Re: [PATCH 2/2] KVM: arm64: Enable S1PIE for nVHE and hVHE

[Will Deacon]

On Fri, Sep 04, 2026 at 11:33:24AM +0100, Mark Brown wrote:
> On Fri, Sep 04, 2026 at 08:25:58AM +0100, Marc Zyngier wrote:
> > Mark Brown <broonie@xxxxxxxxxx> wrote:
> 
> > > When FEAT_S1PIE (stage 1 permission indirection) is supported we
> > > currently enable and use it in the hypervisor when running in VHE mode
> > > but not when running in nVHE or hVHE mode.  While systems with
> > > FEAT_S1PIE would normally use VHE users can configure them for nVHE or
> > > hVHE, for example in order to run protected guests.  Enable FEAT_S1PIE
> > > with nVHE and hVHE.
> 
> > No. nVHE is dead, and I'm not adding support for random stuff that
> > appeared over 10 years after v8.0. If you have S1PIE, you have VHE.
> 
> > If you force the kernel to run with E2H==0, that's your own problem.
> 
> What about pKVM, my understanding was that that is very much an ongoing
> concern and uses the nVHE hypervisor?  My expectation was that this
> would only ever get used in hVHE configurations when people enable pKVM
> on modern hardware, actual nVHE mode was mostly just carried along with
> that.

pKVM uses hVHE wherever it can nowadays, so I'm fine with only supporting
S1PIE on hVHE and VHE configurations if that's easier to maintain. We
just need to make sure that the failure mode for nVHE results in the
feature being gracefully disabled, rather than e.g. crashing or quietly
doing the wrong thing.

Will