[PATCH v23 14/14] KVM: arm64: Prevent unsupported vcpu features for VM types

[Marc Zyngier]

On Wed, 07 Oct 2026 15:19:53 +0100,
Fuad Tabba <tabba at google.com> wrote:
> 
> Hi Suzuki,
> 
> On Wed, 07 Oct 2026 08:35:37 +0100, Suzuki K Poulose
> <suzuki.poulose at arm.com> wrote:
> [...]
> > diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> > index 4d0e6bd2009ac..97089c81d6428 100644
> > --- a/arch/arm64/include/asm/kvm_host.h
> > +++ b/arch/arm64/include/asm/kvm_host.h
> > @@ -42,6 +42,13 @@
> >  #define KVM_VCPU_MAX_FEATURES 10
> >  #define KVM_VCPU_VALID_FEATURES        (BIT(KVM_VCPU_MAX_FEATURES) - 1)
> >
> > +/* As dictated by kvm_pkvm_ext_allowed() */
> > +#define KVM_PROTECTED_VCPU_VALID_FEATURES              \
> > +       (BIT(KVM_ARM_VCPU_POWER_OFF)            |       \
> > +        BIT(KVM_ARM_VCPU_PSCI_0_2)             |       \
> > +        BIT(KVM_ARM_VCPU_PTRAUTH_ADDRESS)      |       \
> > +        BIT(KVM_ARM_VCPU_PTRAUTH_GENERIC))
> 
> kvmarm/next already restricts protected VM features through
> kvm_pkvm_vcpu_allowed_features(), shared with EL2 (0b7d843ef3bf).
> Could you rebase on that and drop the protected half of this patch,
> rather than add a second list?

A rebase would be a terrible idea. This thing *must* go on its own
branch, and not depend on anything else.

I can however fix things at merge time. is something like this what
you had in mind? It compiles, and is therefore perfect...

	M.

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 300ffc2e31c7d..1c6632216e327 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -45,13 +45,6 @@
 #define KVM_VCPU_MAX_FEATURES 10
 #define KVM_VCPU_VALID_FEATURES	(BIT(KVM_VCPU_MAX_FEATURES) - 1)
 
-/* As dictated by kvm_pkvm_ext_allowed() */
-#define KVM_PROTECTED_VCPU_VALID_FEATURES		\
-	(BIT(KVM_ARM_VCPU_POWER_OFF)		|	\
-	 BIT(KVM_ARM_VCPU_PSCI_0_2)		|	\
-	 BIT(KVM_ARM_VCPU_PTRAUTH_ADDRESS)	|	\
-	 BIT(KVM_ARM_VCPU_PTRAUTH_GENERIC))
-
 #define KVM_REQ_SLEEP \
 	KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
 #define KVM_REQ_IRQ_PENDING		KVM_ARCH_REQ(1)
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 3ae8f51ce948a..a0e7f1d2d1575 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1706,12 +1706,10 @@ int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kvm_irq_level *irq_level,
 
 static unsigned long system_supported_vcpu_features(struct kvm_vcpu *vcpu)
 {
-	unsigned long features;
+	unsigned long features = KVM_VCPU_VALID_FEATURES;
 
 	if (vcpu->kvm->arch.vm_flavor == VM_PROTECTED_PKVM)
-		features = KVM_PROTECTED_VCPU_VALID_FEATURES;
-	else
-		features = KVM_VCPU_VALID_FEATURES;
+		kvm_pkvm_vcpu_allowed_features(vcpu->kvm, &features);
 
 	if (!cpus_have_final_cap(ARM64_HAS_32BIT_EL1))
 		clear_bit(KVM_ARM_VCPU_EL1_32BIT, &features);
@@ -1753,19 +1751,6 @@ static int kvm_vcpu_init_check_features(struct kvm_vcpu *vcpu,
 	if (features & ~system_supported_vcpu_features(vcpu))
 		return -EINVAL;
 
-	/* Reject features EL2 would drop when it creates the hyp VM. */
-	if (vcpu_is_protected(vcpu)) {
-		DECLARE_BITMAP(allowed, KVM_VCPU_MAX_FEATURES);
-
-		kvm_pkvm_vcpu_allowed_features(vcpu->kvm, allowed);
-		if (!bitmap_subset(&features, allowed, KVM_VCPU_MAX_FEATURES))
-			return -EINVAL;
-
-		/* EL2 implements PSCI 1.1; the host must not dispatch as 0.1. */
-		if (!test_bit(KVM_ARM_VCPU_PSCI_0_2, &features))
-			return -EINVAL;
-	}
-
 	/*
 	 * For now make sure that both address/generic pointer authentication
 	 * features are requested by the userspace together.

-- 
Without deviation from the norm, progress is not possible.