Re: [PATCH v3 20/28] KVM: arm64: Add sanitisation for NVHCR_EL2

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Subsystem rule violation: Numeric range loop over sparse `enum vcpu_sysreg`
--

--- Patch [20]: [PATCH v3 20/28] KVM: arm64: Add sanitisation for NVHCR_EL2 ---
commit b143c0689f4a9db3345ab50e6a712d0698ebaa75
Author: Marc Zyngier <maz@kernel.org>

KVM: arm64: Add sanitisation for NVHCR_EL2

This commit adds sanitisation support for the NVHCR_EL2 register.
It mimics the format of HCR_EL2 but conditionally depends on FEAT_NV3
being present. If FEAT_NV3 is absent, it relies on standard VNCR data
transfers.

[ ... ]

> diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> index 82be8bcb07035..34e63480886cd 100644
> --- a/arch/arm64/kvm/nested.c
> +++ b/arch/arm64/kvm/nested.c
> @@ -1828,6 +1828,10 @@ int kvm_init_nv_sysregs(struct kvm_vcpu *vcpu)
>  	resx = get_reg_fixed_bits(kvm, HCR_EL2);
>  	set_sysreg_masks(kvm, HCR_EL2, resx);
>  
> +	/* NVHCR_EL2 */
> +	resx = get_reg_fixed_bits(kvm, NVHCR_EL2);
> +	set_sysreg_masks(kvm, NVHCR_EL2, resx);
> +
>  	/* HCRX_EL2 */
>  	resx = get_reg_fixed_bits(kvm, HCRX_EL2);
>  	set_sysreg_masks(kvm, HCRX_EL2, resx);

[Severity: High]
This is a pre-existing issue, but later in kvm_init_nv_sysregs() there is
a loop over enum vcpu_sysreg:

	for (enum vcpu_sysreg sr = __SANITISED_REG_START__; sr < NR_SYS_REGS; sr++)
		__vcpu_rmw_sys_reg(vcpu, sr, |=, 0);

Does this numeric range loop iterate over unintended registers?

The KVM ARM64 subsystem guidelines state that enum vcpu_sysreg is sparsely
numbered by VNCR byte offsets. Using a < comparison and incrementing over a
numeric range touches register indices that happen to fall within the byte
span.

Could this silently drop or corrupt guest state by applying operations to
unrelated registers?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722074234.3330999-1-maz@kernel.org?part=20