[PATCH 04/17] KVM: arm64: Introduce per-EC entry handlers for pKVM

[Fuad Tabba]

On Wed, 2 Sept 2026 at 11:12, Joey Gouly <joey.gouly at arm.com> wrote:
>
> On Mon, Aug 31, 2026 at 05:34:08PM +0100, Fuad Tabba wrote:
> > From: Marc Zyngier <maz at kernel.org>
> >
> > Add an ESR_EL2.EC-indexed handler table, entry_hyp_vm_handlers[],
> > consulted from flush_hyp_vcpu() on re-entry when the previous exit was
> > a trap: sync_hyp_vcpu() records the exit reason in the hyp vCPU as
> > exit_code, and the trap's exception class comes from its ESR_EL2.
> >
> > Entry carries the host's requested PC updates to the hyp vCPU: add
> > vcpu_copy_flag() to copy a masked set of flags between the two vCPU
> > structures, with PC_UPDATE_REQ covering INCREMENT_PC and the
> > pending-exception flags. The wholesale iflags copy moves into the
> > non-protected branch; a protected vCPU takes only PC_UPDATE_REQ.
> >
> > Signed-off-by: Marc Zyngier <maz at kernel.org>
> > Co-developed-by: Fuad Tabba <fuad.tabba at linux.dev>
> > Signed-off-by: Fuad Tabba <fuad.tabba at linux.dev>
>
> Not really looked at nVHE much (or pkvm ever), but:

That's a plus. Good to get a fresh perspective on the code.

> Reviewed-by: Joey Gouly <joey.gouly at arm.com>

Thanks for the review!
/fuad

>
> > ---
> >  arch/arm64/include/asm/kvm_host.h      | 19 +++++++++++++
> >  arch/arm64/kvm/hyp/include/nvhe/pkvm.h |  3 ++
> >  arch/arm64/kvm/hyp/nvhe/hyp-main.c     | 39 +++++++++++++++++++++++---
> >  3 files changed, 57 insertions(+), 4 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> > index 27fe0cd5b2d7a..78a4d387f9fd4 100644
> > --- a/arch/arm64/include/asm/kvm_host.h
> > +++ b/arch/arm64/include/asm/kvm_host.h
> > @@ -1033,11 +1033,28 @@ struct kvm_vcpu_arch {
> >               set;                                            \
> >       })
> >
> > +#define __vcpu_copy_flag(vt, vs, flagset, f, m)                      \
> > +     do {                                                    \
> > +             typeof(vs->arch.flagset) tmp, val;              \
> > +                                                             \
> > +             __build_check_flag(vs, flagset, f, m);          \
> > +                                                             \
> > +             val = READ_ONCE(vs->arch.flagset);              \
> > +             val &= (m);                                     \
> > +             __vcpu_flags_preempt_disable();                 \
> > +             tmp = READ_ONCE(vt->arch.flagset);              \
> > +             tmp &= ~(m);                                    \
> > +             tmp |= val;                                     \
> > +             WRITE_ONCE(vt->arch.flagset, tmp);              \
> > +             __vcpu_flags_preempt_enable();                  \
> > +     } while (0)
> > +
> >  #define vcpu_get_flag(v, ...)        __vcpu_get_flag((v), __VA_ARGS__)
> >  #define vcpu_set_flag(v, ...)        __vcpu_set_flag((v), __VA_ARGS__)
> >  #define vcpu_clear_flag(v, ...)      __vcpu_clear_flag((v), __VA_ARGS__)
> >  #define vcpu_test_and_clear_flag(v, ...)                     \
> >       __vcpu_test_and_clear_flag((v), __VA_ARGS__)
> > +#define vcpu_copy_flag(vt, vs, ...) __vcpu_copy_flag((vt), (vs), __VA_ARGS__)
> >
> >  /* KVM_ARM_VCPU_INIT completed */
> >  #define VCPU_INITIALIZED     __vcpu_single_flag(cflags, BIT(0))
> > @@ -1055,6 +1072,8 @@ struct kvm_vcpu_arch {
> >  #define INCREMENT_PC         __vcpu_single_flag(iflags, BIT(1))
> >  /* Target EL/MODE (not a single flag, but let's abuse the macro) */
> >  #define EXCEPT_MASK          __vcpu_single_flag(iflags, GENMASK(3, 1))
> > +/* Cover both PENDING_EXCEPTION and EXCEPT_MASK for global operations */
> > +#define PC_UPDATE_REQ                __vcpu_single_flag(iflags, GENMASK(3, 0))
> >  /* Host-set: the hyp flushes the non-protected vCPU state in on entry */
> >  #define PKVM_HOST_STATE_DIRTY        __vcpu_single_flag(iflags, BIT(4))
> >
> > diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
> > index c904647d2f760..49a0a992047ba 100644
> > --- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
> > +++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
> > @@ -26,6 +26,9 @@ struct pkvm_hyp_vcpu {
> >        * per-cpu pointer tracking us. Otherwise, NULL if not loaded.
> >        */
> >       struct pkvm_hyp_vcpu **loaded_hyp_vcpu;
> > +
> > +     /* The previous exit's ARM_EXCEPTION_* code. */
> > +     u32 exit_code;
> >  };
> >
> >  /*
> > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > index b6bfe502bcd04..ca7122b0bccdd 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > @@ -31,6 +31,17 @@ unsigned int hyp_gicv3_nr_lr;
> >
> >  void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt);
> >
> > +typedef void (*hyp_entry_exit_handler_fn)(struct pkvm_hyp_vcpu *);
> > +
> > +static void handle_vm_entry_generic(struct pkvm_hyp_vcpu *hyp_vcpu)
> > +{
> > +     vcpu_copy_flag(&hyp_vcpu->vcpu, hyp_vcpu->host_vcpu, PC_UPDATE_REQ);
> > +}
>
> This is added here because the full copy of iflags was moved into the
> !pkvm_hyp_vcpu_is_protected() section, so is needed temporarily until
> each EC has its own handler.
>
> Thanks,
> Joey