Re: [PATCH 5/7] KVM: arm64: Set IL for emulated SError injection

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch series attempts to fix SError syndrome IL bits, but the constructed ESR is silently dropped when injecting a nested SError because `kvm_inject_el2_exception()` ignores the `esr_el2` argument.
--

commit 3adb0abe8b63984396e6d2ad4fb963bab5512c79
Author: Fuad Tabba <tabba@google.com>
Subject: KVM: arm64: Set IL for emulated SError injection

This commit updates kvm_inject_serror_esr to include the IL bit when
constructing an SError syndrome. It fixes an architectural compliance issue
where IL must be 1 for SErrors unconditionally.

> diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
> index 444d219b02174..d6c4fc16f8795 100644
> --- a/arch/arm64/kvm/inject_fault.c
> +++ b/arch/arm64/kvm/inject_fault.c
> @@ -381,7 +381,7 @@ int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr)
>  	 */
>  	if (!serror_is_masked(vcpu)) {
>  		pend_serror_exception(vcpu);
> -		esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR);
> +		esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR) | ESR_ELx_IL;

[Severity: High]
This is a pre-existing issue, but while we are ensuring the SError syndrome
is correctly populated here, does the nested SError injection path drop the
syndrome entirely?

When injecting a nested SError, kvm_inject_nested_serror() passes the
constructed syndrome down to kvm_inject_el2_exception(). However, looking at
kvm_inject_el2_exception() in arch/arm64/kvm/emulate-nested.c:

arch/arm64/kvm/emulate-nested.c:kvm_inject_el2_exception() {
        ...
        switch (except_type) {
        case except_type_sync:
                kvm_pend_exception(vcpu, EXCEPT_AA64_EL2_SYNC);
                vcpu_write_sys_reg(vcpu, esr_el2, ESR_EL2);
                break;
        case except_type_serror:
                kvm_pend_exception(vcpu, EXCEPT_AA64_EL2_SERR);
                break;
        ...
}

Unlike the except_type_sync case, the except_type_serror case does not call
vcpu_write_sys_reg() to write esr_el2 into ESR_EL2.

Will this cause the guest hypervisor to observe a stale ESR_EL2 value when
it takes the SError, effectively rendering the syndrome fixes ineffective for
nested guests?

>  		vcpu_write_sys_reg(vcpu, esr, exception_esr_elx(vcpu));
>  		return 1;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260614163336.3490925-1-tabba@google.com?part=5