Re: [PATCH v18 23/23] KVM: arm64: CCA: Control user register access for Realms

[Suzuki K Poulose <suzuki.poulose@arm.com>]

On 15/09/2026 17:49, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] arm64: kvm: KVM_SET_ONE_REG rejects PMCR_EL0 for Realm VMs breaking PMU config
> --
> 
> commit 2d966a4231d9ac9707a0d74a6ba5b743ae7b69b3
> Author: Jean-Philippe Brucker <jpb@kernel.org>
> 
> KVM: arm64: CCA: Control user register access for Realms
> 
> This commit restricts user register access for Realm VMs by limiting which
> registers the VMM can read or modify. KVM explicitly allows access to
> ID_AA64DFR0_EL1 and SVE_VLS for Realm parameter configuration before the Realm
> Descriptor is created.
> 
>> diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
>> --- a/arch/arm64/kvm/guest.c
>> +++ b/arch/arm64/kvm/guest.c
> [ ... ]
>> +static bool validate_realm_set_reg(struct kvm_vcpu *vcpu,
>> +				   const struct kvm_one_reg *reg)
>> +{
>> +	if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE) {
>> +		u64 off = core_reg_offset_from_id(reg->id);
>> +
>> +		return kvm_realm_validate_core_reg(off);
>> +	} else {
>> +		switch (reg->id) {
>> +		case KVM_REG_ARM_ID_AA64DFR0_EL1:
>> +		case KVM_REG_ARM64_SVE_VLS:
>> +			return true;
>> +		}
>> +	}
>> +
>> +	return false;
>> +}
> 
> [Severity: High]
> Does this logic unconditionally reject KVM_SET_ONE_REG calls for PMCR_EL0?
> 
> When the VMM attempts to restore or configure the PMU, kvm_arm_set_reg()
> calls validate_realm_set_reg(). Because the UAPI equivalent of SYS_PMCR_EL0
> is missing from this whitelist, the VMM is prevented from configuring the
> number of PMU counters for Realm VMs, breaking VM initialization.
> 
>> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
>> --- a/arch/arm64/kvm/sys_regs.c
>> +++ b/arch/arm64/kvm/sys_regs.c
> [ ... ]
>> +static inline bool kvm_realm_sys_reg_hidden_user(const struct kvm_vcpu *vcpu,
>> +						 u64 reg)
>> +{
>> +	if (!vcpu_is_rec(vcpu))
>> +		return false;
>> +
>> +	switch (reg) {
>> +	case SYS_ID_AA64DFR0_EL1:
>> +	case SYS_PMCR_EL0:
>> +		return false;
>> +	}
>> +	return true;
>> +}
> 
> [Severity: High]
> This explicitly unhides SYS_PMCR_EL0 in kvm_realm_sys_reg_hidden_user(),
> meaning it is returned to the VMM via KVM_GET_REG_LIST.
> 
> Since validate_realm_set_reg() in arch/arm64/kvm/guest.c rejects writes to
> the PMU register, does this create an ABI inconsistency where the register
> is listed but cannot be set?
> 
> Could this mismatch in configuration flow be corrected to allow PMU support
> for Realm VMs?

Yep, this is the idea. We don't have the PMU support in the current 
integration branch. That said, I will remove the PMCR_EL0 from the 
validate_realm_set_reg().

Cheers
Suzuki


>