Re: [PATCH v19 05/20] KVM: arm64: Track the type of VM in kvm_arch

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] kvm: arm64: missing READ_ONCE() when reading untrusted host_kvm vm_flavor at EL2
--

commit d04a2a8ee6aa64b39d1116da1e8bfebec72b4499
Author: Suzuki K Poulose <suzuki.poulose@arm.com>

    KVM: arm64: Track the type of VM in kvm_arch
    
    KVM arm64 has different types of VMs with all the different modes in which
    the hypervisor code can be run. e.g., VHE, nVHE, pKVM etc. Then there is
    protected VM and normal VMs with pKVM. We might soon add other types,
    e.g., Arm CCA Realm.

> diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
> index 459bd9eb7e4bc..57e2eef6d7426 100644
> --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
> +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
> @@ -432,7 +432,11 @@ static void init_pkvm_hyp_vm(struct kvm *host_kvm, struct pkvm_hyp_vm *hyp_vm,
>  
>  	hyp_vm->host_kvm = host_kvm;
>  	hyp_vm->kvm.created_vcpus = nr_vcpus;
> -	hyp_vm->kvm.arch.pkvm.is_protected = READ_ONCE(host_kvm->arch.pkvm.is_protected);
> +	if (kvm_vm_is_protected(host_kvm))
> +		hyp_vm->kvm.arch.vm_flavor = VM_PROTECTED_PKVM;
> +	else
> +		hyp_vm->kvm.arch.vm_flavor = VM_PKVM;

[Severity: Medium]
Does init_pkvm_hyp_vm() evaluate the untrusted host memory directly without
READ_ONCE()?

The pKVM EL2 trust boundary requires that data from host memory must be
copied to private EL2 memory before validating or acting on it.

The macro kvm_vm_is_protected(host_kvm) evaluates host_kvm->arch.vm_flavor in
the condition. The previous code safely used
READ_ONCE(host_kvm->arch.pkvm.is_protected).

Could we wrap the host memory read with READ_ONCE() to prevent
compiler-induced tearing or optimization issues?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920212845.707-1-suzuki.poulose@arm.com?part=5