[PATCH v20 05/22] KVM: arm64: Track the type of VM in kvm_arch
From: Suzuki K Poulose
Date: Thu Sep 24 2026 - 12:15:06 EST
KVM arm64 has different types of VMs with all the different modes in which
the hypervisor code can be run. e.g., VHE, nVHE, pKVM etc. Then there is
protected VM and normal VMs with pKVM. We might soon add other types,
e.g., Arm CCA Realm. So in an effort to make the handling of these
different types of VMs a bit more friendly to the eyes, add a VM flavor to
the kvm_arch and we could then add handlers for different operations based
on the VM type.
Keep the flavor initialisation at the beginning to allow for the detection
early enough and fail out on any unsupported requests.
With that, add wrappers for checking the "type" of a VM and replace the
existing users with the new wrappers.
Given we already have the construct of "kvm_vm_is_protected" in the core
KVM code, use that for all confidential compute guests including Realms
that we are about to add. Adds __VM_PROTECTED marker vm flavor to draw the
boundary for "protected VMs". In later patches, we would add Realm VMs,
which would also be classified as protected.
Add a explicit helper to detect if a given VM is a "protected" VM under pKVM.
Change the existing users that precisely want to check the VM type. These
include :
- kvm_arch_prepare_memory_region - For preventing memslot changes after
pVM creation.
All the others are retained as a wider check for confidential guest VMs.
These are:
- kvm_vm_ioctl_set_counter_offset - For disallowing timer offset
configuration
- io_mem_abort for dabt handling without valid syndrome information
Both of which are true for Realms too.
Realms support is restricted to VHE host and thus "kvm_vm_is_protected()"
checks in the pkvm hyp specific code doesn't need to change, as the only
protected guests it deals with is "protected pKVM" guests. To tighten this
init_pkvm_hyp_vm() restricts the hyp copy of the vm_flavor to the ones it
supports.
vcpu_is_protected() usage from nVHE hyp code is tricky, as we need to
convert the vcpu->kvm to the HYP VA before checking the flavor. This
involves kern_hyp_va() usage in asm/kvm_host.h. To avoid build breaks,
include asm/kvm_mmu.h to arm64/kvm/mmio.c.
Suggested-by: Marc Zyngier <maz@xxxxxxxxxx>
Tested-by: Gavin Shan <gshan@xxxxxxxxxx>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@xxxxxxx>
---
Changes since v19:
- Fix vcpu_is_protected for nvhe hyp by using the kern_hyp_va() for
vcpu->kvm - Gavin
- Use READ_ONCE() to read the vm_flavor in EL2 pKVM code
- Drop ',' after the end marker in vm_flavor enums
- Replace !kvm_vm_is_protected() in kvm_arch_vcpu_put() with
kvm_vm_is_unprotected_pkvm()
Changes since v18:
- Merge the __VM_PROTECTED marker and the widening of kvm_vm_is_protected()
to this patch.
- Merge the use of kvm_vm_is_unprotected_pkvm() for !kvm_vm_is_protected()
given the scope changes here.
- Drop Fuad's review tag, as this patch has multiple merges
- Restrict the VM flavors to the supported types in init_pkvm_hyp_vm().
- Drop kvm_vm_hyp_is_pkvm() and revert to is_protected_kvm_enabled()
- Use is_protected_kvm_enabled() to make the pKVM guest flavor checks.
- s/PKVM/pKVM for commit descriptions too
Changes since v17:
* s/PKVM/pKVM for the comments
* Drop type argument for pkvm_init_host_vm and also drop protected variable.
* Add helpers for checking if the VM is running on pKVM (kvm_vm_hyp_is_pkvm())
* Use kvm_vm_hyp_is_pkvm() to replace is_protected_kvm_enabled() with valid
kvm instance
---
arch/arm64/include/asm/kvm_host.h | 51 +++++++++++++++++++++++++++++--
arch/arm64/include/asm/kvm_pkvm.h | 4 +--
arch/arm64/kvm/arm.c | 33 ++++++++++++++++----
arch/arm64/kvm/handle_exit.c | 2 +-
arch/arm64/kvm/hyp/nvhe/pkvm.c | 6 +++-
arch/arm64/kvm/mmio.c | 1 +
arch/arm64/kvm/mmu.c | 2 +-
arch/arm64/kvm/pkvm.c | 6 ++--
8 files changed, 87 insertions(+), 18 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 286489a69dff5..63bd1f76edb7b 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -257,7 +257,6 @@ struct kvm_protected_vm {
pkvm_handle_t handle;
struct kvm_hyp_memcache teardown_mc;
struct kvm_hyp_memcache stage2_teardown_mc;
- bool is_protected;
bool is_created;
/*
@@ -306,9 +305,19 @@ enum fgt_group_id {
__NR_FGT_GROUP_IDS__
};
+enum kvm_arm_vm_flavor {
+ VM_NVHE,
+ VM_VHE,
+ VM_PKVM, /* Normal guests on pKVM */
+ MARKER(__VM_PROTECTED),
+ VM_PROTECTED_PKVM, /* Protected VM */
+ VM_FLAVOR_MAX
+};
+
struct kvm_arch {
struct kvm_s2_mmu mmu;
+ enum kvm_arm_vm_flavor vm_flavor;
/*
* Fine-Grained UNDEF, mimicking the FGT layout defined by the
* architecture. We track them globally, as we present the
@@ -1504,9 +1513,45 @@ struct kvm *kvm_arch_alloc_vm(void);
#define __KVM_HAVE_ARCH_FLUSH_REMOTE_TLBS_RANGE
-#define kvm_vm_is_protected(kvm) (is_protected_kvm_enabled() && (kvm)->arch.pkvm.is_protected)
+#define kvm_vm_is_protected(kvm) ((kvm)->arch.vm_flavor >= __VM_PROTECTED)
+/*
+ * Accessing vcpu->kvm from nVHE hyp stub is tricky, as we need to convert the
+ * pointer to the hyp VA. With pKVM, the nVHE code runs with the hyp_vcpu,
+ * which is populated correctly.
