Re: [PATCH 11/28] KVM: arm64: Expose FEAT_NV2p1 to NV guests

[Marc Zyngier <maz@kernel.org>]

On Thu, 02 Jul 2026 17:28:30 +0100,
sashiko-bot@kernel.org wrote:
> 
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Inconsistent preservation of `ID_AA64MMFR4_EL1` feature fields based on host support for `ARM64_HAS_NV2P1` (and later `ARM64_HAS_NV3`), leading to uncontrolled UAPI feature leaks and migration breakages.
> --
> 
> commit 11eacfaa8962f15232e1ae99c1e9f7d1dfee6846
> Author: Marc Zyngier <maz@kernel.org>
> 
> KVM: arm64: Expose FEAT_NV2p1 to NV guests
> 
> This commit exposes the FEAT_NV2p1 feature to nested virtualization guests.
> It does so by updating the ID_AA64MMFR4_EL1 feature register limits in
> limit_nv_id_reg() based on host support.
> 
> > diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> > --- a/arch/arm64/kvm/nested.c
> > +++ b/arch/arm64/kvm/nested.c
> > @@ -1740,7 +1740,11 @@ u64 limit_nv_id_reg(struct kvm *kvm, u32 reg, u64 val)
> >  		if (test_bit(KVM_ARM_VCPU_HAS_EL2_E2H0, kvm->arch.vcpu_features)) {
> >  			val = 0;
> >  		} else {
> > -			val = SYS_FIELD_PREP_ENUM(ID_AA64MMFR4_EL1, NV_frac, NV2_ONLY);
> > +			if (cpus_have_final_cap(ARM64_HAS_NV2P1))
> > +				val = ID_REG_LIMIT_FIELD_ENUM(val, ID_AA64MMFR4_EL1, NV_frac, NV2P1);
> > +			else
> > +				val = SYS_FIELD_PREP_ENUM(ID_AA64MMFR4_EL1, NV_frac, NV2_ONLY);
> 
> [Severity: High]
> Does this introduce inconsistent preservation of ID_AA64MMFR4_EL1 feature fields?
> 
> When the host supports NV2P1, KVM uses ID_REG_LIMIT_FIELD_ENUM(), which only
> modifies the NV_frac field and preserves the rest of the original val. This 
> means the guest will inherit other host-populated feature bits from
> ID_AA64MMFR4_EL1 (like ASID2, HACDBS, FGWTE3, etc.).
> 
> However, if the host is NV2-only, it falls back to the original assignment
> using SYS_FIELD_PREP_ENUM(), which effectively wipes out all other fields in
> val.
> 
> Could this uncontrolled feature leak cause guest-visible state divergence based
> on the underlying hardware and break live migration?
> 
> >  			val &= ~ID_AA64MMFR4_EL1_E2H0;
> >  			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR4_EL1, E2H0, NI_NV1);

Yeah, that's indeed wrong. Another one to fix.

	M.

-- 
Jazz isn't dead. It just smells funny.