Re: [PATCH v19 05/20] KVM: arm64: Track the type of VM in kvm_arch

[Suzuki K Poulose <suzuki.poulose@arm.com>]

On 20/09/2026 22:38, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] kvm: arm64: missing READ_ONCE() when reading untrusted host_kvm vm_flavor at EL2
> --
> 
> commit d04a2a8ee6aa64b39d1116da1e8bfebec72b4499
> Author: Suzuki K Poulose <suzuki.poulose@arm.com>
> 
>      KVM: arm64: Track the type of VM in kvm_arch
>      
>      KVM arm64 has different types of VMs with all the different modes in which
>      the hypervisor code can be run. e.g., VHE, nVHE, pKVM etc. Then there is
>      protected VM and normal VMs with pKVM. We might soon add other types,
>      e.g., Arm CCA Realm.
> 
>> diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
>> index 459bd9eb7e4bc..57e2eef6d7426 100644
>> --- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
>> +++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
>> @@ -432,7 +432,11 @@ static void init_pkvm_hyp_vm(struct kvm *host_kvm, struct pkvm_hyp_vm *hyp_vm,
>>   
>>   	hyp_vm->host_kvm = host_kvm;
>>   	hyp_vm->kvm.created_vcpus = nr_vcpus;
>> -	hyp_vm->kvm.arch.pkvm.is_protected = READ_ONCE(host_kvm->arch.pkvm.is_protected);
>> +	if (kvm_vm_is_protected(host_kvm))
>> +		hyp_vm->kvm.arch.vm_flavor = VM_PROTECTED_PKVM;
>> +	else
>> +		hyp_vm->kvm.arch.vm_flavor = VM_PKVM;
> 
> [Severity: Medium]
> Does init_pkvm_hyp_vm() evaluate the untrusted host memory directly without
> READ_ONCE()?
> 
> The pKVM EL2 trust boundary requires that data from host memory must be
> copied to private EL2 memory before validating or acting on it.
> 
> The macro kvm_vm_is_protected(host_kvm) evaluates host_kvm->arch.vm_flavor in
> the condition. The previous code safely used
> READ_ONCE(host_kvm->arch.pkvm.is_protected).
> 
> Could we wrap the host memory read with READ_ONCE() to prevent
> compiler-induced tearing or optimization issues?

Fair point. I have changed the above hunk to :

-       hyp_vm->kvm.arch.pkvm.is_protected = 
READ_ONCE(host_kvm->arch.pkvm.is_protected);
+       if (READ_ONCE(host_kvm->arch.vm_flavor) == VM_PROTECTED_PKVM)
+               hyp_vm->kvm.arch.vm_flavor = VM_PROTECTED_PKVM;
+       else
+               hyp_vm->kvm.arch.vm_flavor = VM_PKVM;
+


Cheers
Suzuki

>