Re: [PATCH v2 14/17] KVM: arm64: Reject host access to protected VM private state

[Fuad Tabba]

Hi Marc,

On Fri, 11 Sept 2026 at 13:58, Marc Zyngier <maz@xxxxxxxxxx> wrote:
[...]
> Why can't these be moved to the ioctl callback? Something like:
>
[...]
> +static long pkvm_filter_vcpu_ioctl(struct kvm_vcpu *vcpu, unsigned int ioctl)
[...]

Much nicer, I'll move the three has-run checks into that filter for
v3. I think we need the other two where they are, though: the
ext_dabt_pending check reads the payload, and KVM_SET_GUEST_DEBUG has
its own case in kvm_vcpu_ioctl(), so it never gets as far as
kvm_arch_vcpu_ioctl().

> Where is KVM_CAP_ARM_INJECT_EXT_DABT rejected?

In kvm_pkvm_ext_allowed(): on a protected VM it returns false for any
capability it doesn't list, and patch 16 doesn't add this one, so
KVM_CHECK_EXTENSION on the VM fd returns 0 for it (and for
KVM_CAP_SET_GUEST_DEBUG). I'd keep the ioctl check too, for the VMM
that doesn't ask, since userspace has been known to act silly. I'll
say so in the commit message and in pkvm.rst (maybe not the silly
part).

Thanks,
/fuad