Re: [PATCH v2 6/7] KVM: arm64: Set IL for nested SError injection

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The SError syndrome constructed by `kvm_inject_nested_serror()` (including the newly added IL bit) is a dead store because the downstream injection logic silently drops the syndrome.
- [High] When a Synchronous External Abort is routed to an SError via FEAT_DoubleFault2 (`EASE`), KVM incorrectly populates the ESR with an IABT or DABT Exception Class (EC) instead of the architectural SError EC.
--

commit 889dc0193654a25a0ce52006ebe91e58fc4c4ed8
Author: Fuad Tabba <tabba@google.com>

KVM: arm64: Set IL for nested SError injection

This patch modifies kvm_inject_nested_serror() to unconditionally set the IL
bit in the SError syndrome, as mandated by the architecture.

> diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
> index b74369e9ad7ff..6f12496cae815 100644
> --- a/arch/arm64/kvm/emulate-nested.c
> +++ b/arch/arm64/kvm/emulate-nested.c
> @@ -2938,6 +2938,6 @@ int kvm_inject_nested_serror(struct kvm_vcpu *vcpu, u64 esr)
>  	 * vSError injection. Manually populate EC for an emulated SError
>  	 * exception.
>  	 */
> -	esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR);
> +	esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR) | ESR_ELx_IL;
>  	return kvm_inject_nested(vcpu, esr, except_type_serror);
>  }

[Severity: High]
This isn't a bug introduced by this patch, but does the constructed syndrome
value get silently dropped downstream?

Looking at kvm_inject_nested(), it forwards the esr to
kvm_inject_el2_exception():

arch/arm64/kvm/emulate-nested.c:kvm_inject_el2_exception() {
    ...
    case except_type_serror:
        kvm_pend_exception(vcpu, EXCEPT_AA64_EL2_SERR);
        break;
    ...
}

The except_type_serror case doesn't write esr_el2 to ESR_EL2 (unlike the
except_type_sync case), and downstream exception entry code doesn't write
it either.

The constructed payload appears to be entirely discarded.

Would the nested hypervisor observe a stale ESR_EL2 value when taking the
SError, rendering this fix functionally ineffective?

[Severity: High]
This is a pre-existing issue, but when a Synchronous External Abort is routed
to an SError via EASE (FEAT_DoubleFault2), does KVM incorrectly populate the
ESR with an Abort Exception Class instead of SError?

In kvm_inject_nested_sea(), if SCTLR2_EL1_EASE is set, an SError is requested
using an ESR constructed with an Abort EC:

arch/arm64/kvm/emulate-nested.c:kvm_inject_nested_sea() {
    ...
    if (__vcpu_sys_reg(vcpu, SCTLR2_EL2) & SCTLR2_EL1_EASE)
        return kvm_inject_nested(vcpu, esr, except_type_serror);
    ...
}

Similarly in arch/arm64/kvm/inject_fault.c:inject_abt64(), the ESR is
populated with ESR_ELx_EC_IABT_* or ESR_ELx_EC_DABT_* before being written.

Architecturally, all SError interrupts must have an SError Exception Class,
even when representing a routed SEA.

Does supplying an Abort EC violate the architecture and provide the guest with
a malformed exception syndrome?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618121643.4105064-1-tabba@google.com?part=6