Re: [PATCH v18 12/23] KVM: arm64: Widen the scope of "protected" VMs

[Joey Gouly <joey.gouly@arm.com>]

On Tue, Sep 15, 2026 at 05:01:30PM +0100, Suzuki K Poulose wrote:
> On arm64 we have "protected" VMs that run on PKVM as a confidential compute
> guest. Given we already have the construct of "kvm_vm_is_protected" in the core
> KVM code, use that for all confidential compute guests including Realms that
> we are about to add.
> 
> Use the VM flavor to detect the "protected" VMs by introducing a marker.
> Add explicit helper to detect if a given VM is a "protected" VM under PKVM.
> Change the existing users that precisely want to check the VM type. These
> include :
>   - kvm_arch_prepare_memory_region - For preventing memslot changes after pVM
>     creation.
> 
> All the others are retained as a wider check for confidential guest VMs.
> These are:
>  - kvm_vm_ioctl_set_counter_offset - For disallowing timer offset configuration
>  - io_mem_abort for dabt handling without valid syndrome information
> 
> Both of which are true for Realms too.
> 
> Realms support is restricted to VHE host and thus "kvm_vm_is_protected()"
> checks in the pkvm hyp specific code doesn't need to change, as the only
> protected guests it deals with is "protected PKVM" guests.
> 
> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

nit: need to s/PKVM/pKVM/ on the commit message too!

Thanks,
Joey