Re: [PATCH v4 00/18] KVM: arm64: Confine protected VM vCPU state to EL2

[Fuad Tabba]

Hi Marc,

On Fri, 02 Oct 2026 16:55:26 +0100, Marc Zyngier <maz@xxxxxxxxxx> wrote:

[...]

> Given how busy this merge window is, there were plenty of conflicts, most
> of them with your own patches. Please have a look at the way I resolved
> them and let me know if anything is on the bogus side of wrong...

Thanks for taking these, and for sorting out the conflicts. Most of the
resolution matches mine, but two things in the pkvm-state merge are off:

- In __kvm_vcpu_run(), the !host_vcpu and SVCR bail-outs still return
  -EINVAL. Patch 10 changed them to ARM_EXCEPTION_IL, since the host
  reads bit 31 of -EINVAL as a pending SError.

- In __kvm_adjust_pc(), the pin path uses kern_hyp_va() on the __kern
  pointer, which sparse flags. It needs kern_hyp_va_host().

The diff below fixes both. It also drops the set_bit()s in
pkvm_init_features_from_host() that kvm_pkvm_vcpu_allowed_features()
already does, and realigns the esr_dabt_is_cm() line. Could you fold it
into the merge resolution?

With it applied on next, I booted protected and non-protected guests,
ran CPU hotplug in both, and ran the pKVM selftest (from my tree), all
passing.

diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index c709a6ff7448b..1018c36ec39d1 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -244,7 +244,7 @@ static void handle_pvm_entry_dabt(struct pkvm_hyp_vcpu *hyp_vcpu)
 
 	/* Handle PC increment on MMIO, or on a CMO the host skipped */
 	pc_update = vcpu_get_flag(host_vcpu, INCREMENT_PC) &&
-		(vcpu->mmio_needed || esr_dabt_is_cm(kvm_vcpu_get_esr(vcpu)));
+		    (vcpu->mmio_needed || esr_dabt_is_cm(kvm_vcpu_get_esr(vcpu)));
 	if (pc_update) {
 		vcpu_clear_flag(vcpu, PC_UPDATE_REQ);
 		kvm_incr_pc(vcpu);
@@ -914,7 +914,7 @@ DEFINE_KVM_HOST_HCALL(int, __kvm_vcpu_run, struct kvm_vcpu __kern *, vcpu)
 
 	host_vcpu = __get_host_hyp_vcpus(kern_hyp_va_host(vcpu), &hyp_vcpu);
 	if (!host_vcpu)
-		return -EINVAL;
+		return ret;
 
 	if (unlikely(hyp_vcpu)) {
 		/*
@@ -924,7 +924,7 @@ DEFINE_KVM_HOST_HCALL(int, __kvm_vcpu_run, struct kvm_vcpu __kern *, vcpu)
 		 * is misbehaving.
 		 */
 		if (unlikely(system_supports_sme() && read_sysreg_s(SYS_SVCR)))
-			return -EINVAL;
+			return ret;
 
 		/*
 		 * ON has a single writer, pkvm_reset_vcpu() on this CPU, so
@@ -1122,7 +1122,7 @@ DEFINE_KVM_HOST_HCALL(void, __kvm_adjust_pc,
 	 * for memory the host isn't sharing, a bad pointer, so the request
 	 * is dropped.
 	 */
-	host_vcpu = kern_hyp_va(vcpu);
+	host_vcpu = kern_hyp_va_host(vcpu);
 	if (hyp_pin_shared_mem(host_vcpu, host_vcpu + 1))
 		return;
 
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index 03dbe1bf9fa90..f88ad9dc91191 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -413,20 +413,6 @@ static void pkvm_init_features_from_host(struct pkvm_hyp_vm *hyp_vm, const struc
 
 	kvm_pkvm_vcpu_allowed_features(kvm, allowed_features);
 
-	set_bit(KVM_ARM_VCPU_PSCI_0_2, allowed_features);
-
-	if (kvm_pkvm_ext_allowed(kvm, KVM_CAP_ARM_PMU_V3))
-		set_bit(KVM_ARM_VCPU_PMU_V3, allowed_features);
-
-	if (kvm_pkvm_ext_allowed(kvm, KVM_CAP_ARM_PTRAUTH_ADDRESS))
-		set_bit(KVM_ARM_VCPU_PTRAUTH_ADDRESS, allowed_features);
-
-	if (kvm_pkvm_ext_allowed(kvm, KVM_CAP_ARM_PTRAUTH_GENERIC))
-		set_bit(KVM_ARM_VCPU_PTRAUTH_GENERIC, allowed_features);
-
-	if (kvm_pkvm_ext_allowed(kvm, KVM_CAP_ARM_SVE))
-		set_bit(KVM_ARM_VCPU_SVE, allowed_features);
-
 	bitmap_and(kvm->arch.vcpu_features, host_kvm->arch.vcpu_features,
 		   allowed_features, KVM_VCPU_MAX_FEATURES);
 out:

Cheers,
/fuad