Re: [PATCH v2 07/20] KVM: arm64: Share more arm64 code with s390

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Guest-reachable WARN_ONCE in bad_trap() via read_from_write_only() and write_to_read_only()
- [High] Guest-reachable WARN_ON_ONCE in access_gicv5_ppi_enabler() triggered by a guest read.
--

commit feaf451c9f33eb68d8400a6395fedbe94a88f53b
Author: Steffen Eiden <seiden@linux.ibm.com>
Date:   Mon Aug 31 14:55:22 2026 +0000

    KVM: arm64: Share more arm64 code with s390

This commit marks several functions in the KVM arm64 subsystem as shared so 
they can be reused by s390. It achieves this by wrapping the relevant
code blocks in #ifdef ARM64_S390_COMMON.

> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 53d096803d9dc..b167f9d06fd46 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -82,6 +83,8 @@ static bool write_to_read_only(struct kvm_vcpu *vcpu,
>  			"sys_reg write to read-only register");
>  }
>  
> +#endif /* ARM64_S390_COMMON */
> +

[Severity: High]
This is a pre-existing issue, but doesn't bad_trap() allow a guest to trigger
a host DoS?

The bad_trap() function calls WARN_ONCE() which will crash the host if
panic_on_warn is enabled:

arch/arm64/kvm/sys_regs.c:bad_trap() {
	WARN_ONCE(1, "Unexpected %s\n", msg);
	...
}

This is unconditionally reached if a system register handler calls
read_from_write_only() or write_to_read_only().

Because KVM's sysreg dispatcher does not validate the direction (read vs. write)
of an access before calling a register's trap handler, a malicious guest can
deliberately execute a read (e.g., MRS) to a write-only register that traps to
EL2.

The dispatcher routes it to the handler with p->is_write == false, the handler
checks !p->is_write, calls read_from_write_only(), and triggers the host warning.

[ ... ]

> @@ -800,6 +806,7 @@ static bool access_gicv5_ppi_enabler(struct kvm_vcpu *vcpu,
>  	return true;
>  }
>  
> +#ifdef ARM64_S390_COMMON
>  static bool trap_raz_wi(struct kvm_vcpu *vcpu,

[Severity: High]
This isn't a bug introduced by this patch, but doesn't the 
access_gicv5_ppi_enabler() trap handler also allow a malicious guest to crash
the host?

The handler executes a WARN_ON_ONCE unconditionally upon entry:

arch/arm64/kvm/sys_regs.c:access_gicv5_ppi_enabler() {
	...
	/* We never expect to get here with a read! */
	if (WARN_ON_ONCE(!p->is_write))
		return undef_access(vcpu, p, r);
	...
}

Similar to the issue above, the system register dispatcher does not intrinsically
filter read vs. write accesses before routing the trap to the handler.

A guest could execute an MRS (read) instruction targeting ICC_PPI_ENABLER0_EL1,
which would route to this handler with p->is_write == false, triggering the
warning and potentially causing a host DoS.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831145536.913567-1-seiden@linux.ibm.com?part=7