Re: [PATCH v21 02/15] KVM: arm64: Refuse to start a guest with S1PIE or S1POE but not TCR2

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Wed, Sep 30, 2026 at 10:05:50PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] kvm: arm64: TOCTOU race bypasses S1PIE/TCR2 ID register validation
> --
>
> commit ecf3602b27fe0cb6f8ce76b1a8c6698e3dee08f4
> Author: Mark Brown <broonie@kernel.org>
>
> KVM: arm64: Refuse to start a guest with S1PIE or S1POE but not TCR2
>
> This commit adds validation to reject starting a guest with FEAT_S1PIE or
> FEAT_S1POE enabled if FEAT_TCR2 is disabled, as the hypervisor requires
> TCR2 to properly context-switch these registers.
>
> > diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> > index 44aae52c473d7..3ae293798b270 100644
> > --- a/arch/arm64/kvm/sys_regs.c
> > +++ b/arch/arm64/kvm/sys_regs.c
>
> [ ... ]
>
> > @@ -5928,6 +5946,9 @@ int kvm_finalize_sys_regs(struct kvm_vcpu *vcpu)
> >  		kvm_vgic_finalize_idregs(kvm);
> >  	}
> >
> > +	if (!kvm_validate_id_regs(vcpu->kvm))
> > +		return -EINVAL;
> > +
>
> [Severity: Critical]
> Does this introduce a Time-Of-Check to Time-Of-Use (TOCTOU) regression
> that bypasses the S1PIE/TCR2 ID register check?
>
> If Thread A executes the first KVM_RUN, it passes this kvm_validate_id_regs()
> check because the invalid configuration hasn't been set yet. The config_lock
> is then released.
>
> Thread B could then execute KVM_SET_ONE_REG for the ID register, take
> config_lock, and inject the invalid S1PIE=1/TCR2=0 configuration via
> set_id_reg() in arch/arm64/kvm/sys_regs.c, bypassing the immutability check
> because KVM_ARCH_FLAG_HAS_RAN_ONCE is not yet set.
>
> When Thread A proceeds to execute kvm_calculate_traps(), it reads the
> maliciously modified ID registers and disables the traps, before finally
> setting KVM_ARCH_FLAG_HAS_RAN_ONCE in kvm_arch_vcpu_run_pid_change() in
> arch/arm64/kvm/arm.c.
>
> This regression allows KVM to configure traps based on S1PIE, disabling the
> trap for PIRE0_EL1, but skipping context-switching the register because TCR2
> is disabled. Could this allow the guest to directly overwrite the host's
> physical PIRE0_EL1 register?

Isn't this just a pre-existing issue and the one addressed by [0]?

https://lore.kernel.org/kvmarm/20260929-kvm-arm64-idreg-final-v4-0-75296dde994d@kernel.org/

I don't think it's related to patch 2/15 in any case.

>
> >  	return 0;
> >  }
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260930-arm64-gcs-v21-0-3556644cd927@kernel.org?part=2
>

--
Cheers, Lorenzo