Re: [PATCH v2 1/4] KVM: arm64: nv: Don't advertise FEAT_LPA2 for guest stage-1

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] arm64: kvm: exact equality check for FEAT_LPA2 leaks future CPU features to guest
--

commit 04c3c148ddb66ae2c7e9c401ce8ccd1c725fafd5
Author: Wei-Lin Chang <weilin.chang@arm.com>

KVM: arm64: nv: Don't advertise FEAT_LPA2 for guest stage-1

This commit sanitizes ID_AA64MMFR0_EL1 to prevent advertising FEAT_LPA2
to nested guests for non-stage-2 granule size fields (TGRAN4, TGRAN16).
It explicitly clears and resets the fields to IMP when the 52-bit values
are detected.

> diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> --- a/arch/arm64/kvm/nested.c
> +++ b/arch/arm64/kvm/nested.c

[ ... ]

> @@ -1731,6 +1731,17 @@ u64 limit_nv_id_reg(struct kvm *kvm, u32 reg, u64 val)
>  		/* Hide CNTPOFF if present */
>  		val = ID_REG_LIMIT_FIELD_ENUM(val, ID_AA64MMFR0_EL1, ECV, IMP);
>  
> +		/* NV does not support FEAT_LPA2. */
> +		if (SYS_FIELD_GET(ID_AA64MMFR0_EL1, TGRAN4, val) == ID_AA64MMFR0_EL1_TGRAN4_52_BIT) {
> +			val &= ~ID_AA64MMFR0_EL1_TGRAN4;
> +			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN4, IMP);
> +		}

[Severity: Medium]
Could this exact equality check fail to cap future values of TGRAN4?

If a future hardware extension introduces a CPUID value where TGRAN4 is
greater than ID_AA64MMFR0_EL1_TGRAN4_52_BIT, this condition would be
bypassed. This could expose unsupported capabilities to nested guests on
future hardware, potentially leading to guest crashes or page table
corruption when the guest attempts to use 52-bit translation granules.

> +
> +		if (SYS_FIELD_GET(ID_AA64MMFR0_EL1, TGRAN16, val) == ID_AA64MMFR0_EL1_TGRAN16_52_BIT) {
> +			val &= ~ID_AA64MMFR0_EL1_TGRAN16;
> +			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN16, IMP);
> +		}

[Severity: Medium]
Similarly, could this equality check leak future values of TGRAN16 greater
than ID_AA64MMFR0_EL1_TGRAN16_52_BIT?

Would it be safer to handle both of these limits using
ID_REG_LIMIT_FIELD_ENUM instead of exact equality checks to ensure
future monotonic CPUID values remain properly capped?

> +
>  		/* Disallow unsupported S2 page sizes */
>  		switch (PAGE_SIZE) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917214215.74135-1-weilin.chang@arm.com?part=1