Re: [PATCH v2 3/7] KVM: arm64: Unconditionally set IL for injected abort exceptions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unconditional IL=1 in inject_abt64() creates invalid ESR state for Address Size faults.
--

commit 5d93cc0ddb43cdfa88e555d446e07e55b7334637
Author: Fuad Tabba <tabba@google.com>

KVM: arm64: Unconditionally set IL for injected abort exceptions

This commit unconditionally sets the ESR_ELx_IL bit to 1 for injected
aborts, assuming the FSC is always EXTABT or SEA_TTW.

> diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
> index 9dfae1bcdf992..444d219b02174 100644
> --- a/arch/arm64/kvm/inject_fault.c
> +++ b/arch/arm64/kvm/inject_fault.c

[ ... ]

> @@ -138,11 +138,10 @@ static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr
>  		pend_sync_exception(vcpu);
>  
>  	/*
> -	 * Build an {i,d}abort, depending on the level and the
> -	 * instruction set. Report an external synchronous abort.
> +	 * Build an {i,d}abort, depending on the level.
> +	 * Report an external synchronous abort.
>  	 */
> -	if (kvm_vcpu_trap_il_is32bit(vcpu))
> -		esr |= ESR_ELx_IL;
> +	esr |= ESR_ELx_IL;

[Severity: High]
Does this unconditional setting of IL=1 cause an architecturally invalid
syndrome for Address Size faults?

If a guest executing in AArch32 EL0 issues a 16-bit instruction (such as a
16-bit LDR) that triggers a Stage-2 Address Size fault, the IL bit should
accurately reflect the size of the trapped instruction (0 for 16-bit).

Looking at kvm_inject_size_fault(), it injects the abort by calling
inject_abt64() via the __kvm_inject_sea() call chain, and then modifies the
FSC to 0 (Address Size Fault):

arch/arm64/kvm/inject_fault.c:kvm_inject_size_fault() {
    ...
    /* inject_abt64() forces IL=1 earlier in the call chain */
    ...
    esr &= ~GENMASK_ULL(5, 0);
    vcpu_write_sys_reg(vcpu, esr, exception_esr_elx(vcpu));
    ...
}

Will KVM now inject the Address Size fault with IL=1 instead of IL=0,
potentially causing the guest OS exception handler to incorrectly advance
the Program Counter by 4 bytes instead of 2 during fault unwinding?

>  
>  	/*
>  	 * Here, the guest runs in AArch64 mode when in EL1. If we get

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618121643.4105064-1-tabba@google.com?part=3