[PATCH v21 05/23] KVM: arm64: Track the type of VM in kvm_arch

[Marc Zyngier]

On Fri, 02 Oct 2026 16:15:07 +0100,
Suzuki K Poulose <suzuki.poulose at arm.com> wrote:
> 
> > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > index 0f4e8b71fa85d..9ba86450fe4af 100644
> > --- a/arch/arm64/kvm/mmu.c
> > +++ b/arch/arm64/kvm/mmu.c
> > @@ -2624,7 +2624,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
> >   	hva_t hva, reg_end;
> >   	int ret = 0;
> >   -	if (kvm_vm_is_protected_pkvm(kvm)) {
> > +	if (kvm_vm_is_protected(kvm)) {
> 
> We have slightly different handling for Realms. The final code for this
> looks like :
> 
> 	if (kvm_vm_is_protected(kvm)) {
> 		if (new &&
> 		    new->flags & (KVM_MEM_LOG_DIRTY_PAGES | KVM_MEM_READONLY)) {
> 			return -EPERM;
> 		}
> 	}
> 
> 	if (kvm_vm_is_protected_pkvm(kvm)) {
> 		/* Cannot modify memslots once a pVM has run. */
> 		if (pkvm_hyp_vm_is_created(kvm) &&
> 		    (change == KVM_MR_DELETE || change == KVM_MR_MOVE)) {
> 			return -EPERM;
> 		}
> 	} else if (kvm_realm_is_created(kvm)) {
> 		/*
> 		 * Once the Realm is created, we cannot modify any slots that
> 		 * could be providing private memory. i.e., guest_memfd backed
> 		 * slots.
> 		 * TODO: Handle trusted device private memory slots
> 		 */
> 		if (kvm_slot_has_gmem(old) || kvm_slot_has_gmem(new))
> 			return -EPERM;
> 	}
> 
> 
> Of course we could invert the checks to detect vm_is_protected_pkvm()

This is how I expect this stuff to be written.

	if (kvm_vm_is_protected(kvm) && new &&
	    new->flags & (KVM_MEM_LOG_DIRTY_PAGES | KVM_MEM_READONLY))
		return -EPERM;

	switch (kvm->vm_flavor) {
	case VM_PROTECTED_PKVM:
		/* Cannot modify memslots once a pVM has run. */
		if (pkvm_hyp_vm_is_created(kvm) &&
		    (change == KVM_MR_DELETE || change == KVM_MR_MOVE)) {
			return -EPERM;
		break;
	case VM_CCA:
		/*
		 * Once the Realm is created, we cannot modify any slots that
		 * could be providing private memory. i.e., guest_memfd backed
		 * slots.
		 * TODO: Handle trusted device private memory slots
		 */
		if (kvm_realm_is_created(kvm) &&
		    (kvm_slot_has_gmem(old) || kvm_slot_has_gmem(new)))
			return -EPERM;
		break;
	default:
		break;
	}

We have an enumeration. Make use of it. And the whole "is_created"
crap needs to be sorted one way or another.

	M.

-- 
Without deviation from the norm, progress is not possible.