[PATCH v16 30/45] KVM: arm64: CCA: Handle realm vCPU load

[Kohei Enju]

On 08/03 14:43, Steven Price wrote:
> When loading a realm VCPU much of the work is handled by the RMM so only
> some of the actions are required. Rearrange kvm_arch_vcpu_load()
> slightly so we can bail out early for a realm guest.

Hi Steven,

I found that Realm guests can execute WFI/WFE instructions without
causing a REC exit, ignoring KVM's WFx trap policy.

I'd suggest translating HCR_EL2.TWE/TWI into the corresponding
run->enter.flags to honor the policy. Below is the patch I tested.

----
>From 8637cd6f818a3c56d8b898a72874e9485eb94e59 Mon Sep 17 00:00:00 2001
From: Kohei Enju <enju.kohei at fujitsu.com>
Date: Mon, 10 Aug 2026 22:54:27 +0900
Subject: [PATCH] KVM: arm64: CCA: Honor WFx trap policy for Realm vCPUs

Propagate KVM's WFx trap policy to the RMM by translating
HCR_EL2.TWE/TWI into REC_ENTER TRAP_WFE/WFI flags before entering a REC.

Without this, guests can execute WFE/WFI instructions without causing a
REC exit, ignoring KVM's common trap policy. Configure the REC_ENTER
flags to honor the policy.

Signed-off-by: Kohei Enju <enju.kohei at fujitsu.com>
---
 arch/arm64/include/asm/kvm_rmi.h |  2 ++
 arch/arm64/kvm/arm.c             |  3 +++
 arch/arm64/kvm/rmi.c             | 14 ++++++++++++++
 3 files changed, 19 insertions(+)

diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
index 2789879b6701..b858c6b4db6a 100644
--- a/arch/arm64/include/asm/kvm_rmi.h
+++ b/arch/arm64/include/asm/kvm_rmi.h
@@ -109,6 +109,8 @@ void kvm_destroy_realm(struct kvm *kvm);
 int kvm_realm_teardown_stage2(struct kvm *kvm);
 void kvm_destroy_rec(struct kvm_vcpu *vcpu);
 
+void kvm_rec_set_wfx_traps(struct kvm_vcpu *vcpu);
+
 int kvm_rec_enter(struct kvm_vcpu *vcpu);
 int kvm_rec_exit(struct kvm_vcpu *vcpu, int rec_run_status);
 int kvm_rec_handle_request(struct kvm_vcpu *vcpu);
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 7edc572dd8ab..0cba333b4fd2 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -770,6 +770,9 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 	else
 		vcpu->arch.hcr_el2 |= HCR_TWI;
 
+	if (vcpu_is_rec(vcpu))
+		kvm_rec_set_wfx_traps(vcpu);
+
 	vcpu_set_pauth_traps(vcpu);
 
 	if (is_protected_kvm_enabled()) {
diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
index c242dfc2c7a6..c472f3d03234 100644
--- a/arch/arm64/kvm/rmi.c
+++ b/arch/arm64/kvm/rmi.c
@@ -1302,6 +1302,20 @@ static void noinstr load_realm_timer_state(struct kvm_vcpu *vcpu)
 	write_sysreg_el0(rec_exit->cntp_ctl, SYS_CNTP_CTL);
 }
 
+void kvm_rec_set_wfx_traps(struct kvm_vcpu *vcpu)
+{
+	struct realm_rec *rec = &vcpu->arch.rec;
+
+	rec->run->enter.flags &=
+		~(REC_ENTER_FLAG_TRAP_WFE | REC_ENTER_FLAG_TRAP_WFI);
+
+	if (vcpu->arch.hcr_el2 & HCR_TWE)
+		rec->run->enter.flags |= REC_ENTER_FLAG_TRAP_WFE;
+
+	if (vcpu->arch.hcr_el2 & HCR_TWI)
+		rec->run->enter.flags |= REC_ENTER_FLAG_TRAP_WFI;
+}
+
 int noinstr kvm_rec_enter(struct kvm_vcpu *vcpu)
 {
 	struct realm_rec *rec = &vcpu->arch.rec;
-- 
2.43.0

> 
> Signed-off-by: Steven Price <steven.price at arm.com>
> ---
>  arch/arm64/kvm/arm.c | 19 ++++++++++++-------
>  1 file changed, 12 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index f1b26b263bf0..96e536d2dda8 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -707,7 +707,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
>  	struct kvm_s2_mmu *mmu;
>  	int *last_ran;
>  
> -	if (is_protected_kvm_enabled())
> +	if (is_protected_kvm_enabled() || kvm_is_realm(vcpu->kvm))
>  		goto nommu;
>  
>  	if (vcpu_has_nv(vcpu))
> @@ -751,12 +751,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
>  	kvm_vgic_load(vcpu);
>  	kvm_vcpu_load_debug(vcpu);
>  	kvm_vcpu_load_fgt(vcpu);
> -	if (has_vhe())
> -		kvm_vcpu_load_vhe(vcpu);
> -	kvm_arch_vcpu_load_fp(vcpu);
> -	kvm_vcpu_pmu_restore_guest(vcpu);
> -	if (kvm_arm_is_pvtime_enabled(&vcpu->arch))
> -		kvm_make_request(KVM_REQ_RECORD_STEAL, vcpu);
>  
>  	if (kvm_vcpu_should_clear_twe(vcpu))
>  		vcpu->arch.hcr_el2 &= ~HCR_TWE;
> @@ -778,6 +772,17 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
>  			     &vcpu->arch.vgic_cpu.vgic_v3);
>  	}
>  
> +	/* No additional state needs to be loaded on Realmed VMs */
> +	if (vcpu_is_rec(vcpu))
> +		return;
> +
> +	if (has_vhe())
> +		kvm_vcpu_load_vhe(vcpu);
> +	kvm_arch_vcpu_load_fp(vcpu);
> +	kvm_vcpu_pmu_restore_guest(vcpu);
> +	if (kvm_arm_is_pvtime_enabled(&vcpu->arch))
> +		kvm_make_request(KVM_REQ_RECORD_STEAL, vcpu);
> +
>  	if (!cpumask_test_cpu(cpu, vcpu->kvm->arch.supported_cpus))
>  		vcpu_set_on_unsupported_cpu(vcpu);
>  
> -- 
> 2.43.0
>