[PATCH v20 13/22] KVM: arm64: Mandate VGIC v3 for pKVM VMs and Realms
WARM1d
REVIEWED: 2 (0M)
From: Suzuki K Poulose <suzuki.poulose@arm.com>
Date: 2026-09-24 16:06:18
Also in:
kvm, kvmarm, linux-coco, lkml
Subsystem:
arm64 port (aarch64 architecture), kernel virtual machine for arm64 (kvm/arm64), the rest · Maintainers:
Catalin Marinas, Will Deacon, Marc Zyngier, Oliver Upton, Linus Torvalds
Revision v20 of 5 in this series; 2 review trailers.
Revisions (5)
pKVM does not trust the host. Realm VMs follow a similar trust model, with the Realm Management Monitor owning the protected state instead of the host. Add a helper to identify VMs that run under a host-distrusting hypervisor. Use this for blocking ioremap of vgic-v2 into stage2 and prevent creation of VGIC other than v3. Reviewed-by: Jonathan Cameron <redacted> Tested-by: Gavin Shan <redacted> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> --- Changes since v18: - Cover pKVM guests for VGIC v3 mandate. - Merge the VGIC mandate check in here. --- arch/arm64/include/asm/kvm_host.h | 3 +++ arch/arm64/kvm/mmu.c | 2 +- arch/arm64/kvm/vgic/vgic-init.c | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 871f503e9f164..4d75b8e6797bb 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h@@ -328,6 +328,8 @@ enum fgt_group_id { enum kvm_arm_vm_flavor { VM_NVHE, VM_VHE, + /* VMs running on a hyp that doesn't trust */ + MARKER(__VM_DISTRUSTING_HYP), VM_PKVM, /* Normal guests on pKVM */ MARKER(__VM_PROTECTED), VM_PROTECTED_PKVM, /* Protected VM */
@@ -1575,6 +1577,7 @@ struct kvm *kvm_arch_alloc_vm(void); #define kvm_vm_is_unprotected_pkvm(kvm) \ (is_protected_kvm_enabled() && ((kvm)->arch.vm_flavor == VM_PKVM)) +#define kvm_vm_hyp_is_distrusting(kvm) ((kvm)->arch.vm_flavor >= __VM_DISTRUSTING_HYP) int kvm_arm_vcpu_finalize(struct kvm_vcpu *vcpu, int feature); bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu);
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 8e092efdf0825..8f21652d3625c 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c@@ -1252,7 +1252,7 @@ int kvm_phys_addr_ioremap(struct kvm *kvm, phys_addr_t guest_ipa, KVM_PGTABLE_PROT_R | (writable ? KVM_PGTABLE_PROT_W : 0); - if (is_protected_kvm_enabled()) + if (kvm_vm_hyp_is_distrusting(kvm)) return -EPERM; size += offset_in_page(guest_ipa);
diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index 4012df6002ea6..874025513afcc 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c@@ -84,6 +84,8 @@ int kvm_vgic_create(struct kvm *kvm, u32 type) !kvm_vgic_global_state.can_emulate_gicv2) return -ENODEV; + if (kvm_vm_hyp_is_distrusting(kvm) && type != KVM_DEV_TYPE_ARM_VGIC_V3) + return -ENODEV; /* * Ensure mutual exclusion with vCPU creation and any vCPU ioctls by: *
--
2.43.0