Re: [PATCH 08/17] KVM: arm64: Implement HVC handling for protected guests at EL2

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm_handle_pvm_hvc64 incorrectly intercepts ARM_SMCCC_ARCH_FEATURES_FUNC_ID and unconditionally returns NOT_SUPPORTED for Spectre mitigations (ARCH_WORKAROUND_1, 2, 3), leaving protected guests vulnerable.
--

commit 3a993faeabc602db9d44970bfb0c7813227c0324
Author: Fuad Tabba <fuad.tabba@linux.dev>

KVM: arm64: Implement HVC handling for protected guests at EL2

This commit extends kvm_handle_pvm_hvc64() to handle SMCCC_VERSION,
SMCCC_ARCH_FEATURES, and the vendor hypervisor call UID at EL2. It also
adds handlers to forward protected guest HVCs to the host.

> diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
> index af334318d0a03..0fe11f95e2e26 100644
> --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
> +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c

[ ... ]

> @@ -1144,8 +1144,37 @@ bool kvm_handle_pvm_hvc64(struct kvm_vcpu *vcpu, u64 *exit_code)
>  {
>  	u64 val[4] = { SMCCC_RET_INVALID_PARAMETER };
>  	bool handled = true;
> +	u32 feature;
> +	uuid_t uuid;
>  
>  	switch (smccc_get_function(vcpu)) {

[ ... ]

> +	case ARM_SMCCC_ARCH_FEATURES_FUNC_ID:
> +		/* SUCCESS only for the architecture calls EL2 implements. */
> +		feature = smccc_get_arg1(vcpu);
> +		switch (feature) {
> +		case ARM_SMCCC_VERSION_FUNC_ID:
> +		case ARM_SMCCC_ARCH_FEATURES_FUNC_ID:
> +			val[0] = SMCCC_RET_SUCCESS;
> +			break;
> +		default:
> +			val[0] = SMCCC_RET_NOT_SUPPORTED;
> +			break;

[Severity: High]
Does this catch-all default case inadvertently disable Spectre mitigations
in the protected guest kernel?

When the guest OS boots, it queries ARM_SMCCC_ARCH_FEATURES_FUNC_ID for
ARM_SMCCC_ARCH_WORKAROUND_1 (and others) to check availability. Because this
default case blindly returns SMCCC_RET_NOT_SUPPORTED, the guest will assume
the workarounds are unavailable.

Could this allow an untrusted guest userspace process to exploit transient
execution attacks (like V2, V4, BHB) and leak guest kernel or other guest
userspace memory?

> +		}
> +		break;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831163421.272420-1-fuad.tabba@linux.dev?part=8