Re: [PATCH v2 12/13] KVM: arm64: Prevent the host from programming new GITS_BASER tables

[Fuad Tabba]

Hi Sebastian,

The GITS_BASER restriction is right, but the new range dispatch lets a
sub-word write through and the masking is incomplete. A few things:

On Fri, Aug 07, 2026 at 04:43:22PM +0000, Sebastian Ene wrote:

> diff --git a/arch/arm64/kvm/hyp/nvhe/its_emulate.c b/arch/arm64/kvm/hyp/nvhe/its_emulate.c
[...]
> +static void baser_write(struct pkvm_protected_reg *region, u64 offset, u64 value)
> +{
[...]
> +        value &= ~(GENMASK_ULL(47, 12) | GENMASK_ULL(9, 0));
> +        value |= (baser & GENMASK_ULL(47, 12)) | (baser & GENMASK_ULL(9, 0));

baser_write should force Valid[63] and the cache/shareability attrs
from the snapshot too, not just PA and [9:0]. As is, the host can set
Valid on a BASER that setup left invalid (pkvm_setup_its_shadow_baser
only mediated tables that were valid in the snapshot), which activates
a table whose L2s hyp never took, and it can change a table's
cacheability/shareability. (Sashiko)

> +        writeq_relaxed(value, its->base + offset);

offset is the raw trapped offset. pkvm_its_emulate_handler now matches
the whole GITS_BASER range (the num_registers change), but it still
doesn't require reg_size == access_size or offset aligned to
access_size, so a 4-byte write at GITS_BASER + 4 reaches baser_write
with offset 0x104. This writeq is then a misaligned 64-bit Device
write that alignment-faults to EL2 and takes hyp down. (Sashiko)

And forcing the address from host_state->tables[].val only points at
the right table once setup validates the snapshot against the hardware
GITS_BASER<n>, the same setup gap as the tables patch.

Cheers,
/fuad