Re: [PATCH v19 02/20] KVM: arm64: Disable Steal time accounting for protected guests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] arm64: kvm: contradictory SMCCC advertisement for PV_TIME on protected VMs
--

commit db2c057e4ceefd58162587d4fd417788a4db3dbc
Author: Suzuki K Poulose <suzuki.poulose@arm.com>

    KVM: arm64: Disable Steal time accounting for protected guests
    
    PVTIME support is advertised by KVM_CAP_STEAL_TIME, which doesn't take into
    account the kvm instance. Even with that, a VMM could skip the CAP check
    and proceed to configure the PVTIME as we don't do further check on the
    DEVICE_CTRL. Tighten this up by passing the KVM instance around wherever
    possible and catch things early.

> diff --git a/arch/arm64/kvm/pvtime.c b/arch/arm64/kvm/pvtime.c
> index 4ceabaa4c30bd..579e0a4720ad2 100644
> --- a/arch/arm64/kvm/pvtime.c
> +++ b/arch/arm64/kvm/pvtime.c
> @@ -67,9 +67,9 @@ gpa_t kvm_init_stolen_time(struct kvm_vcpu *vcpu)
>  	return base;
>  }
>  
> -bool kvm_arm_pvtime_supported(void)
> +bool kvm_arm_pvtime_supported(struct kvm *kvm)
>  {
> -	return !!sched_info_on();
> +	return !!sched_info_on() && (!kvm || !kvm_vm_is_protected(kvm));
>  }

[Severity: Medium]
Does this create a contradictory SMCCC advertisement for protected VMs?

A protected guest querying ARM_SMCCC_ARCH_FEATURES_FUNC_ID for
ARM_SMCCC_HV_PV_TIME_FEATURES in kvm_smccc_call_handler() will receive
SMCCC_RET_SUCCESS because the KVM_REG_ARM_STD_HYP_BIT_PV_TIME bit is
still set in std_hyp_bmap:

arch/arm64/kvm/hypercalls.c:kvm_smccc_call_handler() {
	...
	case ARM_SMCCC_HV_PV_TIME_FEATURES:
		if (test_bit(KVM_REG_ARM_STD_HYP_BIT_PV_TIME,
			     &smccc_feat->std_hyp_bmap))
			val[0] = SMCCC_RET_SUCCESS;
		break;
	...
}

However, when the guest actually invokes the feature,
kvm_hypercall_pv_features() returns SMCCC_RET_NOT_SUPPORTED because
the IPA is unconfigured:

arch/arm64/kvm/pvtime.c:kvm_hypercall_pv_features() {
	...
	case ARM_SMCCC_HV_PV_TIME_FEATURES:
	case ARM_SMCCC_HV_PV_TIME_ST:
		if (vcpu->arch.steal.base != INVALID_GPA)
			val = SMCCC_RET_SUCCESS;
		break;
	...
}

This violates the SMCCC ABI by advertising ARM_SMCCC_HV_PV_TIME_FEATURES
as supported but returning NOT_SUPPORTED when it is invoked. Should the
KVM_REG_ARM_STD_HYP_BIT_PV_TIME bit be cleared for protected VMs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920212845.707-1-suzuki.poulose@arm.com?part=2