KVM: arm64: Prevent host PC adjustments for protected vCPUs

__kvm_adjust_pc() lets the host advance a vCPU's PC or inject an
exception, which for a protected vCPU would let the host redirect
guest execution. Leave the request on the host copy there: the entry
handlers apply the host's PC_UPDATE_REQ at the next entry, where EL2
allows it.

__kvm_adjust_pc() adjusts the vCPU a get/put pair returns, the one it
was given outside pKVM. Both host callers hold the vCPU mutex, so a
hyp vCPU loaded for the vCPU is loaded on the calling CPU, and EL2's
own calls pass the hyp vCPU itself. For a loaded protected vCPU,
kvm_adjust_pc_get() returns NULL and the request stays on the host
copy. For a loaded non-protected vCPU, PKVM_HOST_STATE_DIRTY selects
the copy, since adjusting the hyp vCPU while the host copy is
authoritative loses the update at the next flush. Adjusting the hyp
vCPU copies PC_UPDATE_REQ in and back out again: without the copy
back, INCREMENT_PC outlives the adjustment and the next
KVM_SET_VCPU_EVENTS trips WARN_ON(INCREMENT_PC) in
kvm_pend_exception(). With no hyp vCPU loaded, as under
KVM_SET_VCPU_EVENTS, the host copy is adjusted as before.

Until the marshalling patch clears PC_UPDATE_REQ on the host copy at
exit, a KVM_RUN that returns to userspace with INCREMENT_PC set leaves
it on the host copy of a loaded protected vCPU, and a
KVM_SET_VCPU_EVENTS before the next run then trips that WARN_ON.

Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261001135711.1640520-13-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

0 files changed, 0 insertions, 0 deletions