Re: [PATCH v3 15/18] KVM: arm64: Reject host access to protected VM private state

[Marc Zyngier]

On Mon, 14 Sep 2026 12:33:35 +0100,
Fuad Tabba <fuad.tabba@xxxxxxxxx> wrote:
> 
> A protected vCPU's register and debug state is no longer exposed to
> the host. Host ioctls that would reach that state now fail rather
> than operate on a copy that isn't the guest's:
> 
>   - KVM_GET_ONE_REG and KVM_SET_ONE_REG return -EPERM once the vCPU has
>     run: the copy then holds reset values plus what the exit handlers
>     marshal out. Pre-run access still builds the guest's boot state.
>   - KVM_ARM_VCPU_INIT returns -EPERM once the vCPU has run: it would
>     reset the host copy alone and rewrite mp_state, which EL2 reads
>     only at hyp vCPU creation, so a vCPU the guest powered off would
>     come back RUNNABLE.
>   - KVM_SET_VCPU_EVENTS rejects external-abort injection with -EPERM;
>     SError injection is forwarded and stays permitted.
>   - KVM_SET_GUEST_DEBUG returns -EPERM: a protected guest's debug state
>     is hypervisor-owned.
> 
> The KVM_{GET,SET}_ONE_REG and KVM_ARM_VCPU_INIT checks are one filter
> on the ioctl number in kvm_arch_vcpu_ioctl(), the only caller of the
> three functions they were in. Its -EPERM now precedes the cases'
> -EFAULT and the ONE_REG case's pending-reset handling, which the next
> KVM_RUN performs. The external-abort check reads the payload, and
> KVM_SET_GUEST_DEBUG has its own case in kvm_vcpu_ioctl(), so it never
> reaches kvm_arch_vcpu_ioctl(): those two stay in their handlers.
> 
> KVM_CHECK_EXTENSION returns 0 for KVM_CAP_ARM_INJECT_EXT_DABT and
> KVM_CAP_SET_GUEST_DEBUG on a protected VM: kvm_pkvm_ext_allowed()
> returns false on every capability it doesn't list, and the patch that
> advertises the capabilities protected VMs support leaves these two
> out. The two ioctl checks stay for a VMM that doesn't query
> KVM_CHECK_EXTENSION.
> 
> Signed-off-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>
> ---
>  arch/arm64/kvm/arm.c   | 21 +++++++++++++++++++++
>  arch/arm64/kvm/guest.c | 11 +++++++++++
>  2 files changed, 32 insertions(+)
> 
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index ca6e109b3e5d6..0362f5f235e02 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -1865,6 +1865,23 @@ static int kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
>  	return __kvm_arm_vcpu_set_events(vcpu, events);
>  }
>  
> +/*
> + * Once a protected vCPU has run, the host copy is not the guest's state,
> + * and EL2 has read mp_state, which it does only at hyp vCPU creation.
> + */
> +static long pkvm_filter_vcpu_ioctl(struct kvm_vcpu *vcpu, unsigned int ioctl)
> +{
> +	switch (ioctl) {
> +	case KVM_ARM_VCPU_INIT:
> +	case KVM_SET_ONE_REG:
> +	case KVM_GET_ONE_REG:
> +		if (vcpu_is_protected(vcpu) && vcpu_has_run_once(vcpu))
> +			return -EPERM;
> +	}
> +
> +	return 0;
> +}
> +

I'm not keen on returning -EPERM for the ONE_REG stuff. For a start,
X0 *is* valid on MMIO, and when you want to support LD64B and co,
you'll need to show the actual data there.

I'd rather return what is in the host vcpu structure, as normal.

	M.

-- 
Without deviation from the norm, progress is not possible.