[PATCH 0/2] KVM: arm64: Fixes for S2 permission relaxation

[PATCH 0/2] KVM: arm64: Fixes for S2 permission relaxation

[Oliver Upton]

Couple of small fixes for S2 permission relaxation.

The first patch looks a bit worse than it actually is, potentially
consuming an uninitialized stack variable as a TLBI TTL hint in the
event of a race to update the PTE. However, if the bad TTL value results
in the stale TLB entry remaining valid, the vCPU will just fault again
and (hopefully) avoid the race.

Second patch is of a similar flavor, where the permission relaxation was
unconditionally updating XN, potentially reaping execute permissions
when handling a write fault. The consequence of this is taking an
unintended execute permission fault to restore the original XN value.

Applies to 7.2-rc1.

Oliver Upton (2):
  KVM: arm64: Ensure level is always initialized when relaxing perms
  KVM: arm64: Only update XN attr when requested during S2 relaxation

 arch/arm64/kvm/hyp/pgtable.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)


base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
-- 
2.47.3

[PATCH 1/2] KVM: arm64: Ensure level is always initialized when relaxing perms

[Oliver Upton]

stage2_update_leaf_attrs() returns early before writing to @level if the
table walker returned an error. At the same time,
kvm_pgtable_stage2_relax_perms() uses the level as a TLBI TTL hint when the
error was EAGAIN, indicating the vCPU raced with a table update and the TLB
entry it hit is now stale.

Fall back to an unknown TTL if none was provided by the walk.

Cc: stable@vger.kernel.org
Fixes: be097997a273 ("KVM: arm64: Always invalidate TLB for stage-2 permission faults")
Signed-off-by: Oliver Upton <oupton@kernel.org>
---
 arch/arm64/kvm/hyp/pgtable.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c
index 91a7dfad6686..31aaca35693a 100644
--- a/arch/arm64/kvm/hyp/pgtable.c
+++ b/arch/arm64/kvm/hyp/pgtable.c
@@ -1358,7 +1358,7 @@ int kvm_pgtable_stage2_relax_perms(struct kvm_pgtable *pgt, u64 addr,
 				   enum kvm_pgtable_prot prot, enum kvm_pgtable_walk_flags flags)
 {
 	kvm_pte_t xn = 0, set = 0, clr = 0;
-	s8 level;
+	s8 level = TLBI_TTL_UNKNOWN;
 	int ret;
 
 	if (prot & KVM_PTE_LEAF_ATTR_HI_SW)
-- 
2.47.3

[PATCH 2/2] KVM: arm64: Only update XN attr when requested during S2 relaxation

[Oliver Upton]

On systems without DIC, KVM lazily grants execute permission to stage-2
translations after taking an instruction abort due to a permission
fault, allowing it to defer I-cache invalidations to the point they're
absolutely required.

If a data abort happens later down the line to such a translation, KVM
will not request execute permissions as part of the S2 relaxation on the
assumption that kvm_pgtable_stage2_relax_perms() does exactly what the
name implies and adds the requested permissions to the pre-existing
ones.

Avoid taking unintended execute permission faults by only preparing the
XN attribute if KVM_PGTABLE_PROT_X is set.

Fixes: 2608563b466b ("KVM: arm64: Add support for FEAT_XNX stage-2 permissions")
Signed-off-by: Oliver Upton <oupton@kernel.org>
---
 arch/arm64/kvm/hyp/pgtable.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c
index 31aaca35693a..0b6d32d03efe 100644
--- a/arch/arm64/kvm/hyp/pgtable.c
+++ b/arch/arm64/kvm/hyp/pgtable.c
@@ -1370,12 +1370,14 @@ int kvm_pgtable_stage2_relax_perms(struct kvm_pgtable *pgt, u64 addr,
 	if (prot & KVM_PGTABLE_PROT_W)
 		set |= KVM_PTE_LEAF_ATTR_LO_S2_S2AP_W;
 
-	ret = stage2_set_xn_attr(prot, &xn);
-	if (ret)
-		return ret;
+	if (prot & KVM_PGTABLE_PROT_X) {
+		ret = stage2_set_xn_attr(prot, &xn);
+		if (ret)
+			return ret;
 
-	set |= xn & KVM_PTE_LEAF_ATTR_HI_S2_XN;
-	clr |= ~xn & KVM_PTE_LEAF_ATTR_HI_S2_XN;
+		set |= xn & KVM_PTE_LEAF_ATTR_HI_S2_XN;
+		clr |= ~xn & KVM_PTE_LEAF_ATTR_HI_S2_XN;
+	}
 
 	ret = stage2_update_leaf_attrs(pgt, addr, 1, set, clr, NULL, &level, flags);
 	if (!ret || ret == -EAGAIN)
-- 
2.47.3

Re: [PATCH 0/2] KVM: arm64: Fixes for S2 permission relaxation

[Wei-Lin Chang]

On Wed, Jul 01, 2026 at 04:16:18PM -0700, Oliver Upton wrote:
> Couple of small fixes for S2 permission relaxation.
> 
> The first patch looks a bit worse than it actually is, potentially
> consuming an uninitialized stack variable as a TLBI TTL hint in the
> event of a race to update the PTE. However, if the bad TTL value results
> in the stale TLB entry remaining valid, the vCPU will just fault again
> and (hopefully) avoid the race.
> 
> Second patch is of a similar flavor, where the permission relaxation was
> unconditionally updating XN, potentially reaping execute permissions
> when handling a write fault. The consequence of this is taking an
> unintended execute permission fault to restore the original XN value.
> 
> Applies to 7.2-rc1.
> 
> Oliver Upton (2):
>   KVM: arm64: Ensure level is always initialized when relaxing perms
>   KVM: arm64: Only update XN attr when requested during S2 relaxation
> 
>  arch/arm64/kvm/hyp/pgtable.c | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)

For the series,

Reviewed-by: Wei-Lin Chang <weilin.chang@arm.com>

> 
> 
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
> -- 
> 2.47.3
> 

Re: [PATCH 0/2] KVM: arm64: Fixes for S2 permission relaxation

[Marc Zyngier]

On Wed, 01 Jul 2026 16:16:18 -0700, Oliver Upton wrote:
> Couple of small fixes for S2 permission relaxation.
> 
> The first patch looks a bit worse than it actually is, potentially
> consuming an uninitialized stack variable as a TLBI TTL hint in the
> event of a race to update the PTE. However, if the bad TTL value results
> in the stale TLB entry remaining valid, the vCPU will just fault again
> and (hopefully) avoid the race.
> 
> [...]

Applied to fixes, thanks!

[1/2] KVM: arm64: Ensure level is always initialized when relaxing perms
      commit: 100baf0184896f859290a684f864b8200d8ac872
[2/2] KVM: arm64: Only update XN attr when requested during S2 relaxation
      commit: f35c08c092505f3a83ce097d94fe51eb8bc9c1b5

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.