[PATCH 04/17] KVM: arm64: Introduce per-EC entry handlers for pKVM

[Joey Gouly]

On Mon, Aug 31, 2026 at 05:34:08PM +0100, Fuad Tabba wrote:
> From: Marc Zyngier <maz at kernel.org>
> 
> Add an ESR_EL2.EC-indexed handler table, entry_hyp_vm_handlers[],
> consulted from flush_hyp_vcpu() on re-entry when the previous exit was
> a trap: sync_hyp_vcpu() records the exit reason in the hyp vCPU as
> exit_code, and the trap's exception class comes from its ESR_EL2.
> 
> Entry carries the host's requested PC updates to the hyp vCPU: add
> vcpu_copy_flag() to copy a masked set of flags between the two vCPU
> structures, with PC_UPDATE_REQ covering INCREMENT_PC and the
> pending-exception flags. The wholesale iflags copy moves into the
> non-protected branch; a protected vCPU takes only PC_UPDATE_REQ.
> 
> Signed-off-by: Marc Zyngier <maz at kernel.org>
> Co-developed-by: Fuad Tabba <fuad.tabba at linux.dev>
> Signed-off-by: Fuad Tabba <fuad.tabba at linux.dev>

Not really looked at nVHE much (or pkvm ever), but:

Reviewed-by: Joey Gouly <joey.gouly at arm.com>

> ---
>  arch/arm64/include/asm/kvm_host.h      | 19 +++++++++++++
>  arch/arm64/kvm/hyp/include/nvhe/pkvm.h |  3 ++
>  arch/arm64/kvm/hyp/nvhe/hyp-main.c     | 39 +++++++++++++++++++++++---
>  3 files changed, 57 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> index 27fe0cd5b2d7a..78a4d387f9fd4 100644
> --- a/arch/arm64/include/asm/kvm_host.h
> +++ b/arch/arm64/include/asm/kvm_host.h
> @@ -1033,11 +1033,28 @@ struct kvm_vcpu_arch {
>  		set;						\
>  	})
>  
> +#define __vcpu_copy_flag(vt, vs, flagset, f, m)			\
> +	do {							\
> +		typeof(vs->arch.flagset) tmp, val;		\
> +								\
> +		__build_check_flag(vs, flagset, f, m);		\
> +								\
> +		val = READ_ONCE(vs->arch.flagset);		\
> +		val &= (m);					\
> +		__vcpu_flags_preempt_disable();			\
> +		tmp = READ_ONCE(vt->arch.flagset);		\
> +		tmp &= ~(m);					\
> +		tmp |= val;					\
> +		WRITE_ONCE(vt->arch.flagset, tmp);		\
> +		__vcpu_flags_preempt_enable();			\
> +	} while (0)
> +
>  #define vcpu_get_flag(v, ...)	__vcpu_get_flag((v), __VA_ARGS__)
>  #define vcpu_set_flag(v, ...)	__vcpu_set_flag((v), __VA_ARGS__)
>  #define vcpu_clear_flag(v, ...)	__vcpu_clear_flag((v), __VA_ARGS__)
>  #define vcpu_test_and_clear_flag(v, ...)			\
>  	__vcpu_test_and_clear_flag((v), __VA_ARGS__)
> +#define vcpu_copy_flag(vt, vs, ...) __vcpu_copy_flag((vt), (vs), __VA_ARGS__)
>  
>  /* KVM_ARM_VCPU_INIT completed */
>  #define VCPU_INITIALIZED	__vcpu_single_flag(cflags, BIT(0))
> @@ -1055,6 +1072,8 @@ struct kvm_vcpu_arch {
>  #define INCREMENT_PC		__vcpu_single_flag(iflags, BIT(1))
>  /* Target EL/MODE (not a single flag, but let's abuse the macro) */
>  #define EXCEPT_MASK		__vcpu_single_flag(iflags, GENMASK(3, 1))
> +/* Cover both PENDING_EXCEPTION and EXCEPT_MASK for global operations */
> +#define PC_UPDATE_REQ		__vcpu_single_flag(iflags, GENMASK(3, 0))
>  /* Host-set: the hyp flushes the non-protected vCPU state in on entry */
>  #define PKVM_HOST_STATE_DIRTY	__vcpu_single_flag(iflags, BIT(4))
>  
> diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
> index c904647d2f760..49a0a992047ba 100644
> --- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
> +++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
> @@ -26,6 +26,9 @@ struct pkvm_hyp_vcpu {
>  	 * per-cpu pointer tracking us. Otherwise, NULL if not loaded.
>  	 */
>  	struct pkvm_hyp_vcpu **loaded_hyp_vcpu;
> +
> +	/* The previous exit's ARM_EXCEPTION_* code. */
> +	u32 exit_code;
>  };
>  
>  /*
> diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> index b6bfe502bcd04..ca7122b0bccdd 100644
> --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> @@ -31,6 +31,17 @@ unsigned int hyp_gicv3_nr_lr;
>  
>  void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt);
>  
> +typedef void (*hyp_entry_exit_handler_fn)(struct pkvm_hyp_vcpu *);
> +
> +static void handle_vm_entry_generic(struct pkvm_hyp_vcpu *hyp_vcpu)
> +{
> +	vcpu_copy_flag(&hyp_vcpu->vcpu, hyp_vcpu->host_vcpu, PC_UPDATE_REQ);
> +}

This is added here because the full copy of iflags was moved into the
!pkvm_hyp_vcpu_is_protected() section, so is needed temporarily until
each EC has its own handler.

Thanks,
Joey