Message-ID: <sashiko-outbox-202099@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH v2 8/8] KVM: arm64: Stop leaning on __kvm_inject_sea()
 for abort injection
Reply-To: sashiko-reviews@lists.linux.dev
To: "Oliver Upton" <oupton@kernel.org>, kvmarm@lists.linux.dev
Cc: "Marc Zyngier" <maz@kernel.org>
In-Reply-To: <20261106183154.3590825-9-oupton@kernel.org>
References: <20261106183154.3590825-1-oupton@kernel.org>
 <20261106183154.3590825-9-oupton@kernel.org>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Fri, 06 Nov 2026 18:47:20 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] KVM: arm64: missing Fixes trailer for kvm_inject_size_fault()
  AArch32 PABT bug
--

commit f2d6dc968339775720bc3ec74dcb33374b8473b1
Author: Oliver Upton <oupton@kernel.org>

> KVM: arm64: Stop leaning on __kvm_inject_sea() for abort injection
>
> KVM's handling of local abort injection is, politely stated, a giant
> fscking mess. At surface level, things look somewhat innocuous: inject
> an SEA and directly update ESR_EL1 with the correct FSC afterwards. But
> this is broken for a couple reasons.
>
> For one, on implementations with FEAT_DoubleFault2 KVM may inject the
> SEA as an SError depending on the falue of SCTLR2_EL1.NMEA, meaning that
> the eventual non-SEA abort is incorrectly taken to the SError vector.
>
> AArch32 is also quite bitrotted. No surprise. The FSR value is written
> to IFSR not DFSR, when a prefetch abort is injected. So while DFSR is
> aliased to ESR_EL1 architecturally, fixing up ESR_EL1.FSC after
> injection has no effect on IFSR.
>
> Finally, injecting aborts into non-LPAE relics may use an invalid value
> for xFSC.FS, as KVM unconditionally uses the LPAE/VMSAv8-64 format.
>
> Fix the first two by tearing the whole mess, adding __kvm_inject_abort()
> for injecting non-SEA aborts which takes the desired FSC from the
> caller. Fix the third one by selecting a fault status value based on the
> LPAE-ness of the guest.
>
> Cc: stable@vger.kernel.org
> Fixes: fff97df2a0bd ("KVM: arm64: Route SEAs to the SError vector when EA=
SE is set")
> Fixes: 2937aeec9dc5 ("KVM: arm64: Handle DABT caused by LS64* instruction=
s on unsupported memory")
> Signed-off-by: Oliver Upton <oupton@kernel.org>

[Severity: Low]
Of the two functions changed here, only kvm_inject_size_fault() can inject
an AArch32 prefetch abort (where FSR is written to IFSR32_EL2 while the
post-injection fixup only cleared ESR_EL1).  Should this also include:

  Fixes: 85ea6b1ec915 ("KVM: arm64: Inject exception on out-of-IPA-range tr=
anslation fault")

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261106183154.3590=
825-1-oupton@kernel.org?part=3D8