Re: [PATCH v17 12/20] KVM: arm64: CCA: Support timers in realm RECs

[Suzuki K Poulose <suzuki.poulose@arm.com>]

On 08/09/2026 17:56, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Realm VM timers are blackholed on GICv5 hosts due to unconditional physical interrupt masking combined with disabled direct injection.
> --
> 
> commit 759ada4556cf9518a1b30ec3610b7b7833129bd9
> Author: Steven Price <steven.price@arm.com>
> 
> KVM: arm64: CCA: Support timers in realm RECs
> 
> This commit adds support for handling timers when exiting a realm REC to the
> normal world. It implements realm_timer_irq_ops which relies on the existing
> software resampling mechanism for Realm timer interrupts.
> 
>> diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
>> index eba84cab95d01..3eddf44f7b1dd 100644
>> --- a/arch/arm64/kvm/arch_timer.c
>> +++ b/arch/arm64/kvm/arch_timer.c
> [ ... ]
>> @@ -1609,8 +1623,12 @@ int kvm_timer_enable(struct kvm_vcpu *vcpu)
>>   
>>   	get_timer_map(vcpu, &map);
>>   
>> -	ops = vgic_is_v5(vcpu->kvm) ? &arch_timer_irq_ops_vgic_v5 :
>> -				      &arch_timer_irq_ops;
>> +	if (vcpu_is_rec(vcpu))
>> +		ops = &realm_timer_irq_ops;
>> +	else if (vgic_is_v5(vcpu->kvm))
>> +		ops = &arch_timer_irq_ops_vgic_v5;
>> +	else
>> +		ops = &arch_timer_irq_ops;
>>   
>>   	for (int i = 0; i < nr_timers(vcpu); i++)
>>   		kvm_vgic_set_irq_ops(vcpu, timer_irq(vcpu_get_timer(vcpu, i)), ops);
> 
> [Severity: High]
> Will this cause Realm VM timers to be lost on a GICv5 host?
> 
> When a Realm VM is created on a GICv5 host, vcpu_is_rec(vcpu) takes precedence,
> assigning realm_timer_irq_ops. However, this struct lacks the
> .set_direct_injection callback used for hardware direct injection.
> 
> At the same time, because vgic_is_v5(vcpu->kvm) is still true for the host,
> other timer paths will unconditionally assume direct injection is active. For
> example, kvm_timer_update_irq() skips software injection:
> 
> kvm_timer_update_irq() {
>          ...
>          /* Skip injecting on GICv5 for directly injected (DVI'd) timers */
>          if (vgic_is_v5(vcpu->kvm)) {
>                  ...
>                  if (map.direct_ptimer == timer_ctx ||
>                      map.direct_vtimer == timer_ctx)
>                          return;
>          }
> }
> 
> Additionally, kvm_timer_vcpu_load_gic() unconditionally masks the physical
> timer interrupt for GICv5 setups:
> 
> kvm_timer_vcpu_load_gic() {
>          ...
>          phys_active |= pending;
>          phys_active |= vgic_is_v5(vcpu->kvm);
> 
>          set_timer_irq_phys_active(ctx, phys_active);
> }
> 
> Since hardware injection is not configured by the Realm ops and software
> injection is bypassed due to the GICv5 checks, does this completely blackhole
> timer interrupts for Realm VMs on GICv5 hardware?
> 

CCA doesn't support VGIC_V5. We only support VGIC_V3. I have added the 
following patch to make sure this is mandated:



---8>---

KVM: arm64: CCA: Mandate VGIC_V3 for Realms

Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

diff --git a/arch/arm64/kvm/vgic/vgic-init.c 
b/arch/arm64/kvm/vgic/vgic-init.c
index 4012df6002ea6..452c085073f3e 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -84,6 +84,9 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
                 !kvm_vgic_global_state.can_emulate_gicv2)
                 return -ENODEV;

+       /* Realms only support VGIC_V3 */
+       if (kvm_vm_is_realm(kvm) && type != KVM_DEV_TYPE_ARM_VGIC_V3)
+               return -ENODEV;
         /*
          * Ensure mutual exclusion with vCPU creation and any vCPU 
ioctls by:

Suzuki