[PATCH v18 12/23] KVM: arm64: Widen the scope of "protected" VMs

[Suzuki K Poulose]

On 17/09/2026 12:44, Marc Zyngier wrote:
> On Tue, 15 Sep 2026 17:01:30 +0100,
> Suzuki K Poulose <suzuki.poulose at arm.com> wrote:
>>
>> On arm64 we have "protected" VMs that run on PKVM as a confidential compute
>> guest. Given we already have the construct of "kvm_vm_is_protected" in the core
>> KVM code, use that for all confidential compute guests including Realms that
>> we are about to add.
>>
>> Use the VM flavor to detect the "protected" VMs by introducing a marker.
>> Add explicit helper to detect if a given VM is a "protected" VM under PKVM.
>> Change the existing users that precisely want to check the VM type. These
>> include :
>>    - kvm_arch_prepare_memory_region - For preventing memslot changes after pVM
>>      creation.
>>
>> All the others are retained as a wider check for confidential guest VMs.
>> These are:
>>   - kvm_vm_ioctl_set_counter_offset - For disallowing timer offset configuration
>>   - io_mem_abort for dabt handling without valid syndrome information
>>
>> Both of which are true for Realms too.
>>
>> Realms support is restricted to VHE host and thus "kvm_vm_is_protected()"
>> checks in the pkvm hyp specific code doesn't need to change, as the only
>> protected guests it deals with is "protected PKVM" guests.
>>
>> Signed-off-by: Suzuki K Poulose <suzuki.poulose at arm.com>
>> ---
>>   arch/arm64/include/asm/kvm_host.h | 4 +++-
>>   arch/arm64/kvm/mmu.c              | 2 +-
>>   2 files changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
>> index 7ce46d853c47e..1bb43c57fb0f0 100644
>> --- a/arch/arm64/include/asm/kvm_host.h
>> +++ b/arch/arm64/include/asm/kvm_host.h
>> @@ -329,6 +329,7 @@ enum kvm_arm_vm_flavor {
>>   	VM_NVHE,
>>   	VM_VHE,
>>   	VM_PKVM,		/* Normal guests on pKVM */
>> +	MARKER(__VM_PROTECTED),
>>   	VM_PROTECTED_PKVM,	/* Protected VM */
>>   	VM_FLAVOR_MAX,
>>   };
>> @@ -1535,7 +1536,8 @@ struct kvm *kvm_arch_alloc_vm(void);
>>   
>>   #define __KVM_HAVE_ARCH_FLUSH_REMOTE_TLBS_RANGE
>>   
>> -#define kvm_vm_is_protected(kvm)	((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM)
>> +#define kvm_vm_is_protected(kvm)	((kvm)->arch.vm_flavor >= __VM_PROTECTED)
>> +#define kvm_vm_is_protected_pkvm(kvm)	((kvm)->arch.vm_flavor == VM_PROTECTED_PKVM)
>>   #define kvm_vm_is_unprotected_pkvm(kvm)	((kvm)->arch.vm_flavor == VM_PKVM)
>>
> 
> This really should be added from where you introduce the enumeration,
> as my original patch did. Otherwise, this is pure churn for no benefit.

Ack, the idea was to introduce this, after converting the existing
code with the new wrappers. I will fold that change here.

Cheers
Suzuki

> 
> Thanks,
> 
> 	M.
>