Re: [PATCH] KVM: arm64: Use S1E1A when Stage-1 PIE is supported

[Lorenzo Stoakes (ARM)]

On Tue, Nov 03, 2026 at 01:35:39PM +0000, Will Deacon wrote:
> On a system with stage-1 PIE, a guest can try to execute from an
> execute-only mapping at stage-1 but trigger a permission fault at
> stage-2 if the stage-2 mapping is execute-never.
>
> In this case, the EL2 permission fault handler will attempt to translate
> the faulting VA using an AT S1E1R operation, which will fail due to the
> lack of read permission at stage-1. We will then return to the guest and
> take the exact same fault the next time around.
>
> Similarly to commit 55f4b215fb60 ("KVM: arm64: use `at s1e1a` for POE"),
> use the S1E1A operation to bypass stage-1 permission checks when
> obtaining the IPA for a stage-2 permission fault. Like FEAT_S1POE,
> FEAT_S1PIE implies FEAT_ATS1A, so extend the existing AT invocation in
> __translate_far_to_hpfar() to use the permission-bypassing variant when
> S1PIE is implemented.

>
> Cc: Marc Zyngier <maz@xxxxxxxxxx>
> Cc: Oliver Upton <oupton@xxxxxxxxxx>
> Cc: Fuad Tabba <fuad.tabba@xxxxxxxxx>
> Cc: Joey Gouly <joey.gouly@xxxxxxx>
> Cc: Steffen Eiden <seiden@xxxxxxxxxxxxx>
> Cc: Ard Biesheuvel <ardb@xxxxxxxxxx>
> Signed-off-by: Will Deacon <will@xxxxxxxxxx>

This was useful as an excuse to go and investigate all this, take notes,
and learn why it all makes sense :)

And it does, so:

Acked-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>

> ---
>
> I've been debugging an external report of a failure in Android related
> to S1PIE. The symptoms match what I would expect from this issue and
> this patch has been reported to fix the problem, but I don't have enough
> information to know for sure that my analysis is correct. I've had to
> piece things together based on partial information and bits of logs.
>
>  arch/arm64/include/asm/cpufeature.h    | 5 +++++
>  arch/arm64/kvm/hyp/include/hyp/fault.h | 5 +++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
> index 4f04ad82ea34..f05ace660fa2 100644
> --- a/arch/arm64/include/asm/cpufeature.h
> +++ b/arch/arm64/include/asm/cpufeature.h
> @@ -841,6 +841,11 @@ static inline bool system_supports_lpa2(void)
>  	return cpus_have_final_cap(ARM64_HAS_LPA2);
>  }
>
> +static inline bool system_supports_pie(void)
> +{
> +	return alternative_has_cap_unlikely(ARM64_HAS_S1PIE);
> +}
> +
>  static inline bool system_supports_poe(void)
>  {
>  	return alternative_has_cap_unlikely(ARM64_HAS_S1POE);
> diff --git a/arch/arm64/kvm/hyp/include/hyp/fault.h b/arch/arm64/kvm/hyp/include/hyp/fault.h
> index fc573fc767b0..741ea12be07d 100644
> --- a/arch/arm64/kvm/hyp/include/hyp/fault.h
> +++ b/arch/arm64/kvm/hyp/include/hyp/fault.h
> @@ -38,8 +38,9 @@ static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
>  	 * saved the guest context yet, and we may return early...
>  	 */
>  	par = read_sysreg_par();
> -	ret = system_supports_poe() ? __kvm_at(OP_AT_S1E1A, far) :
> -	                              __kvm_at(OP_AT_S1E1R, far);
> +	ret = system_supports_poe() || system_supports_pie() ?
> +		__kvm_at(OP_AT_S1E1A, far) :
> +		__kvm_at(OP_AT_S1E1R, far);
>  	if (!ret)
>  		tmp = read_sysreg_par();
>  	else
> --
> 2.56.0.385.gac671c819a-goog
>
>

--
Cheers, Lorenzo