Re: [RFC PATCH v3 5/6] virt: bao: consolidate the IPC hypercall ID in include/linux/bao.h

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing memory barrier (e.g., `wmb()`) before notifying the hypervisor of newly written data, potentially causing the hypervisor or the receiving VM to read stale memory.
--

--- Patch [5]: [RFC PATCH v3 5/6] virt: bao: consolidate the IPC hypercall ID in include/linux/bao.h ---
commit 392291f754c5a86346cd59911eed878c78654f9d
Author: João Peixoto <jpeixoto@osyx.tech>

virt: bao: consolidate the IPC hypercall ID in include/linux/bao.h

This commit consolidates the IPC shared-memory hypercall ID into a common
header. It also simplifies the architecture-specific bao_ipcshmem_hypercall()
helpers by dropping the hypercall_id parameter.

> diff --git a/drivers/virt/bao/ipcshmem/ipcshmem.c b/drivers/virt/bao/ipcshmem/ipcshmem.c
> index 0d46d89ee788b..5bf37c1c7933d 100644
> --- a/drivers/virt/bao/ipcshmem/ipcshmem.c
> +++ b/drivers/virt/bao/ipcshmem/ipcshmem.c
[ ... ]
> @@ -104,7 +101,7 @@ static ssize_t bao_ipcshmem_write(struct file *filp, const char __user *buf,
>  	*ppos += count;
>  
>  	/* Notify Bao hypervisor */
> -	bao_ipcshmem_hypercall(BAO_IPCSHMEM_HYPERCALL_ID, bao->id);
> +	bao_ipcshmem_hypercall(bao->id);

[Severity: High]
This isn't a bug introduced by this patch, but is there a missing memory
barrier before notifying the hypervisor here in bao_ipcshmem_write()?

Data is written to the shared memory via copy_from_user() just before this,
but no memory barrier ensures global visibility of the write prior to the
notification.

The ARM SMCCC explicitly states that callers must ensure memory updates are
visible before invoking SMC/HVC, meaning an explicit memory barrier (like
wmb()) is architecturally required to prevent stale reads.

Without it, could the hypervisor or the receiving VM read stale memory before
the stores from copy_from_user() become globally visible across PEs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786010512.git.jpeixoto@osyx.tech?part=5