Re: [PATCH 18/28] KVM: arm64: Add kvm_has_nv{2,3}() predicates

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] `is_nested_nv3_ctxt()` incorrectly identifies NV3 context when the guest clears `HCR_EL2.E2H`, diverging from hardware execution semantics.
--

commit c75857355bb73ff60c1d0206705bb863784f8183
Author: Marc Zyngier <maz@kernel.org>

KVM: arm64: Add kvm_has_nv{2,3}() predicates

Add a new set of predicates indicating whether VM is capable of
NV2, NV3, and is in a nested NV3 context. This is going to become
useful as we start dealing with a mix of behaviours.

> diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
> index 9831166695186..c562d8171d5e1 100644
> --- a/arch/arm64/include/asm/kvm_emulate.h
> +++ b/arch/arm64/include/asm/kvm_emulate.h

[ ... ]

> +static inline bool kvm_has_nv3(struct kvm *kvm)
> +{
> +	return (cpus_have_final_cap(ARM64_HAS_NESTED_VIRT) &&
> +		cpus_have_final_cap(ARM64_HAS_NV3) &&
> +		kvm_has_feat(kvm, ID_AA64MMFR4_EL1, NV_frac, NV3));
> +}
> +
> +static inline bool is_nested_nv3_ctxt(struct kvm_vcpu *vcpu)
> +{
> +	return (has_vhe() && kvm_has_nv3(vcpu->kvm) && is_nested_ctxt(vcpu) &&
> +		(__vcpu_sys_reg(vcpu, HCR_EL2) & HCR_EL2_NV) &&
> +		(__vcpu_sys_reg(vcpu, HCRX_EL2) & HCRX_EL2_NVTGE));
> +}

[Severity: High]
Does this predicate miss a mandatory check for HCR_EL2.E2H?

Architecturally, NVTGE is RES0 when E2H is 0. If a guest sets HCR_EL2.NV = 1
and HCRX_EL2.NVTGE = 1, but leaves HCR_EL2.E2H = 0, the hardware will not
execute the guest under NV3 semantics.

If is_nested_nv3_ctxt() evaluates to true in this scenario, could it lead to
KVM state desynchronization?

For example, KVM might unconditionally save SYS_NVHCR_EL2 to the software
context during exit handling. Since the hardware wasn't actually using NV3,
SYS_NVHCR_EL2 wouldn't be updated with guest writes and would contain stale
data.

Would this result in KVM later loading that stale value into the guest's
HCR_EL2 when context switching back, clobbering the guest's register? Should
this include a check for vcpu_el2_e2h_is_set(vcpu)?

>  /*
>   * The layout of SPSR for an AArch32 state is different when observed from an
>   * AArch64 SPSR_ELx or an AArch32 SPSR_*. This function generates the AArch32

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702160248.1377250-1-maz@kernel.org?part=18