When the KVM software-planes backend is enabled, create and activate the
secure plane before the backend issues its first VTL call.  vbs_enable()
runs at late_initcall -- after device drivers have initialised and before
userspace starts -- which is where vm_planes_bootstrap() now runs.

Select VM_PLANES from VBS_KVM_PLANES so the plane bootstrap is built in
whenever the backend is.
---
 security/vbs/Kconfig |  1 +
 security/vbs/core.c  | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/security/vbs/Kconfig b/security/vbs/Kconfig
index e21f4f30b6cf..7a2ebc13e479 100644
--- a/security/vbs/Kconfig
+++ b/security/vbs/Kconfig
@@ -18,6 +18,7 @@ config VBS
 config VBS_KVM_PLANES
 	bool "VBS backend: KVM software planes"
 	depends on VBS && KVM_GUEST
+	select VM_PLANES
 	help
 	  VBS backend that uses a KVM paravirt hypercall to communicate
 	  between plane-0 (the normal guest kernel) and plane-1 (a secure
diff --git a/security/vbs/core.c b/security/vbs/core.c
index c006b6d53a14..8dd4567bcb9c 100644
--- a/security/vbs/core.c
+++ b/security/vbs/core.c
@@ -16,6 +16,7 @@
 #include <linux/reboot.h>
 #include <linux/sizes.h>
 #include <linux/string.h>
+#include <linux/vm_planes.h>
 #include <linux/vmalloc.h>
 
 static const struct vbs_ops *vbs_backend;
@@ -154,6 +155,17 @@ static int __init vbs_enable(void)
 	if (!vbs_plane_config_present())
 		return 0;
 
+	/*
+	 * Create and activate the secure plane before the backend issues its
+	 * first VTL call.  A failure here leaves the backend idle.
+	 */
+	ret = vm_planes_bootstrap();
+	if (ret) {
+		pr_warn("vbs: plane bootstrap failed (%d); backend \"%s\" left idle\n",
+			ret, ops->name);
+		return 0;
+	}
+
 	if (ops->init) {
 		ret = ops->init();
 		if (ret) {
-- 
2.55.0