Re: [PATCH v7 21/21] KVM: s390: vsie: Enable use of VSIE SSCA

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: s390: missing MMU notifier integration causes stale page translations
--

commit c91eb6421a6b9ec0c4df9e03f9cc7aa92ee08182
Author: Christoph Schlameuss <schlameuss@linux.ibm.com>

KVM: s390: vsie: Enable use of VSIE SSCA

This commit enables code paths that configure and use VSIE SIGPI and
SRSI, allowing hardware to handle SIGP EXTERNAL_CALL and
SENSE_RUNNING_STATUS instructions without exiting VSIE. The feature can
be enabled globally via the ssca module parameter and improves guest-3
performance.

> diff --git a/arch/s390/kvm/s390/vsie.c b/arch/s390/kvm/s390/vsie.c
> index c99cc03ecb81d..04c14d33927a6 100644
> --- a/arch/s390/kvm/s390/vsie.c
> +++ b/arch/s390/kvm/s390/vsie.c
> @@ -147,6 +147,8 @@ static inline bool use_ssca(struct kvm *kvm, struct kvm_s390_sie_block *scb)
>  {
>  	if (!kvm->arch.use_ssca)
>  		return false;
> +	if (!test_kvm_cpu_feat(kvm, KVM_S390_VM_CPU_FEAT_SIGPIF))
> +		return false;
>  	if (!(scb->eca & ECA_SIGPI) && !(scb->ecb & ECB_SRSI))
>  		return false;
>  	if (!read_scao(kvm, scb))
>  		return false;

[Severity: High]
By enabling the use of SSCA here, doesn't this expose a memory corruption
regression in how the vsie control blocks cache host physical addresses?

Looking at get_vsie_sca() which caches the pinned SCA pages:

arch/s390/kvm/s390/vsie.c:get_vsie_sca() {
...
	rc = pin_sca(kvm, vsie_sca);
	if (rc) {
		put_vsie_sca(vsie_sca);
		vsie_sca->sca_gpa = ULONG_MAX;
		goto out;
	}

	rc = xa_insert(&kvm->arch.vsie.osca_to_sca, vsie_sca->sca_gpa >> SCA_ALIGNMENT_SHIFT,
		       vsie_sca, GFP_KERNEL_ACCOUNT);
...
}

This appears to cache the pages across VM exits without registering an MMU
notifier to invalidate them when the host mapping changes.

Furthermore, looking at pin_guest_page():

arch/s390/kvm/s390/vsie.c:pin_guest_page() {
...
	page = gfn_to_page(kvm, gpa_to_gfn(gpa));
	if (!page)
		return -EINVAL;
	*hpa = (hpa_t)page_to_phys(page) + (gpa & ~PAGE_MASK);
...
}

Because this extracts the physical address without closing the time-of-check
to time-of-use window via mmu_invalidate_seq, if host userspace alters the
mapping for the guest physical address (e.g., via madvise with
MADV_DONTNEED or memory hot-unplug), won't KVM retain and use a
stale physical address?

Since this bypasses the MMU notifier retry protocol, could a malicious guest
or dynamic host environment cause the hardware to read or write an old
physical page while the guest OS accesses a new page?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918-vsie-sigpi-v7-0-f39806eaae37@linux.ibm.com?part=21