Re: [PATCH v15 19/37] KVM: arm64: CCA: Activate realms on first vCPU run

On 03/08/2026 13:29, Marc Zyngier wrote:
> On Wed, 15 Jul 2026 15:28:21 +0100,
> Steven Price <[email protected]> wrote:
>>
>> Use kvm_arch_vcpu_run_pid_change() to check if this is the first time
>> the realm guest has run. If this is the first run then activate the
>> realm.
>>
>> Signed-off-by: Steven Price <[email protected]>
>>
>> ---
>> Changes since v12:
>>  * Fix commit message
>>  * Change realm_state checks to be >= REALM_STATE_ACTIVE to avoid a dead
>>    guest being revived by kvm_activate_realm().
>> ---
>>  arch/arm64/include/asm/kvm_rmi.h |  1 +
>>  arch/arm64/kvm/arm.c             |  6 +++++
>>  arch/arm64/kvm/rmi.c             | 45 ++++++++++++++++++++++++++++++--
>>  3 files changed, 50 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
>> index 5461c49bea4d..5cb99c187202 100644
>> --- a/arch/arm64/include/asm/kvm_rmi.h
>> +++ b/arch/arm64/include/asm/kvm_rmi.h
>> @@ -96,6 +96,7 @@ void kvm_init_rmi(void);
>>  u32 kvm_rmm_ipa_limit(void);
>>  
>>  int kvm_init_realm(struct kvm *kvm);
>> +int kvm_activate_realm(struct kvm *kvm);
>>  void kvm_destroy_realm(struct kvm *kvm);
>>  int kvm_realm_teardown_stage2(struct kvm *kvm);
>>  void kvm_destroy_rec(struct kvm_vcpu *vcpu);
>> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
>> index 534d33b7c67a..df33322b8fea 100644
>> --- a/arch/arm64/kvm/arm.c
>> +++ b/arch/arm64/kvm/arm.c
>> @@ -1034,6 +1034,12 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu)
>>  			return ret;
>>  	}
>>  
>> +	if (kvm_is_realm(vcpu->kvm)) {
>> +		ret = kvm_activate_realm(kvm);
>> +		if (ret)
>> +			return ret;
>> +	}
>> +
>>  	mutex_lock(&kvm->arch.config_lock);
>>  	set_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags);
>>  	mutex_unlock(&kvm->arch.config_lock);
>> diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
>> index 94776a9262c9..53b5b18f2275 100644
>> --- a/arch/arm64/kvm/rmi.c
>> +++ b/arch/arm64/kvm/rmi.c
>> @@ -687,7 +687,7 @@ static int realm_set_ipa_state(struct kvm_vcpu *vcpu,
>>  	return ret;
>>  }
>>  
>> -static int __maybe_unused realm_ensure_created(struct kvm *kvm)
>> +static int realm_ensure_created(struct kvm *kvm)
>>  {
>>  	lockdep_assert_held(&kvm->arch.config_lock);
>>  
>> @@ -793,7 +793,7 @@ int noinstr kvm_rec_enter(struct kvm_vcpu *vcpu)
>>  	return ret;
>>  }
>>  
>> -static int __maybe_unused kvm_create_rec(struct kvm_vcpu *vcpu)
>> +static int kvm_create_rec(struct kvm_vcpu *vcpu)
>>  {
>>  	struct user_pt_regs *vcpu_regs = vcpu_gp_regs(vcpu);
>>  	unsigned long mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
>> @@ -893,6 +893,47 @@ void kvm_destroy_rec(struct kvm_vcpu *vcpu)
>>  	rec->rec_page = NULL;
>>  }
>>  
>> +int kvm_activate_realm(struct kvm *kvm)
>> +{
>> +	struct realm *realm = &kvm->arch.realm;
>> +	struct kvm_vcpu *vcpu;
>> +	unsigned long i;
>> +	int ret;
>> +
>> +	if (kvm_realm_state(kvm) >= REALM_STATE_ACTIVE)
>> +		return 0;
>> +
>> +	if (!irqchip_in_kernel(kvm)) {
>> +		/* Userspace irqchip not yet supported with realms */
>> +		return -EOPNOTSUPP;
>> +	}
> 
> This could race with the irqchip being created on another CPU. Also,
> an irqchip being in kernel doesn't mean it is ready, and I suspect
> you also need to check that it has been initialised.

Good point - moving the config_lock up and checking vgic_initialized()
makes sense.

>> +
>> +	guard(mutex)(&kvm->arch.config_lock);
>> +	/* Check again with the lock held */
>> +	if (kvm_realm_state(kvm) >= REALM_STATE_ACTIVE)
>> +		return 0;
>> +
>> +	ret = realm_ensure_created(kvm);
>> +	if (ret)
>> +		return ret;
>> +
>> +	/* Mark state as dead in case we fail */
>> +	kvm_set_realm_state(kvm, REALM_STATE_DEAD);
>> +
>> +	kvm_for_each_vcpu(i, vcpu, kvm) {
>> +		ret = kvm_create_rec(vcpu);
>> +		if (ret)
>> +			return ret;
>> +	}
> 
> If the realm is dead, shouldn't the KVM view of death apply as well?

Indeed that would be a good improvement. I'll change these error paths
to include a kvm_vm_dead() call.

Thanks,
Steve

>> +
>> +	ret = rmi_realm_activate(virt_to_phys(realm->rd));
>> +	if (ret)
>> +		return -ENXIO;
>> +
>> +	kvm_set_realm_state(kvm, REALM_STATE_ACTIVE);
>> +	return 0;
>> +}
>> +
>>  void kvm_destroy_realm(struct kvm *kvm)
>>  {
>>  	struct realm *realm = &kvm->arch.realm;
> 
> Thanks,
> 
> 	M.
>