[PATCH] KVM: arm64: Use S1E1A when Stage-1 PIE is supported

[PATCH] KVM: arm64: Use S1E1A when Stage-1 PIE is supported

[Will Deacon]

On a system with stage-1 PIE, a guest can try to execute from an
execute-only mapping at stage-1 but trigger a permission fault at
stage-2 if the stage-2 mapping is execute-never.

In this case, the EL2 permission fault handler will attempt to translate
the faulting VA using an AT S1E1R operation, which will fail due to the
lack of read permission at stage-1. We will then return to the guest and
take the exact same fault the next time around.

Similarly to commit 55f4b215fb60 ("KVM: arm64: use `at s1e1a` for POE"),
use the S1E1A operation to bypass stage-1 permission checks when
obtaining the IPA for a stage-2 permission fault. Like FEAT_S1POE,
FEAT_S1PIE implies FEAT_ATS1A, so extend the existing AT invocation in
__translate_far_to_hpfar() to use the permission-bypassing variant when
S1PIE is implemented.

Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Fuad Tabba <fuad.tabba@linux.dev>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Steffen Eiden <seiden@linux.ibm.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
---

I've been debugging an external report of a failure in Android related
to S1PIE. The symptoms match what I would expect from this issue and
this patch has been reported to fix the problem, but I don't have enough
information to know for sure that my analysis is correct. I've had to
piece things together based on partial information and bits of logs.

 arch/arm64/include/asm/cpufeature.h    | 5 +++++
 arch/arm64/kvm/hyp/include/hyp/fault.h | 5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 4f04ad82ea34..f05ace660fa2 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -841,6 +841,11 @@ static inline bool system_supports_lpa2(void)
 	return cpus_have_final_cap(ARM64_HAS_LPA2);
 }
 
+static inline bool system_supports_pie(void)
+{
+	return alternative_has_cap_unlikely(ARM64_HAS_S1PIE);
+}
+
 static inline bool system_supports_poe(void)
 {
 	return alternative_has_cap_unlikely(ARM64_HAS_S1POE);
diff --git a/arch/arm64/kvm/hyp/include/hyp/fault.h b/arch/arm64/kvm/hyp/include/hyp/fault.h
index fc573fc767b0..741ea12be07d 100644
--- a/arch/arm64/kvm/hyp/include/hyp/fault.h
+++ b/arch/arm64/kvm/hyp/include/hyp/fault.h
@@ -38,8 +38,9 @@ static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
 	 * saved the guest context yet, and we may return early...
 	 */
 	par = read_sysreg_par();
-	ret = system_supports_poe() ? __kvm_at(OP_AT_S1E1A, far) :
-	                              __kvm_at(OP_AT_S1E1R, far);
+	ret = system_supports_poe() || system_supports_pie() ?
+		__kvm_at(OP_AT_S1E1A, far) :
+		__kvm_at(OP_AT_S1E1R, far);
 	if (!ret)
 		tmp = read_sysreg_par();
 	else
-- 
2.56.0.385.gac671c819a-goog

Re: [PATCH] KVM: arm64: Use S1E1A when Stage-1 PIE is supported

[Joey Gouly]

On Tue, Nov 03, 2026 at 01:35:39PM +0000, Will Deacon wrote:
> On a system with stage-1 PIE, a guest can try to execute from an
> execute-only mapping at stage-1 but trigger a permission fault at
> stage-2 if the stage-2 mapping is execute-never.
> 
> In this case, the EL2 permission fault handler will attempt to translate
> the faulting VA using an AT S1E1R operation, which will fail due to the
> lack of read permission at stage-1. We will then return to the guest and
> take the exact same fault the next time around.
> 
> Similarly to commit 55f4b215fb60 ("KVM: arm64: use `at s1e1a` for POE"),
> use the S1E1A operation to bypass stage-1 permission checks when
> obtaining the IPA for a stage-2 permission fault. Like FEAT_S1POE,
> FEAT_S1PIE implies FEAT_ATS1A, so extend the existing AT invocation in
> __translate_far_to_hpfar() to use the permission-bypassing variant when
> S1PIE is implemented.
> 
> Cc: Marc Zyngier <maz@kernel.org>
> Cc: Oliver Upton <oupton@kernel.org>
> Cc: Fuad Tabba <fuad.tabba@linux.dev>
> Cc: Joey Gouly <joey.gouly@arm.com>
> Cc: Steffen Eiden <seiden@linux.ibm.com>
> Cc: Ard Biesheuvel <ardb@kernel.org>
> Signed-off-by: Will Deacon <will@kernel.org>

