Re: [PATCH v15 12/37] KVM: arm64: CCA: Support the VGIC in realms

[Kohei Enju]

On 07/22 10:27, Marc Zyngier wrote:
> On Wed, 22 Jul 2026 09:27:29 +0100,
> Kohei Enju <enju.kohei@xxxxxxxxxxx> wrote:
> > 
> > On 07/15 15:28, Steven Price wrote:
> > > The RMM provides emulation of a VGIC to the realm guest. With RMM v2.0
> > > the registers are passed in the system registers so this works similar
> > > to a normal guest, but kvm_arch_vcpu_put() need reordering to early out,
> > > and realm guests don't support GICv2 even if the host does.
> > > 
> > > Signed-off-by: Steven Price <steven.price@xxxxxxx>
> > 
> > Hi Steven,
> > 
> > I've been testing this series and found that when the host CPU doesn't have
> > ARM64_HAS_ICH_HCR_EL2_TDIR this series doesn't work as expected.
> 
> What modern CPU doesn't support TDIR? The only CPUs I know of that are
> stuck in this mode are old ARMv8.0 CPUs, and anything else was fixed.

Hi Marc, thank you for the response.

I'm afraid I can't share the details due to my company's policy, but at
least I happen to be testing on such a system.

> 
> > 
> > Since commit 2a28810cbb8b ("KVM: arm64: GICv3: Detect and work around the lack
> > of ICV_DIR_EL1 trapping"), when the host CPU doesn't support this feature, KVM
> > traps all GIC sysreg accesses in the common group. However, currently trap
> > handlers for ICC_{PMR,RPR,CTLR}_EL1 registers are missing [0]. So when Realm
> > guests try to access those registers, KVM traps them but just emits the warning
> > shown in [1], and Realm guests fail to boot.
> 
> This isn't missing. This is handled by the early emulation in
> vgic-v3-sr.c, which of course CCA completely bypasses. Too bad.

That makes sense.

> 
> > 
> > As far as I can tell, the CCA requirements don't require the
> > ARM64_HAS_ICH_HCR_EL2_TDIR feature. If that's the case, this seems to be a
> > problem. Is there any workaround for this issue, or should we implement trap
> > handlers for those registers?
> 
> No. Either you support TDIR, like any modern CPU, or you don't run
> CCA. I'm not adding yet another level of emulation for this.

However, I'm still not aware of any requirement in the CCA architecture,
or in Armv8-A/Armv9-A, that mandates TDIR support.

When you say "you don't run CCA", is that because the architecture
requires it, or because that's the current KVM policy? If it's the
latter, we'd be interested in adding the required emulation to make it
work.

Thanks,
Kohei

> 
> Thanks,
> 
> 	M.
> 
> -- 
> Without deviation from the norm, progress is not possible.
>