Re: [PATCH v17 02/14] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP

Mark Brown <[email protected]> Fri, 31 Jul 2026 14:47:01 +0100

Newsgroups	dev.linux.lists.sashiko-reviews,dev.linux.lists.kvmarm
Message-ID	<[email protected]>

On Fri, Jul 31, 2026 at 01:03:26PM +0000, [email protected] wrote:

> > -	SR_FGT(OP_GCSPOPX, 		HFGITR, nGCSEPP, 0),
> > +	SR_FGT(OP_GCSPOPCX, 		HFGITR, nGCSEPP, 0),
> >  	SR_FGT(OP_GCSPUSHM, 		HFGITR, nGCSPUSHM_EL1, 0),
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but is the Fine-Grained Trap
> mapping for HFGITR_EL2.nGCSPUSHM_EL1 incomplete here?

> It looks like this maps OP_GCSPUSHM to nGCSPUSHM_EL1 but omits the GCSPOPM
> instruction.

> If an L1 hypervisor clears HFGITR_EL2.nGCSPUSHM_EL1 and the L2 guest
> executes GCSPOPM, will L0 KVM fail to find OP_GCSPOPM in encoding_to_fgt
> during triage_sysreg_trap() and incorrectly inject an UNDEF exception into
> the L2 guest instead of properly forwarding the trap?

> If so, does OP_GCSPOPM (sys_insn(1, 3, 7, 7, 1)) need to be defined in
> arch/arm64/include/asm/sysreg.h and added to this array?

This appears to be incorrect, the documentation in DDI0601 for
HFGITR_EL2 only calls out GCSPUSHM as being trapped by nGCSPUSHM_EL1 and
I can't see anything that contradicts this or associates GCSPOPM with
any other FGT.

signature.asc (application/pgp-signature, 488 B)