Re: [PATCH v2 5/8] KVM: s390: vsie: Fix rmap handling in _do_shadow_crste()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] `_do_shadow_crste()` creates a corrupted Region-3 large page entry (PUD) due to `_crste_fc1()` hardcoding `_SEGMENT_MASK`, leading to hardware Translation-Specification exceptions.
--

commit 249b86f32c315315b0e5e5c41fd24415c3c08a7f
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>

KVM: s390: vsie: Fix rmap handling in _do_shadow_crste()

Fix _do_shadow_crste() to also apply a mask on the reverse address, to
prevent spurious entries from being created, like already done in
gmap_protect_rmap().

> diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
> index 4f8d5592c9a92..20e28b183c1ac 100644
> --- a/arch/s390/kvm/gaccess.c
> +++ b/arch/s390/kvm/gaccess.c
[ ... ]
> @@ -1497,8 +1499,7 @@ static int _do_shadow_crste(struct gmap *sg, gpa_t raddr, union crste *host, uni
>  		return -EAGAIN;
>  
>  	newcrste = _crste_fc1(f->pfn, oldcrste.h.tt, 0, !p);

[Severity: Critical]
This is a pre-existing issue, but does this create a corrupted Region-3 large
page entry when dealing with 2GB large pages?

Looking at _crste_fc1() in arch/s390/kvm/dat.h, it hardcodes _SEGMENT_MASK:

arch/s390/kvm/dat.h:_crste_fc1() {
	union crste res = { .val = PFN_PHYS(pfn) & _SEGMENT_MASK };
	...
}

If oldcrste.h.tt is TABLE_TYPE_REGION3, f->pfn may have non-zero bits in
the 20-30 range (which map to IBM bits 33-43) if the fault was not at the
start of the 2GB page. Since _SEGMENT_MASK only masks out the lower 20 bits,
these bits remain set.

Will writing this entry with bits 20-30 set (which should be strictly
zero per architecture) cause the hardware to raise a Translation-Specification
exception?

> -	gfn = gpa_to_gfn(raddr);
> -	while (!dat_crstep_xchg_atomic(table, READ_ONCE(*table), newcrste, gfn, sg->asce))
> +	while (!dat_crstep_xchg_atomic(table, READ_ONCE(*table), newcrste, r_gfn, sg->asce))
>  		;
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601152951.196859-1-imbrenda@linux.ibm.com?part=5