Re: [PATCH v3 15/18] KVM: arm64: Reject host access to protected VM private state

[Fuad Tabba]

Hi Marc,

On Thu, 17 Sept 2026 at 09:06, Marc Zyngier <maz@xxxxxxxxxx> wrote:
[...]
> News flash, this is not x86, nor s390. I don't feel constrained by
> other architecture, and we deviate *everywhere* already.

Not x86 nor s390: and I'm grateful for that every day :P

[...]
> A protected-aware VMM already knows it cannot obtain the registers.
>
> I don't want to have to revisit the userspace interface once you have
> to relax it, because I know for sure that you will have to.

What the error buys is that a read outside what EL2 copies out fails
rather than returning the copy, which is what a register dump would
otherwise print. But then how would the VMM know, once EL2 starts
copying more out on an exit it already gets, that those registers are
now the guest's? A cap is all I can think of, but I may well be
missing something. With the error, the relaxation is a window on that
exit for the registers EL2 copies out, and a read that succeeds there
returns something EL2 copied out.

> As far as LD64B is concerned, there is no place to copy anything in
> the run structure, and the relaxation would require to cover all the
> GPRs, ESR, and FAR. At this stage, returning whatever is there is the
> correct thing to do IMO.

For a protected VM the operands would go through fixed registers, the
way x0 carries the MMIO data today, so the window on that exit is
those registers rather than all the GPRs.

Hoping this one doesn't return -EPERM :)

Cheers,
/fuad