Re: [PATCH v18 12/23] KVM: arm64: Widen the scope of "protected" VMs

[Suzuki K Poulose]

On 17/09/2026 12:44, Marc Zyngier wrote:
> On Tue, 15 Sep 2026 17:01:30 +0100,
> Suzuki K Poulose <suzuki.poulose@xxxxxxx> wrote:
> > On arm64 we have "protected" VMs that run on PKVM as a confidential compute
> > guest. Given we already have the construct of "kvm_vm_is_protected" in the core
> > KVM code, use that for all confidential compute guests including Realms that
> > we are about to add.
> >
> > Use the VM flavor to detect the "protected" VMs by introducing a marker.
> > Add explicit helper to detect if a given VM is a "protected" VM under PKVM.
> > Change the existing users that precisely want to check the VM type. These
> > include :
> >    - kvm_arch_prepare_memory_region - For preventing memslot changes after pVM
> >      creation.
> >
> > All the others are retained as a wider check for confidential guest VMs.
> > These are:
> >   - kvm_vm_ioctl_set_counter_offset - For disallowing timer offset configuration
> >   - io_mem_abort for dabt handling without valid syndrome information
> >
> > Both of which are true for Realms too.
> >
> > Realms support is restricted to VHE host and thus "kvm_vm_is_protected()"
> > checks in the pkvm hyp specific code doesn't need to change, as the only
> > protected guests it deals with is "protected PKVM" guests.
> >
> > Signed-off-by: Suzuki K Poulose <suzuki.poulose@xxxxxxx>
> > ---
> >   arch/arm64/include/asm/kvm_host.h | 4 +++-
> >   arch/arm64/kvm/mmu.c              | 2 +-
> >   2 files changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> > index 7ce46d853c47e..1bb43c57fb0f0 100644
> > --- a/arch/arm64/include/asm/kvm_host.h
> > +++ b/arch/arm64/include/asm/kvm_host.h
> > @@ -329,6 +329,7 @@ enum kvm_arm_vm_flavor {
> >   	VM_NVHE,
> >   	VM_VHE,
> >   	VM_PKVM,		/* Normal guests on pKVM */
> > +	MARKER(__VM_PROTECTED),
> >   	VM_PROTECTED_PKVM,	/* Protected VM */
> >   	VM_FLAVOR_MAX,
> >   };
> > @@ -1535,7 +1536,8 @@ struct kvm *kvm_arch_alloc_vm(void);
> >   
> >   #define __KVM_HAVE_ARCH_FLUSH_REMOTE_TLBS_RANGE
> >   
> > -#define kvm_vm_is_protected(kvm)	((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM)
> > +#define kvm_vm_is_protected(kvm)	((kvm)->arch.vm_flavor >= __VM_PROTECTED)
> > +#define kvm_vm_is_protected_pkvm(kvm)	((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM)
> >   #define kvm_vm_is_unprotected_pkvm(kvm)	((kvm)->arch.vm_flavor == VM_PKVM)
>
> This really should be added from where you introduce the enumeration,
> as my original patch did. Otherwise, this is pure churn for no benefit.

Ack, the idea was to introduce this, after converting the existing
code with the new wrappers. I will fold that change here.

Cheers
Suzuki

> Thanks,
>
> 	M.