Re: [PATCH v2 2/2] KVM: arm64: selftests: Add MMIO sign-extending load test

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Guest EL1 will crash with an Instruction Abort because the `el0_be_loads` assembly block shares a page with EL1 test code and is marked as EL0-accessible.
--

commit 60c24b3648e8f92661ec2d484d27ac4580cad60a
Author: Fuad Tabba <fuad.tabba@linux.dev>

KVM: arm64: selftests: Add MMIO sign-extending load test

Adds a test for sign-extending MMIO loads (LDRSB, LDRSH, LDRSW) into Xt
and Wt destinations, with and without the sign bit set. The host supplies
the MMIO data and checks the guest register holds the sign-extended value.

> diff --git a/tools/testing/selftests/kvm/arm64/mmio_sign_ext.c b/tools/testing/selftests/kvm/arm64/mmio_sign_ext.c
> new file mode 100644
> index 0000000000000..06708ab6db8c0
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/arm64/mmio_sign_ext.c

[ ... ]

> +extern char el0_be_loads[], el0_be_loads_end[];
> +asm(
> +"	.pushsection .text, \"ax\"\n"
> +"	.global el0_be_loads\n"
> +"el0_be_loads:\n"

[Severity: Medium]
Will this crash guest EL1 with an Instruction Abort?

The el0_be_loads assembly block lacks page alignment directives, placing it
adjacent to EL1 executable code in the same page of the .text section.

When make_el0_accessible() is called in main():

    make_el0_accessible(vm, (uint64_t)el0_be_loads,
                        el0_be_loads_end - el0_be_loads);

It makes the shared page EL0-accessible by setting PTE_USER. This
inadvertently makes the EL1 guest_code on the same page EL0-accessible. In
the ARMv8 EL1&0 translation regime, an instruction fetch by EL1 from an
EL0-accessible memory page unconditionally generates a Permission Fault.

> +"	ldrsb	x19, [x0]\n"
> +"	ldrsb	x20, [x0]\n"
> +"	ldrsb	w21, [x0]\n"

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625144807.2603272-1-fuad.tabba@linux.dev?part=2