Re: [PATCH v7 15/23] s390: Introduce Start Arm Execution instruction

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing hardware branch predictor isolation (Spectre v2 mitigations) and alignment padding around the Start Arm Execution (SAE) instruction.
--

commit 5f700400137f55bf83aa7484eb428f79dafd9340
Author: Steffen Eiden <seiden@linux.ibm.com>

s390: Introduce Start Arm Execution instruction

This commit introduces the Start Arm Execution (SAE) instruction to enable
accelerated execution of arm64 virtual machines on s390. It adds the new
header variants, control block structures, and the __sae64a assembly routine
to handle host-guest register state transitions.

> diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
> index 10dd9bbdf9856..6f6f8f6ff9c48 100644
> --- a/arch/s390/kernel/entry.S
> +++ b/arch/s390/kernel/entry.S

[ ... ]

> @@ -245,6 +245,28 @@ EXPORT_SYMBOL(__sie64a)
>  EXPORT_SYMBOL(sie_exit)
>  #endif
>  
> +#if IS_ENABLED(CONFIG_KVM_S390_ARM64)
> +/*
> + * __sae64a calling convention:
> + * %r2 pointer to sae control block physical address
> + */
> +SYM_FUNC_START(__sae64a)
> +	stmg	%r6,%r14,__SF_GPRS(%r15)	# store kernel registers
> +	STBEAR	__SF_SAE_BEAR(%r15)		# save breaking event address register
> +	.insn	rre,0xb9a50000,%r2,0		# Start Arm Execution
> +	LBEAR	__SF_SAE_BEAR(%r15)		# restore breaking event address register

[Severity: High]
Does this sequence safely handle branch predictor state when transitioning to
and from the untrusted guest?

Unlike the analogous __sie64a implementation, __sae64a appears to lack the
BPEXIT, BPOFF, and BPENTER macros to flush or isolate the branch predictor.
Could a malicious guest poison the host CPU's Branch Target Buffer (BTB) or
Return Stack Buffer (RSB), leading to speculative execution vulnerabilities
(Spectre v2) that leak host kernel memory?

Additionally, is a padding instruction such as "nopr 7" needed immediately
following the SAE instruction here? For SIE, this padding is required to
safely handle mishandled machine checks on the instruction boundary.

> +	lmg	%r6,%r14,__SF_GPRS(%r15)	# restore kernel registers
> +	xgr	%r0,%r0				# clear guest registers to
> +	xgr	%r1,%r1				# prevent speculative use
> +	xgr	%r2,%r2
> +	xgr	%r3,%r3
> +	xgr	%r4,%r4
> +	xgr	%r5,%r5
> +	BR_EX	%r14
> +SYM_FUNC_END(__sae64a)
> +EXPORT_SYMBOL(__sae64a)
> +#endif

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831144802.834315-1-seiden@linux.ibm.com?part=15