[PATCH v18 12/23] KVM: arm64: Widen the scope of "protected" VMs

[Marc Zyngier]

On Tue, 15 Sep 2026 17:01:30 +0100,
Suzuki K Poulose <suzuki.poulose at arm.com> wrote:
> 
> On arm64 we have "protected" VMs that run on PKVM as a confidential compute
> guest. Given we already have the construct of "kvm_vm_is_protected" in the core
> KVM code, use that for all confidential compute guests including Realms that
> we are about to add.
> 
> Use the VM flavor to detect the "protected" VMs by introducing a marker.
> Add explicit helper to detect if a given VM is a "protected" VM under PKVM.
> Change the existing users that precisely want to check the VM type. These
> include :
>   - kvm_arch_prepare_memory_region - For preventing memslot changes after pVM
>     creation.
> 
> All the others are retained as a wider check for confidential guest VMs.
> These are:
>  - kvm_vm_ioctl_set_counter_offset - For disallowing timer offset configuration
>  - io_mem_abort for dabt handling without valid syndrome information
> 
> Both of which are true for Realms too.
> 
> Realms support is restricted to VHE host and thus "kvm_vm_is_protected()"
> checks in the pkvm hyp specific code doesn't need to change, as the only
> protected guests it deals with is "protected PKVM" guests.
> 
> Signed-off-by: Suzuki K Poulose <suzuki.poulose at arm.com>
> ---
>  arch/arm64/include/asm/kvm_host.h | 4 +++-
>  arch/arm64/kvm/mmu.c              | 2 +-
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> index 7ce46d853c47e..1bb43c57fb0f0 100644
> --- a/arch/arm64/include/asm/kvm_host.h
> +++ b/arch/arm64/include/asm/kvm_host.h
> @@ -329,6 +329,7 @@ enum kvm_arm_vm_flavor {
>  	VM_NVHE,
>  	VM_VHE,
>  	VM_PKVM,		/* Normal guests on pKVM */
> +	MARKER(__VM_PROTECTED),
>  	VM_PROTECTED_PKVM,	/* Protected VM */
>  	VM_FLAVOR_MAX,
>  };
> @@ -1535,7 +1536,8 @@ struct kvm *kvm_arch_alloc_vm(void);
>  
>  #define __KVM_HAVE_ARCH_FLUSH_REMOTE_TLBS_RANGE
>  
> -#define kvm_vm_is_protected(kvm)	((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM)
> +#define kvm_vm_is_protected(kvm)	((kvm)->arch.vm_flavor >= __VM_PROTECTED)
> +#define kvm_vm_is_protected_pkvm(kvm)	((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM)
>  #define kvm_vm_is_unprotected_pkvm(kvm)	((kvm)->arch.vm_flavor == VM_PKVM)
>

This really should be added from where you introduce the enumeration,
as my original patch did. Otherwise, this is pure churn for no benefit.

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.