Re: [PATCH v2 4/4] KVM: arm64: Convert TCR_EL2 to config-driven sanitisation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: arm64: static TCR_EL2 mask based on FEAT_E2H0 breaks dynamic E2H layouts
--

commit 18ffaaa0986bf7864d7ed4beba6765c60e2a26c1
Author: Wei-Lin Chang <weilin.chang@arm.com>

KVM: arm64: Convert TCR_EL2 to config-driven sanitisation
    
This commit converts the translation control register TCR_EL2 to use the
config-driven sanitisation framework. It extracts feature dependencies
from the BSD-licensed AARCHMRS Registers.json, applying some manual
deviations for dependencies like TCR_EL2.TCMA and FEAT_ASID16.

> diff --git a/arch/arm64/kvm/config.c b/arch/arm64/kvm/config.c
> index 1053676551aff..080b3510b7831 100644
> --- a/arch/arm64/kvm/config.c
> +++ b/arch/arm64/kvm/config.c
[ ... ]
> @@ -1611,6 +1718,12 @@ struct resx get_reg_fixed_bits(struct kvm *kvm, enum vcpu_sysreg reg)
>  	case SCTLR2_EL2:
>  		resx = compute_reg_resx_bits(kvm, &sctlr2_desc, 0, 0);
>  		break;
> +	case TCR_EL2:
> +		if (kvm_has_feat(kvm, FEAT_E2H0))
> +			resx = compute_reg_resx_bits(kvm, &tcr_el2_desc, 0, 0);
> +		else
> +			resx = compute_reg_resx_bits(kvm, &vhe_tcr_el2_desc, 0, 0);
> +		break;

[Severity: High]
Does this static choice in get_reg_fixed_bits() break dynamic E2H layouts for
nested guests? When FEAT_E2H0 is present on the host, this restricts the sysreg
mask to the E2H=0 layout for all TCR_EL2 accesses, ignoring that guests can
still dynamically enter E2H=1 mode.

If a nested hypervisor runs on a host with FEAT_E2H0, sets HCR_EL2.E2H = 1,
and writes to TCR_EL2 expecting the VHE layout, KVM will intercept the write.
When passed to kvm_vcpu_apply_reg_masks(), the VHE-specific bits (e.g., EPD1,
T1SZ, TG1, IPS) will be cleared because they overlap with RES0 bits in the
static nVHE mask. Could this corrupt translation table configurations and
cause translation aborts?

>  	case TCR2_EL2:
>  		resx = compute_reg_resx_bits(kvm, &tcr2_el2_desc, 0, 0);
>  		break;

> diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> index 7f13f0077c9f4..3e01123d00ca0 100644
> --- a/arch/arm64/kvm/nested.c
> +++ b/arch/arm64/kvm/nested.c
[ ... ]
> @@ -1957,6 +1957,10 @@ int kvm_init_nv_sysregs(struct kvm_vcpu *vcpu)
>  	resx = get_reg_fixed_bits(kvm, HFGITR2_EL2);
>  	set_sysreg_masks(kvm, HFGITR2_EL2, resx);
>  
> +	/* TCR_EL2 */
> +	resx = get_reg_fixed_bits(kvm, TCR_EL2);
> +	set_sysreg_masks(kvm, TCR_EL2, resx);

[Severity: High]
Does this application in kvm_init_nv_sysregs() cause valid guest writes to be
clobbered?

Since the wrongly computed static mask is applied to the VM's sysreg_masks
array here, it looks like it will break nested virtualization for any nested
guest running in VHE mode.

> +
>  	/* TCR2_EL2 */
>  	resx = get_reg_fixed_bits(kvm, TCR2_EL2);
>  	set_sysreg_masks(kvm, TCR2_EL2, resx);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917214215.74135-1-weilin.chang@arm.com?part=4