KVM: x86: Restrict saved GPA writes to hardware write faults

A GPA supplied by a hardware page fault describes the access that
faulted, not an arbitrary instruction decoded afterwards.  A guest can
change an MMIO read into a store before KVM fetches the instruction.  The
saved-GPA shortcut then skips the write-aware guest page-table walk and
can issue a write through a guest-read-only mapping.

Carry hardware write-fault information into the emulator and retain it
alongside the saved GPA.  For guests without protected page tables, only
reuse that GPA for a write when hardware reported a write access.  Reads
and faults with unknown access direction do not authorize an emulated
write; fall back to the existing permission-aware translation in those
cases.

Keep the authorization across MMIO completion without decoding a new
instruction, and reset it when initializing a fresh emulator context.
This also covers writes reached through the cmpxchg fallback.

Preserve the shortcut for hardware-reported writes and for the read side
of read-modify-write emulation after such a fault.  For guests with
protected page tables, preserve the existing behavior and always allow
writes through the saved GPA.  An RMW instruction can fault on its
initial read, and KVM cannot walk the protected guest page tables to
check the subsequent write.

Track this property in common KVM state for SEV and TDX.  Also account
for legacy SEV initialization and encryption-context copies and moves.

Fixes: 0f89b207b04a ("kvm: svm: Use the hardware provided GPA instead of page walk")
Reported-by: Oleg Boiko <oboiko@openai.com>
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Link: https://patch.msgid.link/20260918033658.21842-1-kylebot@openai.com
[sean: clear has_protected_page_tables on the source after migration]
Signed-off-by: Sean Christopherson <seanjc@google.com>

0 files changed, 0 insertions, 0 deletions