Re: [PATCH v3 30/36] KVM: arm64: Allow userspace to create protected VMs when pKVM is enabled

Will Deacon
2026-03-23T15:00:16Z

On Fri, Mar 20, 2026 at 01:22:29PM +0000, Marc Zyngier wrote:
> On Thu, 05 Mar 2026 14:43:43 +0000,
> Will Deacon <will@kernel.org> wrote:
> >
> > Introduce a new VM type for KVM/arm64 to allow userspace to request the
> > creation of a "protected VM" when the host has booted with pKVM enabled.
> >
> > For now, this depends on CONFIG_EXPERT and results in a taint on first
> > use as many aspects of a protected VM are not yet protected!
> >
> > Signed-off-by: Will Deacon <will@kernel.org>
> > ---
> > arch/arm64/include/asm/kvm_pkvm.h | 2 +-
> > arch/arm64/kvm/Kconfig | 10 ++++++++++
> > arch/arm64/kvm/arm.c | 8 +++++++-
> > arch/arm64/kvm/mmu.c | 3 ---
> > arch/arm64/kvm/pkvm.c | 11 ++++++++++-
> > include/uapi/linux/kvm.h | 5 +++++
> > 6 files changed, 33 insertions(+), 6 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h
> > index 7041e398fb4c..2954b311128c 100644
> > --- a/arch/arm64/include/asm/kvm_pkvm.h
> > +++ b/arch/arm64/include/asm/kvm_pkvm.h
> > @@ -17,7 +17,7 @@
> >
> > #define HYP_MEMBLOCK_REGIONS 128
> >
> > -int pkvm_init_host_vm(struct kvm *kvm);
> > +int pkvm_init_host_vm(struct kvm *kvm, unsigned long type);
> > int pkvm_create_hyp_vm(struct kvm *kvm);
> > bool pkvm_hyp_vm_is_created(struct kvm *kvm);
> > void pkvm_destroy_hyp_vm(struct kvm *kvm);
> > diff --git a/arch/arm64/kvm/Kconfig b/arch/arm64/kvm/Kconfig
> > index 7d1f22fd490b..e71f7fb6e89a 100644
> > --- a/arch/arm64/kvm/Kconfig
> > +++ b/arch/arm64/kvm/Kconfig
> > @@ -82,4 +82,14 @@ config PTDUMP_STAGE2_DEBUGFS
> >
> > If in doubt, say N.
> >
> > +config PROTECTED_VM_UAPI
> > + bool "Expose protected VMs to userspace (experimental)"
> > + depends on KVM && EXPERT
> > + help
> > + Say Y here to enable experimental (i.e. in development)
> > + support for creating protected virtual machines using KVM's
> > + KVM_CREATE_VM ioctl() when booted with pKVM enabled.
> > +
> > + Unless you are a KVM developer, say N.
> > +
>
> Let me once more express my lack of appetite for config options.
> Protected more is already gated by a command-line option, and requires
> active buy-in from the user.
>
> Nested support is in the same "not quite finished" state, and yet
> isn't hidden behind a configuration symbol.
>
> Taint the kernel if you want, but I'd rather we don't add extra config
> options for this. Documenting the "experimental" aspect of upstream
> pKVM should be enough.

Since I _do_ expect the user ABI to evolve (probably becoming stricter)
as we introduce additional protection to parts of the protected VM
state, I just went for the full shebang: CONFIG option, cmdline option
and taint.

I tend to agree that having *all* of that is overkill, so if you're
happy for me to drop the CONFIG option, despite the user ABI not being
stable, then I'm fine with that.

Will