+ */
+#define vcpu_is_protected(vcpu) \
+ ({ \
+ struct kvm *__kvm = READ_ONCE((vcpu)->kvm); \
+ bool __protected = false; \
+ \
+ if (__kvm) { \
+ if (is_nvhe_hyp_code() && \
+ !is_protected_kvm_enabled()) \
+ __kvm = kern_hyp_va(__kvm); \
+ \
+ __protected = kvm_vm_is_protected(__kvm); \
+ } \
+ __protected; \
+ })
+
+#define kvm_vm_is_protected_pkvm(kvm) \
+ (is_protected_kvm_enabled() && ((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM))
+
+/*
+ * Rely on is_protected_kvm_enabled() check in kvm_vm_is_protected_pkvm() to
+ * make sure the vcpu->kvm is always valid VA in the context
+ */
+#define vcpu_is_protected_pkvm(vcpu) \
+ ({ \
+ struct kvm *__kvm = READ_ONCE((vcpu)->kvm); \
+ \
+ (__kvm && kvm_vm_is_protected_pkvm(__kvm)); \
+ })
+
+
+#define kvm_vm_is_unprotected_pkvm(kvm) \
+ (is_protected_kvm_enabled() && ((kvm)->arch.vm_flavor == VM_PKVM))
-#define vcpu_is_protected(vcpu) kvm_vm_is_protected((vcpu)->kvm)
int kvm_arm_vcpu_finalize(struct kvm_vcpu *vcpu, int feature);
bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu);
diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h
index 54a618d887fa4..e4ea80711bec6 100644
--- a/arch/arm64/include/asm/kvm_pkvm.h
+++ b/arch/arm64/include/asm/kvm_pkvm.h
@@ -17,7 +17,7 @@
#define HYP_MEMBLOCK_REGIONS 128
-int pkvm_init_host_vm(struct kvm *kvm, unsigned long type);
+int pkvm_init_host_vm(struct kvm *kvm);
int pkvm_create_hyp_vm(struct kvm *kvm);
bool pkvm_hyp_vm_is_created(struct kvm *kvm);
void pkvm_destroy_hyp_vm(struct kvm *kvm);
@@ -49,7 +49,7 @@ static inline bool kvm_pkvm_ext_allowed(struct kvm *kvm, long ext)
case KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES:
return false;
default:
- return !kvm || !kvm_vm_is_protected(kvm);
+ return !kvm || kvm_vm_is_unprotected_pkvm(kvm);
}
}
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index db36815630790..90547fbbc8ad7 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -214,6 +214,26 @@ static int kvm_arm_default_max_vcpus(void)
return vgic_present ? kvm_vgic_get_max_vcpus() : KVM_MAX_VCPUS;
}
+static int kvm_init_vm_flavor(struct kvm *kvm, unsigned long type)
+{
+ bool protected = type & KVM_VM_TYPE_ARM_PROTECTED;
+
+ if (is_protected_kvm_enabled()) {
+ if (protected)
+ kvm->arch.vm_flavor = VM_PROTECTED_PKVM;
+ else
+ kvm->arch.vm_flavor = VM_PKVM;
+ } else if (protected) {
+ return -EINVAL;
+ } else if (has_vhe()) {
+ kvm->arch.vm_flavor = VM_VHE;
+ } else {
+ kvm->arch.vm_flavor = VM_NVHE;
+ }
+
+ return 0;
+}
+
/**
* kvm_arch_init_vm - initializes a VM data structure
* @kvm: pointer to the KVM struct
@@ -236,6 +256,10 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
mutex_unlock(&kvm->lock);
#endif
+ ret = kvm_init_vm_flavor(kvm, type);
+ if (ret)
+ return ret;
+
kvm_init_nested(kvm);
ret = kvm_share_hyp(kvm, kvm + 1);
@@ -257,12 +281,9 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
* If any failures occur after this is successful, make sure to
* call __pkvm_unreserve_vm to unreserve the VM in hyp.
