Re: [PATCH v20 18/22] KVM: arm64: CCA: Don't expose unsupported capabilities for realm guests

[Suzuki K Poulose <suzuki.poulose@arm.com>]

On 24/09/2026 17:25, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] kvm: arm64: CCA: Realm VCPU features bypass capability allowlist
> --
> 
> commit e303d487e75069060645d8d27a0d2607328fb9fc
> Author: Suzuki K Poulose <suzuki.poulose@arm.com>
> 
> KVM: arm64: CCA: Don't expose unsupported capabilities for realm guests
> 
> Limit the capabilities that are allowed for Realm VMs. Similarly block
> the vm_ioctls backed by the capabilities.
> 
> Repurpose the kvm_pkvm_ioctl_allowed() to support both pKVM and Realm
> ioctls. Rename the helper to kvm_vm_ioctl_allowed() and move it
> into arch/arm64/kvm/arm.c. Also add a generic kvm_vm_ext_allowed()
> to handle pKVM and Realm capability filtering and route them accordingly.
> 
>> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
>> index 0e77f59ded6d9..106b52e556e20 100644
>> --- a/arch/arm64/kvm/arm.c
>> +++ b/arch/arm64/kvm/arm.c
> [ ... ]
>> @@ -136,6 +136,49 @@ int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu)
>>   	return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE;
>>   }
>>   
>> +static inline bool kvm_vm_ext_allowed(struct kvm *kvm, long ext)
>> +{
>> +	/*
>> +	 * We could be called with kvm as NULL, so can't use kvm_vm_* for pKVM
>> +	 * flavors
>> +	 */
>> +	if (is_protected_kvm_enabled())
>> +		return kvm_pkvm_ext_allowed(kvm, ext);
>> +	else if (kvm && kvm_vm_is_realm(kvm))
>> +		return kvm_realm_ext_allowed(ext);
>> +	else
>> +		return true;
>> +}
> 
> [Severity: High]
> While this patch correctly limits VM-level capabilities and ioctls for Realm
> VMs, does it miss restricting VCPU-level features during initialization?
> 
> Looking at kvm_vcpu_init_check_features() in arch/arm64/kvm/arm.c:
> 
> static int kvm_vcpu_init_check_features(struct kvm_vcpu *vcpu,
> 					const struct kvm_vcpu_init *init)
> {
> 	unsigned long features = init->features[0];
> 	...
> 	if (features & ~system_supported_vcpu_features())
> 		return -EINVAL;
> 
> Since system_supported_vcpu_features() only checks global host capabilities,
> can a malicious userspace process managing the VM enable restricted VCPU
> features (such as KVM_ARM_VCPU_PMU_V3 or KVM_ARM_VCPU_EL1_32BIT) on a Realm
> VCPU?
> 
> If userspace creates a Realm VM and VCPU, then invokes the KVM_ARM_VCPU_INIT
> ioctl with restricted features set in init.features[0], this could activate
> host KVM emulation logic for a Realm. Would this break the intended isolation
> boundary and lead to inconsistent state or host/RMM crashes when KVM attempts
> to emulate hardware for a Realm managed by the RMM?

The host doesn't get to emulate any of this as the RMM can correctly
handle the Realm VCPU exits. That said, I could restrict the VCPU
features to the ones that are supported for Realms.

--8>--


KVM: arm64: Prevent unsupported vcpu features for VM types

Prevent unsupported VCPU features for the protected VCPUs.
Realms and pVM do not support 32bit EL1 or NV.
pKVM doesn't rely on the host vcpu features, but still
block the vcpu init if we detect incompatible features.

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index fbd5784e481b6..2e153b4fc8f62 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1727,11 +1727,12 @@ int kvm_vm_ioctl_irq_line(struct kvm *kvm, 
struct kvm_irq_level *irq_level,
         return -EINVAL;
  }

-static unsigned long system_supported_vcpu_features(void)
+static unsigned long system_supported_vcpu_features(struct kvm_vcpu *vcpu)
  {
         unsigned long features = KVM_VCPU_VALID_FEATURES;

-       if (!cpus_have_final_cap(ARM64_HAS_32BIT_EL1))
+       if (vcpu_is_protected(vcpu) ||
+           !cpus_have_final_cap(ARM64_HAS_32BIT_EL1))
                 clear_bit(KVM_ARM_VCPU_EL1_32BIT, &features);

         if (!kvm_supports_guest_pmuv3()) {
@@ -1747,7 +1748,8 @@ static unsigned long 
system_supported_vcpu_features(void)
                 clear_bit(KVM_ARM_VCPU_PTRAUTH_GENERIC, &features);
         }

-       if (!cpus_have_final_cap(ARM64_HAS_NESTED_VIRT))
+       if (vcpu_is_protected(vcpu) ||
+           !cpus_have_final_cap(ARM64_HAS_NESTED_VIRT))
                 clear_bit(KVM_ARM_VCPU_HAS_EL2, &features);

         return features;
@@ -1767,7 +1769,7 @@ static int kvm_vcpu_init_check_features(struct 
kvm_vcpu *vcpu,
                         return -ENOENT;
         }

-       if (features & ~system_supported_vcpu_features())
+       if (features & ~system_supported_vcpu_features(vcpu))
                 return -EINVAL;


Suzuki

>