Re: [PATCH v17 12/20] KVM: arm64: CCA: Support timers in realm RECs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Realm VM timers are blackholed on GICv5 hosts due to unconditional physical interrupt masking combined with disabled direct injection.
--

commit 759ada4556cf9518a1b30ec3610b7b7833129bd9
Author: Steven Price <steven.price@arm.com>

KVM: arm64: CCA: Support timers in realm RECs

This commit adds support for handling timers when exiting a realm REC to the
normal world. It implements realm_timer_irq_ops which relies on the existing
software resampling mechanism for Realm timer interrupts.

> diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
> index eba84cab95d01..3eddf44f7b1dd 100644
> --- a/arch/arm64/kvm/arch_timer.c
> +++ b/arch/arm64/kvm/arch_timer.c
[ ... ]
> @@ -1609,8 +1623,12 @@ int kvm_timer_enable(struct kvm_vcpu *vcpu)
>  
>  	get_timer_map(vcpu, &map);
>  
> -	ops = vgic_is_v5(vcpu->kvm) ? &arch_timer_irq_ops_vgic_v5 :
> -				      &arch_timer_irq_ops;
> +	if (vcpu_is_rec(vcpu))
> +		ops = &realm_timer_irq_ops;
> +	else if (vgic_is_v5(vcpu->kvm))
> +		ops = &arch_timer_irq_ops_vgic_v5;
> +	else
> +		ops = &arch_timer_irq_ops;
>  
>  	for (int i = 0; i < nr_timers(vcpu); i++)
>  		kvm_vgic_set_irq_ops(vcpu, timer_irq(vcpu_get_timer(vcpu, i)), ops);

[Severity: High]
Will this cause Realm VM timers to be lost on a GICv5 host?

When a Realm VM is created on a GICv5 host, vcpu_is_rec(vcpu) takes precedence,
assigning realm_timer_irq_ops. However, this struct lacks the
.set_direct_injection callback used for hardware direct injection.

At the same time, because vgic_is_v5(vcpu->kvm) is still true for the host,
other timer paths will unconditionally assume direct injection is active. For
example, kvm_timer_update_irq() skips software injection:

kvm_timer_update_irq() {
        ...
        /* Skip injecting on GICv5 for directly injected (DVI'd) timers */
        if (vgic_is_v5(vcpu->kvm)) {
                ...
                if (map.direct_ptimer == timer_ctx ||
                    map.direct_vtimer == timer_ctx)
                        return;
        }
}

Additionally, kvm_timer_vcpu_load_gic() unconditionally masks the physical
timer interrupt for GICv5 setups:

kvm_timer_vcpu_load_gic() {
        ...
        phys_active |= pending;
        phys_active |= vgic_is_v5(vcpu->kvm);

        set_timer_irq_phys_active(ctx, phys_active);
}

Since hardware injection is not configured by the Realm ops and software
injection is bypassed due to the GICv5 checks, does this completely blackhole
timer interrupts for Realm VMs on GICv5 hardware?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908162223.1683432-1-suzuki.poulose@arm.com?part=12