Re: [PATCH 3/3] arm64/coco: Add pKVM as a CC platform

[Catalin Marinas]

On Fri, Jun 12, 2026 at 08:37:42PM +0530, Aneesh Kumar K.V wrote:
> Mostafa Saleh <smostafa@xxxxxxxxxx> writes:
> 
> > On Thu, Jun 04, 2026 at 02:29:00PM +0530, Aneesh Kumar K.V wrote:
> >> Mostafa Saleh <smostafa@xxxxxxxxxx> writes:
> >> 
> >> > pKVM does support memory encryption, expose that to the rest of
> >> > the kernel through cc_platform_has()
> >> >
> >> > At the moment, all devices inside the guest are emulated which
> >> > requires its memory to be shared back to the host (decrypted), so
> >> > set force_dma_unencrypted() to always return true.
> >> >
> >> > Although, typically pKVM guests rely on restricted-dma-pools to
> >> > bounce traffic, with this change, it is possible to solely rely on
> >> > the default SWIOTLB for that (assuming the appropriate size is set
> >> > from the command line)
> >> >
> >> > Signed-off-by: Mostafa Saleh <smostafa@xxxxxxxxxx>
> >> > ---
> >> > This change is critical for the ongoing refactoring of the DMA-API[1]
> >> > that will break protected guests under pKVM with this patch. That is
> >> > due to this rework will make the state of the SWIOTLB and restricted
> >> > dma pools depends on the value returned by cc_platform_has()
> >> >
> >> > [1] https://lore.kernel.org/all/20260522042815.370873-1-aneesh.kumar@xxxxxxxxxx/
> >> > ---
> >> >  arch/arm64/include/asm/hypervisor.h           | 13 +++++++++++++
> >> >  arch/arm64/include/asm/mem_encrypt.h          |  3 ++-
> >> >  arch/arm64/kernel/rsi.c                       | 12 ------------
> >> >  arch/arm64/mm/init.c                          | 15 ++++++++++++++-
> >> >  drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c |  3 +++
> >> >  5 files changed, 32 insertions(+), 14 deletions(-)
> >> >
> >> > index d66291def0f4..26fe9c3f22e3 100644
> > [...]
> >> > --- a/drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c
> >> > +++ b/drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c
> >> > @@ -17,6 +17,7 @@
> >> >  #include <asm/hypervisor.h>
> >> >  
> >> >  static size_t pkvm_granule;
> >> > +DEFINE_STATIC_KEY_FALSE_RO(pkvm_guest);
> >> >
> >> 
> >> Do we need EXPORT_SYMBOL on this? 
> >
> > I was not sure about that, all users of this are in tree, I saw RME
> > code have the EXPORT but did not know why?
> >
> 
> arm-cca-guest is one example. I was assuming is_protected_kvm_guest()
> would be a helper that could get pulled into various code paths via
> force_dma_unencrypted().

For now, the only callers of force_dma_unencrypted() I can see are in
kernel/dma/*, so we can skip the exporting.

-- 
Catalin