Merge branch kvm-arm64/pkvm_vm_handle into kvmarm-master/next

* kvm-arm64/pkvm_vm_handle:
  : pKVM VM handle allocation fixes, courtesy of Fuad Tabba.
  :
  : From the cover letter (20250909072437.4110547-1-tabba@google.com):
  :
  : "In pKVM, this handle is allocated when the VM is initialized at the
  :  hypervisor, which is on the first vCPU run. However, the host starts
  :  initializing the VM and setting up its data structures earlier. MMU
  :  notifiers for the VMs are also registered before VM initialization at
  :  the hypervisor, and rely on the handle to identify the VM.
  :
  :  Therefore, there is a potential gap between when the VM is (partially)
  :  setup at the host, but still without a valid pKVM handle to identify it
  :  when communicating with the hypervisor."
  KVM: arm64: Reserve pKVM handle during pkvm_init_host_vm()
  KVM: arm64: Introduce separate hypercalls for pKVM VM reservation and initialization
  KVM: arm64: Consolidate pKVM hypervisor VM initialization logic
  KVM: arm64: Separate allocation and insertion of pKVM VM table entries
  KVM: arm64: Decouple hyp VM creation state from its handle
  KVM: arm64: Clarify comments to distinguish pKVM mode from protected VMs
  KVM: arm64: Rename 'host_kvm' to 'kvm' in pKVM host code
  KVM: arm64: Rename pkvm.enabled to pkvm.is_protected
  KVM: arm64: Add build-time check for duplicate DECLARE_REG use

Signed-off-by: Marc Zyngier <maz@kernel.org>

1 files changed, 10 insertions, 4 deletions

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 5bf101c869c9..b77ebe3aafb5 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -170,10 +170,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 	if (ret)
 		return ret;
 
-	ret = pkvm_init_host_vm(kvm);
-	if (ret)
-		goto err_unshare_kvm;
-
 	if (!zalloc_cpumask_var(&kvm->arch.supported_cpus, GFP_KERNEL_ACCOUNT)) {
 		ret = -ENOMEM;
 		goto err_unshare_kvm;
@@ -184,6 +180,16 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 	if (ret)
 		goto err_free_cpumask;
 
+	if (is_protected_kvm_enabled()) {
+		/*
+		 * If any failures occur after this is successful, make sure to
+		 * call __pkvm_unreserve_vm to unreserve the VM in hyp.
+		 */
+		ret = pkvm_init_host_vm(kvm);
+		if (ret)
+			goto err_free_cpumask;
+	}
+
 	kvm_vgic_early_init(kvm);
 
 	kvm_timer_init_vm(kvm);