From: Quentin Perret <qperret@xxxxxxxxxx>
The current implementation of pKVM doesn't support dirty logging or
read-only memslots. Although support for these features is desirable,
this will require future work, so let's cleanly report the limitations
to userspace by failing the ioctls until then.
Signed-off-by: Quentin Perret <qperret@xxxxxxxxxx>
---
arch/arm64/kvm/mmu.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 67cac3340d49..df92b5f7ac63 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1679,11 +1679,17 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
hva_t hva, reg_end;
int ret = 0;
- /* In protected mode, cannot modify memslots once a VM has run. */
- if (is_protected_kvm_enabled() &&
- (change == KVM_MR_DELETE || change == KVM_MR_MOVE) &&
- kvm->arch.pkvm.shadow_handle) {
- return -EPERM;
+ if (is_protected_kvm_enabled()) {
+ /* In protected mode, cannot modify memslots once a VM has run. */
+ if ((change == KVM_MR_DELETE || change == KVM_MR_MOVE) &&
+ kvm->arch.pkvm.shadow_handle) {
+ return -EPERM;
+ }
+
+ if (new &&
+ new->flags & (KVM_MEM_LOG_DIRTY_PAGES | KVM_MEM_READONLY)) {
+ return -EPERM;
+ }
}
if (change != KVM_MR_CREATE && change != KVM_MR_MOVE &&
--
2.36.1.124.g0e6072fb45-goog
