[PATCH v3 11/36] KVM: arm64: Introduce __pkvm_host_donate_guest()

[Will Deacon]

Hi Marc,

Thanks for going through all of this!

On Fri, Mar 20, 2026 at 12:38:07PM +0000, Marc Zyngier wrote:
> On Thu, 05 Mar 2026 14:43:24 +0000,
> Will Deacon <will at kernel.org> wrote:
> > 
> > In preparation for supporting protected VMs, whose memory pages are
> > isolated from the host, introduce a new pKVM hypercall to allow the
> > donation of pages to a guest.
> > 
> > Signed-off-by: Will Deacon <will at kernel.org>
> > ---
> >  arch/arm64/include/asm/kvm_asm.h              |  1 +
> >  arch/arm64/include/asm/kvm_pgtable.h          |  2 +-
> >  arch/arm64/kvm/hyp/include/nvhe/mem_protect.h |  2 ++
> >  arch/arm64/kvm/hyp/nvhe/hyp-main.c            | 21 +++++++++++++
> >  arch/arm64/kvm/hyp/nvhe/mem_protect.c         | 30 +++++++++++++++++++
> >  5 files changed, 55 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
> > index df6b661701b6..dfc6625c8269 100644
> > --- a/arch/arm64/include/asm/kvm_asm.h
> > +++ b/arch/arm64/include/asm/kvm_asm.h
> > @@ -79,6 +79,7 @@ enum __kvm_host_smccc_func {
> >  	/* Hypercalls that are available only when pKVM has finalised. */
> >  	__KVM_HOST_SMCCC_FUNC___pkvm_host_share_hyp,
> >  	__KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_hyp,
> > +	__KVM_HOST_SMCCC_FUNC___pkvm_host_donate_guest,
> >  	__KVM_HOST_SMCCC_FUNC___pkvm_host_share_guest,
> >  	__KVM_HOST_SMCCC_FUNC___pkvm_host_unshare_guest,
> >  	__KVM_HOST_SMCCC_FUNC___pkvm_host_relax_perms_guest,
> > diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h
> > index c201168f2857..b6f7595c4979 100644
> > --- a/arch/arm64/include/asm/kvm_pgtable.h
> > +++ b/arch/arm64/include/asm/kvm_pgtable.h
> > @@ -100,7 +100,7 @@ typedef u64 kvm_pte_t;
> >  					 KVM_PTE_LEAF_ATTR_HI_S2_XN)
> >  
> >  #define KVM_INVALID_PTE_OWNER_MASK	GENMASK(9, 2)
> > -#define KVM_MAX_OWNER_ID		1
> > +#define KVM_MAX_OWNER_ID		3
> >  
> >  /*
> >   * Used to indicate a pte for which a 'break-before-make' sequence is in
> > diff --git a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h
> > index 5f9d56754e39..9c0cc53d1dc9 100644
> > --- a/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h
> > +++ b/arch/arm64/kvm/hyp/include/nvhe/mem_protect.h
> > @@ -28,6 +28,7 @@ enum pkvm_component_id {
> >  	PKVM_ID_HOST,
> >  	PKVM_ID_HYP,
> >  	PKVM_ID_FFA,
> > +	PKVM_ID_GUEST,
> 
> Is KVM_MAX_OWNER_ID being set to 3 related to PKVM_ID_GUEST being
> introduced?

Yes. At this point, kvm_pgtable_stage2_set_owner() rejects an 'owner_id'
parameter that is '> KVM_MAX_OWNER_ID', so we bump the value so that
PKVM_ID_GUEST isn't rejected outright.

> If so, wouldn't it be better to define one in terms of the other?

I can rework the existing #define if you like, but it actually gets
removed entirely later in the series by "KVM: arm64: Generalise
kvm_pgtable_stage2_set_owner()", so it's less churn just to leave it
in place before nuking it.

> Also, this includes PKVM_ID_FFA as a valid ID, while it wasn't
> included until now. Is that expected?

Huh, so it turns out that this doesn't actually matter, as PKVM_ID_FFA
has been unused since 7cbf7c37718e ("KVM: arm64: Drop pkvm_mem_transition
for host/hyp sharing")! I'll just add a patch to the start of the series
which removes it altogether.

Will