KVM: arm64: Don't translate FAR if invalid/unsafe

Don't re-walk the page tables if an SEA occurred during the faulting
page table walk to avoid taking a fatal exception in the hyp.
Additionally, check that FAR_EL2 is valid for SEAs not taken on PTW
as the architecture doesn't guarantee it contains the fault VA.

Finally, fix up the rest of the abort path by checking for SEAs early
and bugging the VM if we get further along with an UNKNOWN fault IPA.

Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20250402201725.2963645-4-oliver.upton@linux.dev
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>

diff --git a/arch/arm64/include/asm/esr.h b/arch/arm64/include/asm/esr.h
index 92fb26e908405716895ecffdc4dcd5ae3c0706b1..e4f77757937e65d6605ab61d49376c0d9e69808d 100644 (file)
--- a/arch/arm64/include/asm/esr.h
+++ b/arch/arm64/include/asm/esr.h
@@ -482,6 +482,28 @@ static inline bool esr_fsc_is_addr_sz_fault(unsigned long esr)
               (esr == ESR_ELx_FSC_ADDRSZ_L(-1));
 }
 
+static inline bool esr_fsc_is_sea_ttw(unsigned long esr)
+{
+       esr = esr & ESR_ELx_FSC;
+
+       return (esr == ESR_ELx_FSC_SEA_TTW(3)) ||
+              (esr == ESR_ELx_FSC_SEA_TTW(2)) ||
+              (esr == ESR_ELx_FSC_SEA_TTW(1)) ||
+              (esr == ESR_ELx_FSC_SEA_TTW(0)) ||
+              (esr == ESR_ELx_FSC_SEA_TTW(-1));
+}
+
+static inline bool esr_fsc_is_secc_ttw(unsigned long esr)
+{
+       esr = esr & ESR_ELx_FSC;
+
+       return (esr == ESR_ELx_FSC_SECC_TTW(3)) ||
+              (esr == ESR_ELx_FSC_SECC_TTW(2)) ||
+              (esr == ESR_ELx_FSC_SECC_TTW(1)) ||
+              (esr == ESR_ELx_FSC_SECC_TTW(0)) ||
+              (esr == ESR_ELx_FSC_SECC_TTW(-1));
+}
+
 /* Indicate whether ESR.EC==0x1A is for an ERETAx instruction */
 static inline bool esr_iss_is_eretax(unsigned long esr)
 {

diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 44e3fc6483c8d04d1f0d209e55debe0f3a1206ea..bd020fc28aa9ca2c958b741dfe051b63b091ac78 100644 (file)
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -307,6 +307,9 @@ static __always_inline phys_addr_t kvm_vcpu_get_fault_ipa(const struct kvm_vcpu
 {
        u64 hpfar = vcpu->arch.fault.hpfar_el2;
 
+       if (unlikely(!(hpfar & HPFAR_EL2_NS)))
+               return INVALID_GPA;
+
        return FIELD_GET(HPFAR_EL2_FIPA, hpfar) << 12;
 }
 

diff --git a/arch/arm64/include/asm/kvm_ras.h b/arch/arm64/include/asm/kvm_ras.h
index 87e10d9a635b55016596a412b3b79b0951d10085..9398ade632aaf99945c13aa288fb9769658bfe46 100644 (file)
--- a/arch/arm64/include/asm/kvm_ras.h
+++ b/arch/arm64/include/asm/kvm_ras.h
@@ -14,7 +14,7 @@
  * Was this synchronous external abort a RAS notification?
  * Returns '0' for errors handled by some RAS subsystem, or -ENOENT.
  */
-static inline int kvm_handle_guest_sea(phys_addr_t addr, u64 esr)
+static inline int kvm_handle_guest_sea(void)
 {
        /* apei_claim_sea(NULL) expects to mask interrupts itself */
        lockdep_assert_irqs_enabled();

diff --git a/arch/arm64/kvm/hyp/include/hyp/fault.h b/arch/arm64/kvm/hyp/include/hyp/fault.h
index 59409685c14f7da4886828f92527f6d4b3c32d32..fc573fc767b0e7ebfd98755c3caca1e5e7118353 100644 (file)
--- a/arch/arm64/kvm/hyp/include/hyp/fault.h
+++ b/arch/arm64/kvm/hyp/include/hyp/fault.h
@@ -12,6 +12,16 @@
 #include <asm/kvm_hyp.h>
 #include <asm/kvm_mmu.h>
 
