to-back faults (page being evicted and faulted back).
I don't think this is a case worth optimising for.

Fixes: 2540b1eeaecf ("KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch")
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Regression-tested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index f65ff6b90f4a9ff3d17d73e41965eea25ae6faea..4a4c20a1bf26557ebfdac2af798e2ffd08e6091c 100644 (file)
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -378,8 +378,26 @@ static inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu)
 
 static inline bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
 {
-       if (kvm_vcpu_abt_iss1tw(vcpu))
-               return true;
+       if (kvm_vcpu_abt_iss1tw(vcpu)) {
+               /*
+                * Only a permission fault on a S1PTW should be
+                * considered as a write. Otherwise, page tables baked
+                * in a read-only memslot will result in an exception
+                * being delivered in the guest.
+                *
+                * The drawback is that we end-up faulting twice if the
+                * guest is using any of HW AF/DB: a translation fault
+                * to map the page containing the PT (read only at
+                * first), then a permission fault to allow the flags
+                * to be set.
+                */
+               switch (kvm_vcpu_trap_get_fault_type(vcpu)) {
+               case ESR_ELx_FSC_PERM:
+                       return true;
+               default:
+                       return false;
+               }
+       }
 
        if (kvm_vcpu_trap_is_iabt(vcpu))
                return false;