Re: [PATCH v3 2/2] KVM: arm64: selftests: Add MMIO sign-extending load test

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The test executes guest code at EL0 but fails to map the executable text segment with unprivileged access permissions (PTE_USER), causing an immediate Instruction Abort.
--

commit 8d8bc26c675634520d0cf6c2769677a38145f1a9
Author: Fuad Tabba <fuad.tabba@linux.dev>

KVM: arm64: selftests: Add MMIO sign-extending load test

Add a test for sign-extending MMIO loads (LDRSB, LDRSH, LDRSW) into Xt
and Wt destinations, with and without the sign bit set. The host supplies
the MMIO data and checks the guest register holds the sign-extended value.

> diff --git a/tools/testing/selftests/kvm/arm64/mmio_sign_ext.c b/tools/testing/selftests/kvm/arm64/mmio_sign_ext.c
> new file mode 100644
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/arm64/mmio_sign_ext.c

[ ... ]

> +static void guest_code(void)
> +{
> +	guest_loads_le();
> +
> +	if (guest_mixed_endian_el0()) {
> +		write_sysreg(read_sysreg(sctlr_el1) | SCTLR_EL1_E0E, sctlr_el1);
> +		isb();
> +
> +		asm volatile(
> +		"	msr	elr_el1, %[pc]\n"
> +		"	msr	spsr_el1, %[spsr]\n"
> +		"	mov	x0, %[mmio]\n"
> +		"	isb\n"
> +		"	eret\n"

[ ... ]

> +int main(void)
> +{
> +	struct kvm_vcpu *vcpu;
> +	struct kvm_vm *vm;
> +	struct ucall uc;
> +	unsigned int i;
> +	bool be;
> +
> +	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
> +	virt_map(vm, MMIO_ADDR, MMIO_ADDR, 1);
> +
> +	vm_init_descriptor_tables(vm);
> +	vcpu_init_descriptor_tables(vcpu);
> +	vm_install_sync_handler(vm, VECTOR_SYNC_LOWER_64, ESR_ELx_EC_SVC64,
> +				el0_svc_handler);
> +
> +	be = vcpu_mixed_endian_el0(vcpu);
> +	if (be)
> +		make_el0_accessible(vm, MMIO_ADDR, vm->page_size);

[Severity: Medium]
Will this cause an immediate Instruction Abort on hardware supporting
mixed endianness at EL0?

The MMIO address is made EL0-accessible here, but the code segment
containing el0_be_loads is not. KVM selftests map the test payload
(including the .text segment) as EL1-only by default (AP[1]=0).

When vcpu_mixed_endian_el0() is true, guest_code() drops to EL0 using eret
to execute el0_be_loads. Since the page containing el0_be_loads lacks
unprivileged access permissions (PTE_USER), the instruction fetch at EL0
will trigger a Permission Fault.

Should the page containing el0_be_loads also be made EL0-accessible here?

> +
> +	ksft_print_header();
> +	ksft_set_plan(ARRAY_SIZE(tests) * (be ? 2 : 1));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706115522.954913-1-fuad.tabba@linux.dev?part=2