Re: [PATCH v17 02/14] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The Fine-Grained Trap mapping for HFGITR_EL2.nGCSPUSHM_EL1 is incomplete because it omits the GCSPOPM instruction.
--

--- Patch [2]: [PATCH v17 02/14] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP ---
commit f77ebfc89e5efb51bc091da72e90af3bc7f593a6
Author: Mark Brown <[email protected]>

KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP

This commit updates the encoding-to-trap mapping for HFGITR_EL2.nGCSEPP to
reflect that it controls trapping of GCSPUSHX and GCSPOPCX, fixing an
incorrect mapping to GCSPOPX.

> diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
> index 3c82f392845d1..b32742d9dd73e 100644
> --- a/arch/arm64/kvm/emulate-nested.c
> +++ b/arch/arm64/kvm/emulate-nested.c

[ ... ]

> @@ -1432,7 +1432,7 @@ static const struct encoding_to_trap_config encoding_to_fgt[] __initconst = {
>  	SR_FGT(OP_AT_S1E1A, 		HFGITR, ATS1E1A, 1),
>  	SR_FGT(OP_COSP_RCTX, 		HFGITR, COSPRCTX, 1),
>  	SR_FGT(OP_GCSPUSHX, 		HFGITR, nGCSEPP, 0),
> -	SR_FGT(OP_GCSPOPX, 		HFGITR, nGCSEPP, 0),
> +	SR_FGT(OP_GCSPOPCX, 		HFGITR, nGCSEPP, 0),
>  	SR_FGT(OP_GCSPUSHM, 		HFGITR, nGCSPUSHM_EL1, 0),

[Severity: High]
This isn't a bug introduced by this patch, but is the Fine-Grained Trap
mapping for HFGITR_EL2.nGCSPUSHM_EL1 incomplete here?

It looks like this maps OP_GCSPUSHM to nGCSPUSHM_EL1 but omits the GCSPOPM
instruction.

If an L1 hypervisor clears HFGITR_EL2.nGCSPUSHM_EL1 and the L2 guest
executes GCSPOPM, will L0 KVM fail to find OP_GCSPOPM in encoding_to_fgt
during triage_sysreg_trap() and incorrectly inject an UNDEF exception into
the L2 guest instead of properly forwarding the trap?

If so, does OP_GCSPOPM (sys_insn(1, 3, 7, 7, 1)) need to be defined in
arch/arm64/include/asm/sysreg.h and added to this array?

>  	SR_FGT(OP_BRB_IALL, 		HFGITR, nBRBIALL, 0),
>  	SR_FGT(OP_BRB_INJ, 		HFGITR, nBRBINJ, 0),

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2