+static inline bool __fault_safe_to_translate(u64 esr)
+{
+       u64 fsc = esr & ESR_ELx_FSC;
+
+       if (esr_fsc_is_sea_ttw(esr) || esr_fsc_is_secc_ttw(esr))
+               return false;
+
+       return !(fsc == ESR_ELx_FSC_EXTABT && (esr & ESR_ELx_FnV));
+}
+
 static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
 {
        int ret;
@@ -71,17 +81,23 @@ static inline bool __hpfar_valid(u64 esr)
 
 static inline bool __get_fault_info(u64 esr, struct kvm_vcpu_fault_info *fault)
 {
-       u64 hpfar, far;
+       u64 hpfar;
 
-       far = read_sysreg_el2(SYS_FAR);
+       fault->far_el2          = read_sysreg_el2(SYS_FAR);
+       fault->hpfar_el2        = 0;
 
        if (__hpfar_valid(esr))
                hpfar = read_sysreg(hpfar_el2);
-       else if (!__translate_far_to_hpfar(far, &hpfar))
+       else if (unlikely(!__fault_safe_to_translate(esr)))
+               return true;
+       else if (!__translate_far_to_hpfar(fault->far_el2, &hpfar))
                return false;
 
-       fault->far_el2 = far;
-       fault->hpfar_el2 = hpfar;
+       /*
+        * Hijack HPFAR_EL2.NS (RES0 in Non-secure) to indicate a valid
+        * HPFAR value.
+        */
+       fault->hpfar_el2 = hpfar | HPFAR_EL2_NS;
        return true;
 }
 

diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
index 5ce2230054d984f06a9eaebc46b293ad85466f28..2a5284f749b427927791f0706f66542e90611df9 100644 (file)
--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
@@ -578,7 +578,14 @@ void handle_host_mem_abort(struct kvm_cpu_context *host_ctxt)
                return;
        }
 
+
+       /*
+        * Yikes, we couldn't resolve the fault IPA. This should reinject an
+        * abort into the host when we figure out how to do that.
+        */
+       BUG_ON(!(fault.hpfar_el2 & HPFAR_EL2_NS));
        addr = FIELD_GET(HPFAR_EL2_FIPA, fault.hpfar_el2) << 12;
+
        ret = host_stage2_idmap(addr);
        BUG_ON(ret && ret != -EAGAIN);
 }

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 2feb6c6b63af6c7970a8a41a7eec1bf3c659c9eb..754f2fe0cc67382338fd05628b14d3d1fd785831 100644 (file)
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1794,9 +1794,28 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu)
        gfn_t gfn;
        int ret, idx;
 
+       /* Synchronous External Abort? */
+       if (kvm_vcpu_abt_issea(vcpu)) {
+               /*
+                * For RAS the host kernel may handle this abort.
+                * There is no need to pass the error into the guest.
+                */
+               if (kvm_handle_guest_sea())
+                       kvm_inject_vabt(vcpu);
+
+               return 1;
+       }
+
        esr = kvm_vcpu_get_esr(vcpu);
 
+       /*
+        * The fault IPA should be reliable at this point as we're not dealing
+        * with an SEA.
+        */
        ipa = fault_ipa = kvm_vcpu_get_fault_ipa(vcpu);
+       if (KVM_BUG_ON(ipa == INVALID_GPA, vcpu->kvm))
+               return -EFAULT;
+
        is_iabt = kvm_vcpu_trap_is_iabt(vcpu);
 
        if (esr_fsc_is_translation_fault(esr)) {
@@ -1818,18 +1837,6 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu)
                }
        }
 
-       /* Synchronous External Abort? */
-       if (kvm_vcpu_abt_issea(vcpu)) {
-               /*
-                * For RAS the host kernel may handle this abort.
-                * There is no need to pass the error into the guest.
-                */
-               if (kvm_handle_guest_sea(fault_ipa, kvm_vcpu_get_esr(vcpu)))
-                       kvm_inject_vabt(vcpu);
-
-               return 1;
-       }
-
        trace_kvm_guest_fault(*vcpu_pc(vcpu), kvm_vcpu_get_esr(vcpu),
                              kvm_vcpu_get_hfar(vcpu), fault_ipa);