[PATCH v15 19/37] KVM: arm64: CCA: Activate realms on first vCPU run

[Marc Zyngier]

On Wed, 15 Jul 2026 15:28:21 +0100,
Steven Price <steven.price at arm.com> wrote:
> 
> Use kvm_arch_vcpu_run_pid_change() to check if this is the first time
> the realm guest has run. If this is the first run then activate the
> realm.
> 
> Signed-off-by: Steven Price <steven.price at arm.com>
> 
> ---
> Changes since v12:
>  * Fix commit message
>  * Change realm_state checks to be >= REALM_STATE_ACTIVE to avoid a dead
>    guest being revived by kvm_activate_realm().
> ---
>  arch/arm64/include/asm/kvm_rmi.h |  1 +
>  arch/arm64/kvm/arm.c             |  6 +++++
>  arch/arm64/kvm/rmi.c             | 45 ++++++++++++++++++++++++++++++--
>  3 files changed, 50 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
> index 5461c49bea4d..5cb99c187202 100644
> --- a/arch/arm64/include/asm/kvm_rmi.h
> +++ b/arch/arm64/include/asm/kvm_rmi.h
> @@ -96,6 +96,7 @@ void kvm_init_rmi(void);
>  u32 kvm_rmm_ipa_limit(void);
>  
>  int kvm_init_realm(struct kvm *kvm);
> +int kvm_activate_realm(struct kvm *kvm);
>  void kvm_destroy_realm(struct kvm *kvm);
>  int kvm_realm_teardown_stage2(struct kvm *kvm);
>  void kvm_destroy_rec(struct kvm_vcpu *vcpu);
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index 534d33b7c67a..df33322b8fea 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -1034,6 +1034,12 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu)
>  			return ret;
>  	}
>  
> +	if (kvm_is_realm(vcpu->kvm)) {
> +		ret = kvm_activate_realm(kvm);
> +		if (ret)
> +			return ret;
> +	}
> +
>  	mutex_lock(&kvm->arch.config_lock);
>  	set_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags);
>  	mutex_unlock(&kvm->arch.config_lock);
> diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
> index 94776a9262c9..53b5b18f2275 100644
> --- a/arch/arm64/kvm/rmi.c
> +++ b/arch/arm64/kvm/rmi.c
> @@ -687,7 +687,7 @@ static int realm_set_ipa_state(struct kvm_vcpu *vcpu,
>  	return ret;
>  }
>  
> -static int __maybe_unused realm_ensure_created(struct kvm *kvm)
> +static int realm_ensure_created(struct kvm *kvm)
>  {
>  	lockdep_assert_held(&kvm->arch.config_lock);
>  
> @@ -793,7 +793,7 @@ int noinstr kvm_rec_enter(struct kvm_vcpu *vcpu)
>  	return ret;
>  }
>  
> -static int __maybe_unused kvm_create_rec(struct kvm_vcpu *vcpu)
> +static int kvm_create_rec(struct kvm_vcpu *vcpu)
>  {
>  	struct user_pt_regs *vcpu_regs = vcpu_gp_regs(vcpu);
>  	unsigned long mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
> @@ -893,6 +893,47 @@ void kvm_destroy_rec(struct kvm_vcpu *vcpu)
>  	rec->rec_page = NULL;
>  }
>  
> +int kvm_activate_realm(struct kvm *kvm)
> +{
> +	struct realm *realm = &kvm->arch.realm;
> +	struct kvm_vcpu *vcpu;
> +	unsigned long i;
> +	int ret;
> +
> +	if (kvm_realm_state(kvm) >= REALM_STATE_ACTIVE)
> +		return 0;
> +
> +	if (!irqchip_in_kernel(kvm)) {
> +		/* Userspace irqchip not yet supported with realms */
> +		return -EOPNOTSUPP;
> +	}

This could race with the irqchip being created on another CPU. Also,
an irqchip being in kernel doesn't mean it is ready, and I suspect
you also need to check that it has been initialised.

> +
> +	guard(mutex)(&kvm->arch.config_lock);
> +	/* Check again with the lock held */
> +	if (kvm_realm_state(kvm) >= REALM_STATE_ACTIVE)
> +		return 0;
> +
> +	ret = realm_ensure_created(kvm);
> +	if (ret)
> +		return ret;
> +
> +	/* Mark state as dead in case we fail */
> +	kvm_set_realm_state(kvm, REALM_STATE_DEAD);
> +
> +	kvm_for_each_vcpu(i, vcpu, kvm) {
> +		ret = kvm_create_rec(vcpu);
> +		if (ret)
> +			return ret;
> +	}

If the realm is dead, shouldn't the KVM view of death apply as well?

> +
> +	ret = rmi_realm_activate(virt_to_phys(realm->rd));
> +	if (ret)
> +		return -ENXIO;
> +
> +	kvm_set_realm_state(kvm, REALM_STATE_ACTIVE);
> +	return 0;
> +}
> +
>  void kvm_destroy_realm(struct kvm *kvm)
>  {
>  	struct realm *realm = &kvm->arch.realm;

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.