This makes sense to me.

Reviewed-by: Joey Gouly <joey.gouly@arm.com>

Thanks,
Joey

> ---
> 
> I've been debugging an external report of a failure in Android related
> to S1PIE. The symptoms match what I would expect from this issue and
> this patch has been reported to fix the problem, but I don't have enough
> information to know for sure that my analysis is correct. I've had to
> piece things together based on partial information and bits of logs.
> 
>  arch/arm64/include/asm/cpufeature.h    | 5 +++++
>  arch/arm64/kvm/hyp/include/hyp/fault.h | 5 +++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
> index 4f04ad82ea34..f05ace660fa2 100644
> --- a/arch/arm64/include/asm/cpufeature.h
> +++ b/arch/arm64/include/asm/cpufeature.h
> @@ -841,6 +841,11 @@ static inline bool system_supports_lpa2(void)
>  	return cpus_have_final_cap(ARM64_HAS_LPA2);
>  }
>  
> +static inline bool system_supports_pie(void)
> +{
> +	return alternative_has_cap_unlikely(ARM64_HAS_S1PIE);
> +}
> +
>  static inline bool system_supports_poe(void)
>  {
>  	return alternative_has_cap_unlikely(ARM64_HAS_S1POE);
> diff --git a/arch/arm64/kvm/hyp/include/hyp/fault.h b/arch/arm64/kvm/hyp/include/hyp/fault.h
> index fc573fc767b0..741ea12be07d 100644
> --- a/arch/arm64/kvm/hyp/include/hyp/fault.h
> +++ b/arch/arm64/kvm/hyp/include/hyp/fault.h
> @@ -38,8 +38,9 @@ static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
>  	 * saved the guest context yet, and we may return early...
>  	 */
>  	par = read_sysreg_par();
> -	ret = system_supports_poe() ? __kvm_at(OP_AT_S1E1A, far) :
> -	                              __kvm_at(OP_AT_S1E1R, far);
> +	ret = system_supports_poe() || system_supports_pie() ?
> +		__kvm_at(OP_AT_S1E1A, far) :
> +		__kvm_at(OP_AT_S1E1R, far);
>  	if (!ret)
>  		tmp = read_sysreg_par();
>  	else
> -- 
> 2.56.0.385.gac671c819a-goog
> 

Re: [PATCH] KVM: arm64: Use S1E1A when Stage-1 PIE is supported

[Marc Zyngier]

On Tue, 03 Nov 2026 13:35:39 +0000, Will Deacon wrote:
> On a system with stage-1 PIE, a guest can try to execute from an
> execute-only mapping at stage-1 but trigger a permission fault at
> stage-2 if the stage-2 mapping is execute-never.
> 
> In this case, the EL2 permission fault handler will attempt to translate
> the faulting VA using an AT S1E1R operation, which will fail due to the
> lack of read permission at stage-1. We will then return to the guest and
> take the exact same fault the next time around.
> 
> [...]

Applied to fixes, thanks!

