Re: [PATCH 04/22] KVM: arm64: nv: Only shadow writable-dirty guest descs as writable

[Oliver Upton <oupton@kernel.org>]

On Tue, Jun 23, 2026 at 06:58:09PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> 
> New issues:
> - [High] Uninitialized or incorrectly evaluated `wr->dirty` field during Stage-1 page table walks causes an infinite VNCR trap loop.
> 
> Pre-existing issues:
> - [High] Write-Only VNCR mappings cause an infinite trap loop because KVM falls back to `PAGE_KERNEL_NONE` but considers write faults resolved.
> --
> 
> commit fb5a66a1eb4ac6175aad6cbbd38f45328f4f937b
> Author: Oliver Upton <oupton@kernel.org>
> 
> KVM: arm64: nv: Only shadow writable-dirty guest descs as writable
>     
> KVM will soon add support for hardware dirty state management for nested
> guests. In order to emulate dirty state transitions on the guest
> desciptor, KVM will need to use read-only hardware mappings and re-walk
> the guest page tables upon taking a permission fault.
>     
> Prepare by limiting shadow stage-2 and shadow VNCR translations to
> read-only for writable-clean guest translations.
> 
> > diff --git a/arch/arm64/kvm/at.c b/arch/arm64/kvm/at.c
> > index 86b499e7a9a06..7a84495a2e6d4 100644
> > --- a/arch/arm64/kvm/at.c
> > +++ b/arch/arm64/kvm/at.c
> [ ... ]
> > @@ -1317,6 +1317,7 @@ static void compute_s1_permissions(struct kvm_vcpu *vcpu,
> >  			  (pan3_enabled(vcpu, wi->regime) && wr->ux));
> >  	wr->pw &= !pan;
> >  	wr->pr &= !pan;
> > +	wr->dirty = !(wr->desc & BIT(7));
> 
> [Severity: High]
> Could the unconditional use of BIT(7) here cause issues when S1PIE is
> enabled?
> 
> With S1PIE, BIT(7) becomes PIIndex[3], so using it to evaluate the dirty
> state might be incorrect.

Bit 7 is nDirty when using indirect permissions, so this is wrong.

Thanks,
Oliver