Re: [PATCH v20 7/9] arm64: Block hibernate and kexec while RMM is active

[Suzuki K Poulose <suzuki.poulose@arm.com>]

On 29/09/2026 23:26, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] arm64: hibernation resume blind copy triggers GPF when RMM is active
> --
> 
> commit cd33ba7dfabdc9882b5491e3f0d6693b247f8326
> Author: Suzuki K Poulose <suzuki.poulose@arm.com>
> 
> arm64: Block hibernate and kexec while RMM is active
> 
> RMM can be deactivated only after all delegated granules have been
> reclaimed. If a new kernel is entered while any granules remain in the
> Realm PAS, accesses to that memory can raise a Granule Protection Fault
> and be fatal to the new kernel.
> 
>> diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
>> index 424291c547f02..253f544a59731 100644
>> --- a/arch/arm64/kernel/hibernate.c
>> +++ b/arch/arm64/kernel/hibernate.c
> 
> [ ... ]
> 
>> @@ -341,6 +342,11 @@ int swsusp_arch_suspend(void)
>>   		return -EBUSY;
>>   	}
>>   
>> +	if (is_rmm_active()) {
>> +		pr_err("Can't hibernate: RMM is active.\n");
>> +		return -EBUSY;
>> +	}
>> +
> 
> [Severity: High]
> While this successfully prevents saving a hibernation image, is there a missing
> check in the resume path, specifically arch_hibernation_header_restore() in
> arch/arm64/kernel/hibernate.c?
> 
> If a hibernation image is present on disk (e.g., from a prior boot with RMM
> disabled, but with a matching uts_version), subsys_initcall(arm64_init_rmi)
> activates RMM and delegates memory to the Realm PAS early in boot.
> 
> Later, late_initcall_sync(software_resume_initcall) restores the image.
> Because arch_hibernation_header_restore() lacks an is_rmm_active() check,
> the image is accepted. The low-level resume path swsusp_arch_resume() then
> blindly overwrites physical memory with the saved image.
> 
> Without an upstream guard during resume, won't this overwrite newly delegated
> Realm PAS memory, triggering a fatal Granule Protection Fault?

That is a valid point, I have added a check there to bail out if the rmm
is active.

Suzuki

> 
>>   	flags = local_daif_save();
>>   
>>   	if (__cpu_suspend_enter(&state)) {
>