*/
- ret = pkvm_init_host_vm(kvm, type);
+ ret = pkvm_init_host_vm(kvm);
if (ret)
goto err_uninit_mmu;
- } else if (type & KVM_VM_TYPE_ARM_PROTECTED) {
- ret = -EINVAL;
- goto err_uninit_mmu;
}
kvm_vgic_early_init(kvm);
@@ -751,7 +772,7 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
kvm_call_hyp_nvhe(__pkvm_vcpu_put);
/* __pkvm_vcpu_put implies a sync of the state */
- if (!kvm_vm_is_protected(vcpu->kvm))
+ if (kvm_vm_is_unprotected_pkvm(vcpu->kvm))
vcpu_set_flag(vcpu, PKVM_HOST_STATE_DIRTY);
}
@@ -985,7 +1006,7 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu)
if (is_protected_kvm_enabled()) {
/* Start with the vcpu in a dirty state */
- if (!kvm_vm_is_protected(vcpu->kvm))
+ if (kvm_vm_is_unprotected_pkvm(vcpu->kvm))
vcpu_set_flag(vcpu, PKVM_HOST_STATE_DIRTY);
ret = pkvm_create_hyp_vm(kvm);
if (ret)
diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
index db37678dcb05c..384c5d258c7f8 100644
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -490,7 +490,7 @@ static void handle_exit_pkvm_state(struct kvm_vcpu *vcpu, int exception_index)
{
int exception_code = ARM_EXCEPTION_CODE(exception_index);
- if (!is_protected_kvm_enabled() || kvm_vm_is_protected(vcpu->kvm))
+ if (!kvm_vm_is_unprotected_pkvm(vcpu->kvm))
return;
/*
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index 459bd9eb7e4bc..ed51762aa4b5d 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -432,7 +432,11 @@ static void init_pkvm_hyp_vm(struct kvm *host_kvm, struct pkvm_hyp_vm *hyp_vm,
hyp_vm->host_kvm = host_kvm;
hyp_vm->kvm.created_vcpus = nr_vcpus;
- hyp_vm->kvm.arch.pkvm.is_protected = READ_ONCE(host_kvm->arch.pkvm.is_protected);
+ if (READ_ONCE(host_kvm->arch.vm_flavor) == VM_PROTECTED_PKVM)
+ hyp_vm->kvm.arch.vm_flavor = VM_PROTECTED_PKVM;
+ else
+ hyp_vm->kvm.arch.vm_flavor = VM_PKVM;
+
hyp_vm->kvm.arch.flags = 0;
pkvm_init_features_from_host(hyp_vm, host_kvm);
diff --git a/arch/arm64/kvm/mmio.c b/arch/arm64/kvm/mmio.c
index d1c3a352d5a22..ab1d2fef9a522 100644
--- a/arch/arm64/kvm/mmio.c
+++ b/arch/arm64/kvm/mmio.c
@@ -6,6 +6,7 @@
#include <linux/kvm_host.h>
#include <asm/kvm_emulate.h>
+#include <asm/kvm_mmu.h>
#include <trace/events/kvm.h>
#include "trace.h"
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 9ba86450fe4af..0f4e8b71fa85d 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -2624,7 +2624,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
hva_t hva, reg_end;
int ret = 0;
- if (kvm_vm_is_protected(kvm)) {
+ if (kvm_vm_is_protected_pkvm(kvm)) {
/* Cannot modify memslots once a pVM has run. */
if (pkvm_hyp_vm_is_created(kvm) &&
(change == KVM_MR_DELETE || change == KVM_MR_MOVE)) {
diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
index 8e4c6e4bec123..8e9176a700926 100644
--- a/arch/arm64/kvm/pkvm.c
+++ b/arch/arm64/kvm/pkvm.c
@@ -229,10 +229,9 @@ void pkvm_destroy_hyp_vm(struct kvm *kvm)
mutex_unlock(&kvm->arch.config_lock);
}
-int pkvm_init_host_vm(struct kvm *kvm, unsigned long type)
+int pkvm_init_host_vm(struct kvm *kvm)
{
int ret;
- bool protected = type & KVM_VM_TYPE_ARM_PROTECTED;
/* Reserve the VM in hyp and obtain a hyp handle for the VM. */
ret = kvm_call_hyp_nvhe(__pkvm_reserve_vm);
@@ -240,8 +239,7 @@ int pkvm_init_host_vm(struct kvm *kvm, unsigned long type)
return ret;
kvm->arch.pkvm.handle = ret;
- kvm->arch.pkvm.is_protected = protected;
- if (protected) {
+ if (kvm_vm_is_protected(kvm)) {
pr_warn_once("kvm: protected VMs are experimental and for development only, tainting kernel\n");
add_taint(TAINT_USER, LOCKDEP_STILL_OK);
}
--
2.43.0