Re: [PATCH 18/22] KVM: arm64: nv: Set access flag on table descriptors at stage-2

[Oliver Upton <oupton@kernel.org>]

On Tue, Jun 23, 2026 at 07:05:18PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Stage-2 table descriptors fail to generate an Access Flag fault when VTCR_EL2.HAFT == 1, VTCR_EL2.HA == 0, and the descriptor's AF bit is 0.
> --
> 
> commit 7d14ee3ad8d74a4b9734d83c712bb19ae89c1090
> Author: Oliver Upton <oupton@kernel.org>
> 
> KVM: arm64: nv: Set access flag on table descriptors at stage-2
> 
> This commit implements access flag updates on stage-2 table descriptors for
> nested virtualization, as required by FEAT_HAFT.
> 
> > diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> > index 2408d604a1e18..6f540d3481d5a 100644
> > --- a/arch/arm64/kvm/nested.c
> > +++ b/arch/arm64/kvm/nested.c
> [ ... ]
> > @@ -424,6 +428,10 @@ static int walk_nested_s2_pgd(struct kvm_vcpu *vcpu, struct kvm_walk_access *acc
> >  			return 1;
> >  		}
> >  
> > +		ret = handle_desc_update(vcpu, wi, &ws, out, access);
> > +		if (ret)
> > +			return ret;
> > +
> 
> [Severity: High]
> When VTCR_EL2.HAFT == 1 but VTCR_EL2.HA == 0, and the table descriptor's AF
> bit is 0, will this silently bypass the required Access Flag fault?
> 
> If wi->haft evaluates to false (such as when HA == 0), handle_desc_update()
> returns 0 without updating the descriptor. The walk then proceeds to the next
> level without checking if the AF bit is 0, which misses the injection of the
> architectural fault.
> 
> Should there be an explicit check for the AF bit here similar to the one at
> the end of the walk for leaf entries, conditioned on VTCR_EL2.HAFT?

I_HZHJT, the table access flag never generates a fault.

Thanks,
Oliver