KVM: arm64: Validate host pointers in __kvm_adjust_pc() under pKVM

Hi folks,

Changes since v1 [1]:
- New patch 1: enter_exception64() reads the VM's MTE flag through a host-writable vcpu->kvm that nothing validates. It goes first, since pinning the vCPU alone leaves that read on an unmapped VM. (sashiko)
- Dropped the VM pin the fix carried in v1, patch 1 validating that read at its site.

Two host pointers reach EL2 unvalidated on the __kvm_adjust_pc() path under pKVM, and this series fixes both. The host vCPU isn't mapped at EL2 until its first KVM_RUN pins it, and KVM_SET_VCPU_EVENTS with ext_dabt_pending reaches the hypercall before that. The vcpu->kvm the exception entry reads the MTE flag from is host-writable, and nothing checks it. Either one panics the hypervisor, and on MTE-capable hardware the flag read leaks one bit of hyp memory the host chose, through PSR_TCO.

These are patches 2 and 3 of the pKVM core series [2], which carries them so that it applies as is. They're respun here so they can be applied on their own.

Based on v7.3-rc3 (fd73f4a665989).

Cheers,
/fuad

[1] https://lore.kernel.org/all/[email protected]/
[2] https://lore.kernel.org/all/[email protected]/

Fuad Tabba (2):
KVM: arm64: Validate the host vCPU's VM before reading it under pKVM
KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM

 arch/arm64/kvm/hyp/exception.c             |  5 ++-
 arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 18 ++++++++++
 arch/arm64/kvm/hyp/nvhe/hyp-main.c         | 19 ++++++++++-
 arch/arm64/kvm/hyp/nvhe/pkvm.c             | 39 ++++++++++++++++++++++
 4 files changed, 79 insertions(+), 2 deletions(-)

base-commit: fd73f4a6659897191fa0d40695fe370925dd3780

2.39.5