Re: [PATCH 05/21] KVM: s390: vsie: Move SCAO validation into a function

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The validity intercept for an invalid SCAO is written to the original guest SCB (`scb_o`) instead of the shadow SCB (`scb_s`), causing it to be silently overwritten and lost during unshadowing.
--

--- Patch [5]: [PATCH 05/21] KVM: s390: vsie: Move SCAO validation into a function ---
commit 617161c9be47e700da98b253966f2dd2c1dfcaeb
Author: Christoph Schlameuss <schlameuss@linux.ibm.com>

KVM: s390: vsie: Move SCAO validation into a function

This commit moves the System Control Area Origin (SCAO) validation logic
into a new standalone function to improve readability and allow reuse. It
also adds logic to validate both BSCA and ESCA origin addresses.

> diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
> --- a/arch/s390/kvm/vsie.c
> +++ b/arch/s390/kvm/vsie.c

[ ... ]

> @@ -788,20 +812,14 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
>  
>  	gpa = read_scao(vcpu->kvm, scb_o);
>  	if (gpa) {
> -		if (gpa < 2 * PAGE_SIZE)
> -			rc = set_validity_icpt(scb_s, 0x0038U);
> -		else if ((gpa & ~0x1fffUL) == kvm_s390_get_prefix(vcpu))
> -			rc = set_validity_icpt(scb_s, 0x0011U);
> -		else if ((gpa & PAGE_MASK) !=
> -			 ((gpa + offsetof(struct bsca_block, cpu[0]) - 1) & PAGE_MASK))
> -			rc = set_validity_icpt(scb_s, 0x003bU);
> -		if (!rc) {
> -			rc = pin_guest_page(vcpu->kvm, gpa, &hpa);
> -			if (rc)
> -				rc = set_validity_icpt(scb_s, 0x0034U);
> -		}
> +		rc = validate_scao(vcpu, scb_o, gpa);

[Severity: High]
Does this mistakenly set the validity intercept on the original SCB (scb_o)
instead of the shadow SCB (scb_s)?

The previous code correctly called set_validity_icpt(scb_s, ...) to write
intercepts to the shadow SCB. By passing scb_o to validate_scao(), the
validity intercept is now written to the original SCB.

When unshadowing occurs later in unshadow_scb(), the uninitialized intercept
data from the shadow SCB will overwrite the original SCB, completely erasing
the validity intercept:

unshadow_scb() {
    ...
    scb_o->icptcode = scb_s->icptcode;
    scb_o->icptstatus = scb_s->icptstatus;
    scb_o->ipa = scb_s->ipa;
    scb_o->ipb = scb_s->ipb;
    ...
}

Should validate_scao() be modified to ensure the validity intercept is 
correctly written to the shadow SCB?

>  		if (rc)
>  			goto unpin;
> +		rc = pin_guest_page(vcpu->kvm, gpa, &hpa);
> +		if (rc) {
> +			rc = set_validity_icpt(scb_s, 0x0034U);
> +			goto unpin;
> +		}
>  		vsie_page->sca_gpa = gpa;
>  		write_scao(scb_s, hpa);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-vsie-sigpi-v1-0-ea9f12066408@linux.ibm.com?part=5