Re: [PATCH v2 17/20] KVM: s390: arm64: Finalize page fault handling

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Architectural Violation: Injected aborts incorrectly set the ESR_ELx_IL bit conditionally.
--

commit b703e320efef81f7ebb0637eda7231ef63b3ca22
Author: Steffen Eiden <seiden@linux.ibm.com>

KVM: s390: arm64: Finalize page fault handling

This commit finalizes page fault handling by replacing temporary error
returns with proper ARM64 exception injection. Specifically, it routes
PGM_ADDRESSING faults and out-of-bounds IPAs to kvm_inject_size_fault()
and kvm_inject_sea().

> diff --git a/arch/s390/kvm/arm64/mmu.c b/arch/s390/kvm/arm64/mmu.c
> index bf3442d3609b2..b5f1dc3ca0d28 100644
> --- a/arch/s390/kvm/arm64/mmu.c
> +++ b/arch/s390/kvm/arm64/mmu.c
> @@ -30,12 +30,14 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, gpa_t fault_ipa,
>  	ret = kvm_s390_faultin_gfn(vcpu, NULL, &f);
>  	if (ret <= 0)
>  		return ret;
> -	if (ret == PGM_ADDRESSING)
> +	if (ret == PGM_ADDRESSING) {
>  		/*
> -		 * Without the relevant sysregs we cannot do anything for now.
> -		 * Go back to userspace with an error. TODO sysreg handling
> +		 * There is no page with the requested address. Inject size fault
> +		 * which is the closest arm match to PGM-addressing
>  		 */
> -		return -ENOEXEC;
> +		kvm_inject_size_fault(vcpu);

[Severity: High]
This is a pre-existing issue, but does routing faults to
kvm_inject_size_fault() expose an architectural violation for 16-bit
instructions?

When a guest user-space process executing a 16-bit instruction triggers a
fault, this patch routes it to the exception injection logic. That logic
currently conditionally sets the IL bit based on instruction length:

arch/s390/kvm/arm64/inject_fault.c:inject_abt64() {
    ...
    if (kvm_vcpu_trap_il_is32bit(vcpu))
        esr |= ESR_ELx_IL;
    ...
}

(The same conditional logic is also present in kvm_inject_undefined()).

For an SError, Instruction Abort, or Data Abort with ISV == 0, the
architecture mandates that the IL bit must be 1 regardless of the trapping
instruction's length. 

Could this cause KVM to synthesize an ESR_ELx with IL=0 instead of the
required IL=1 for 16-bit instructions? If the guest OS exception handler
receives an architecturally invalid syndrome, could it malfunction or lead to
a guest kernel panic?

> +		return 1;
> +	}
>  	KVM_BUG_ON(ret, vcpu->kvm);
>  	return -EINVAL;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831145536.913567-1-seiden@linux.ibm.com?part=17