Re: [PATCH v18 23/23] KVM: arm64: CCA: Control user register access for Realms

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm64: kvm: KVM_SET_ONE_REG rejects PMCR_EL0 for Realm VMs breaking PMU config
--

commit 2d966a4231d9ac9707a0d74a6ba5b743ae7b69b3
Author: Jean-Philippe Brucker <jpb@kernel.org>

KVM: arm64: CCA: Control user register access for Realms

This commit restricts user register access for Realm VMs by limiting which
registers the VMM can read or modify. KVM explicitly allows access to
ID_AA64DFR0_EL1 and SVE_VLS for Realm parameter configuration before the Realm
Descriptor is created.

> diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
> --- a/arch/arm64/kvm/guest.c
> +++ b/arch/arm64/kvm/guest.c
[ ... ]
> +static bool validate_realm_set_reg(struct kvm_vcpu *vcpu,
> +				   const struct kvm_one_reg *reg)
> +{
> +	if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE) {
> +		u64 off = core_reg_offset_from_id(reg->id);
> +
> +		return kvm_realm_validate_core_reg(off);
> +	} else {
> +		switch (reg->id) {
> +		case KVM_REG_ARM_ID_AA64DFR0_EL1:
> +		case KVM_REG_ARM64_SVE_VLS:
> +			return true;
> +		}
> +	}
> +
> +	return false;
> +}

[Severity: High]
Does this logic unconditionally reject KVM_SET_ONE_REG calls for PMCR_EL0?

When the VMM attempts to restore or configure the PMU, kvm_arm_set_reg()
calls validate_realm_set_reg(). Because the UAPI equivalent of SYS_PMCR_EL0
is missing from this whitelist, the VMM is prevented from configuring the
number of PMU counters for Realm VMs, breaking VM initialization.

> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
[ ... ]
> +static inline bool kvm_realm_sys_reg_hidden_user(const struct kvm_vcpu *vcpu,
> +						 u64 reg)
> +{
> +	if (!vcpu_is_rec(vcpu))
> +		return false;
> +
> +	switch (reg) {
> +	case SYS_ID_AA64DFR0_EL1:
> +	case SYS_PMCR_EL0:
> +		return false;
> +	}
> +	return true;
> +}

[Severity: High]
This explicitly unhides SYS_PMCR_EL0 in kvm_realm_sys_reg_hidden_user(),
meaning it is returned to the VMM via KVM_GET_REG_LIST.

Since validate_realm_set_reg() in arch/arm64/kvm/guest.c rejects writes to
the PMU register, does this create an ABI inconsistency where the register
is listed but cannot be set?

Could this mismatch in configuration flow be corrected to allow PMU support
for Realm VMs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915160141.3543048-1-suzuki.poulose@arm.com?part=23