[1/1] KVM: arm64: Use S1E1A when Stage-1 PIE is supported
      commit: 9d447709895d3977e207dd1bc01a30f5c0f76156

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH] KVM: arm64: Use S1E1A when Stage-1 PIE is supported

[Lorenzo Stoakes (ARM)]

On Tue, Nov 03, 2026 at 01:35:39PM +0000, Will Deacon wrote:
> On a system with stage-1 PIE, a guest can try to execute from an
> execute-only mapping at stage-1 but trigger a permission fault at
> stage-2 if the stage-2 mapping is execute-never.
>
> In this case, the EL2 permission fault handler will attempt to translate
> the faulting VA using an AT S1E1R operation, which will fail due to the
> lack of read permission at stage-1. We will then return to the guest and
> take the exact same fault the next time around.
>
> Similarly to commit 55f4b215fb60 ("KVM: arm64: use `at s1e1a` for POE"),
> use the S1E1A operation to bypass stage-1 permission checks when
> obtaining the IPA for a stage-2 permission fault. Like FEAT_S1POE,
> FEAT_S1PIE implies FEAT_ATS1A, so extend the existing AT invocation in
> __translate_far_to_hpfar() to use the permission-bypassing variant when
> S1PIE is implemented.

>
> Cc: Marc Zyngier <maz@kernel.org>
> Cc: Oliver Upton <oupton@kernel.org>
> Cc: Fuad Tabba <fuad.tabba@linux.dev>
> Cc: Joey Gouly <joey.gouly@arm.com>
> Cc: Steffen Eiden <seiden@linux.ibm.com>
> Cc: Ard Biesheuvel <ardb@kernel.org>
> Signed-off-by: Will Deacon <will@kernel.org>

This was useful as an excuse to go and investigate all this, take notes,
and learn why it all makes sense :)

And it does, so:

Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
>
> I've been debugging an external report of a failure in Android related
> to S1PIE. The symptoms match what I would expect from this issue and
> this patch has been reported to fix the problem, but I don't have enough
> information to know for sure that my analysis is correct. I've had to
> piece things together based on partial information and bits of logs.
>
>  arch/arm64/include/asm/cpufeature.h    | 5 +++++
>  arch/arm64/kvm/hyp/include/hyp/fault.h | 5 +++--
>  2 files changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
> index 4f04ad82ea34..f05ace660fa2 100644
> --- a/arch/arm64/include/asm/cpufeature.h
> +++ b/arch/arm64/include/asm/cpufeature.h
> @@ -841,6 +841,11 @@ static inline bool system_supports_lpa2(void)
>  	return cpus_have_final_cap(ARM64_HAS_LPA2);
>  }
>
> +static inline bool system_supports_pie(void)
> +{
> +	return alternative_has_cap_unlikely(ARM64_HAS_S1PIE);
> +}
> +
>  static inline bool system_supports_poe(void)
>  {
>  	return alternative_has_cap_unlikely(ARM64_HAS_S1POE);
> diff --git a/arch/arm64/kvm/hyp/include/hyp/fault.h b/arch/arm64/kvm/hyp/include/hyp/fault.h
> index fc573fc767b0..741ea12be07d 100644
> --- a/arch/arm64/kvm/hyp/include/hyp/fault.h
> +++ b/arch/arm64/kvm/hyp/include/hyp/fault.h
> @@ -38,8 +38,9 @@ static inline bool __translate_far_to_hpfar(u64 far, u64 *hpfar)
>  	 * saved the guest context yet, and we may return early...
>  	 */
>  	par = read_sysreg_par();
> -	ret = system_supports_poe() ? __kvm_at(OP_AT_S1E1A, far) :
> -	                              __kvm_at(OP_AT_S1E1R, far);
> +	ret = system_supports_poe() || system_supports_pie() ?
> +		__kvm_at(OP_AT_S1E1A, far) :
> +		__kvm_at(OP_AT_S1E1R, far);
>  	if (!ret)
>  		tmp = read_sysreg_par();
>  	else
> --
> 2.56.0.385.gac671c819a-goog
>
>

--
Cheers, Lorenzo