Re: [PATCH v16 17/45] KVM: arm64: CCA: Tear down RTTs
From: Suzuki K Poulose <suzuki.poulose@arm.com>
Date: 2026-08-04 12:16:08
Also in:
kvm, kvmarm, linux-coco, lkml
Hi there On 03/08/2026 23:29, Alper Gun wrote:
On Mon, Aug 3, 2026 at 6:45 AM Steven Price [off-list ref] wrote:quoted
[...] +static void realm_unmap_stage2(struct kvm *kvm) +{ + struct realm *realm = &kvm->arch.realm; + + lockdep_assert_held(&kvm->arch.config_lock); + + if (realm->stage2_unmapped) + return; + + write_lock(&kvm->mmu_lock); + kvm_stage2_unmap_range(&kvm->arch.mmu, 0, + BIT(realm->ia_bits - 1), true); + write_unlock(&kvm->mmu_lock); + + realm->stage2_unmapped = true; +} + +int kvm_realm_teardown_stage2(struct kvm *kvm) +{ + lockdep_assert_held(&kvm->arch.config_lock); + + realm_unmap_stage2(kvm); + return realm_destroy_rtts(kvm); +}Hi Steven, I noticed a warning in dmesg when destroying a realm: [ 158.533495] Call trace: [ 158.535927] kvm_destroy_realm+0x208/0x218 [ 158.540356] kvm_arch_destroy_vm+0xc8/0xd8 [ 158.544439] kvm_put_kvm+0x324/0x4b0 [ 158.548002] kvm_vm_stats_release+0x1c/0x38
Thanks for the report and the detailed analysis.
quoted hunk ↗ jump to hunk
I traced this and found the following: At this point, calling realm_destroy_rtts() may fail destroying the RTTs because RECs are still active and the Realm is not terminated, but the walk finishes and still sets realm->rtts_destroyed = true. Later, kvm_destroy_realm() calls rmi_realm_terminate() and then calls realm_destroy_rtts(kvm) again. But because realm->rtts_destroyed is already set to true, it exits early without tearing down the RTTs. Consequently, rmi_realm_destroy() is invoked while the RTT tables still exist in RMM, which fails and triggers WARN_ON(rmi_realm_destroy). The fix I used was to remove realm_destroy_rtts() from kvm_realm_teardown_stage2():--- a/arch/arm64/kvm/rmi.c +++ b/arch/arm64/kvm/rmi.c@@ -434,7 +434,7 @@ int kvm_realm_teardown_stage2(struct kvm *kvm) lockdep_assert_held(&kvm->arch.config_lock); realm_unmap_stage2(kvm); - return realm_destroy_rtts(kvm); + return 0; }I think we don't need RTT destruction here as it will be handled cleanly in kvm_destroy_realm() later.
That sounds sensible to me, I will take a look and fix it locally for the next version. Thanks Suzuki
Thanks, Alper