[PATCH] KVM: arm64: Preserve AArch32 CP64 registers on rejected reads

[Karl Mehltretter <kmehltretter@gmail.com>]

kvm_handle_cp_64() only seeds params.regval for writes. If a CP64 read is
decoded but rejected, emulate_cp() still returns handled and the caller
writes params.regval back to Rt/Rt2.

This can happen for write-only GIC SGI registers and for rejected PMU
counter reads. In both cases KVM injects an UNDEF into the guest, so the
MRRC destination registers must remain unchanged.

Instead, the uninitialised regval is copied into the guest registers. With
stack auto-initialisation this is a deterministic zero or pattern value.
With CONFIG_INIT_STACK_NONE it may be stale host stack data.

Match kvm_handle_cp_32() and kvm_handle_sys_reg() by seeding regval from
the destination registers before emulation.

Fixes: 6d52f35af10c ("arm64: KVM: add SGI generation register emulation")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Runtime tested on a Raspberry Pi 400 with a minimal KVM harness running
an AArch32 guest. On the unpatched 6.1.21-v8+ vendor kernel, the PMCCNTR
MRRC test took UNDEF with r0=0x00000001/r1=0x00000000 instead of the
guest's sentinel values. With this patch on v7.2-rc3-278-g38436106b2f5,
the same test preserved r0=0x12345678/r1=0x9abcdef0.

--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -4860,11 +4860,11 @@
 	/*
 	 * Make a 64-bit value out of Rt and Rt2. As we use the same trap
 	 * backends between AArch32 and AArch64, we get away with it.
+	 *
+	 * This also makes rejected reads preserve Rt/Rt2.
 	 */
-	if (params.is_write) {
-		params.regval = vcpu_get_reg(vcpu, Rt) & 0xffffffff;
-		params.regval |= vcpu_get_reg(vcpu, Rt2) << 32;
-	}
+	params.regval = vcpu_get_reg(vcpu, Rt) & 0xffffffff;
+	params.regval |= vcpu_get_reg(vcpu, Rt2) << 32;
 
 	/*
 	 * If the table contains a handler, handle the
-- 
2.51.0