Re: [RFC PATCH v7 00/18] kvm/arm: Introduce a customizable aarch64 KVM host model

Hi Khushit,

On 8/24/26 10:19 AM, Khushit Shah wrote:
>
>> On 20 Aug 2026, at 11:57 AM, Khushit Shah <[email protected]> wrote:
>>
>>
>>
>>> On 26 Jul 2026, at 8:59 PM, Eric Auger <[email protected]> wrote:
>>>
>>> !-------------------------------------------------------------------|
>>> CAUTION: External Email
>>>
>>> |-------------------------------------------------------------------!
>>>
>>> This series enhances the current host KVM model with capability to
>>> set writable ID reg fields. 
>>>
>>> Since v6.7 kernel, KVM/arm allows the userspace to overwrite the values
>>> of a subset of ID regs. The list of writable fields continues to grow.
>>> The feature ID range is defined as the AArch64 System register space
>>> with op0==3, op1=={0, 1, 3}, CRn==0, CRm=={0-7}, op2=={0-7}.
>>>
>>> The end goal is to get more flexibility when migrating guests
>>> between different host hardware.
>>>
>>> QEMU retrieves the writable ID fields from KVM UAPI [1] and
>>> match them against a generated description of ID regs and their
>>> named fields that stem from AARCHMRS Registers.json file.
>>> Current description is based on latest 2026-03 edition.
>>> The content of the generated files was compared against kernel
>>> linux/arch/arm64/tools/sysreg file. It is not straightforward
>>> to have unit tests for python scripts as there are many cases for
>>> field extraction. 
>>>
>>> For each writable named field a uint64 property is created
>>> following the "SYSREG_<REG>_<FIELD>" naming convention. REG and
>>> FIELD names are those described in ARM ARM Reference manual.
>>>
>>> The list of SYSREG_ID properties can be retrieved through the qmp
>>> monitor using query-cpu-model-expansion [2].
>>>
>>> For the record, Jinqian was able to migrate between Hisilicon KunPeng
>>> HIP09 and HIP12 chips with this series using this kind of command:
>>>
>>> -cpu host,pauth=off,pmu=off,sve=off,\
>>> SYSREG_ID_AA64PFR1_EL1_NMI=0x0,\
>>> SYSREG_ID_AA64ISAR1_EL1_LS64=0x0,\
>>> SYSREG_ID_AA64ISAR1_EL1_XS=0x0,\
>>> SYSREG_ID_AA64ISAR1_EL1_LRCPC=0x2,\
>>> SYSREG_ID_AA64ISAR2_EL1_RPRFM=0x0,\
>>> SYSREG_ID_AA64ISAR2_EL1_CLRBHB=0x0,\
>>> SYSREG_ID_AA64ISAR2_EL1_PAC_frac=0x0,\
>>> SYSREG_ID_AA64ISAR2_EL1_BC=0x0,\
>>> SYSREG_ID_AA64ISAR2_EL1_RPRES=0x0,\
>>> SYSREG_ID_AA64ISAR2_EL1_WFxT=0x0,\
>>> SYSREG_ID_AA64MMFR0_EL1_FGT=0x0,\
>>> SYSREG_ID_AA64MMFR0_EL1_BigEnd=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_ECBHB=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_CMOW=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_TIDCP1=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_nTLBPA=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_AFP=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_HCX=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_ETS=0x0,\
>>> SYSREG_ID_AA64MMFR1_EL1_PAN=0x2,\
>>> SYSREG_ID_AA64MMFR1_EL1_HAFDBS=0x2,\
>>> SYSREG_ID_AA64MMFR2_EL1_CnP=0x0,\
>>> SYSREG_ID_AA64MMFR3_EL1_TCRX=0x0,\
>>> SYSREG_ID_AA64DFR0_EL1_PMUVer=0x6,\
>>> SYSREG_ID_AA64DFR0_EL1_DebugVer=0x9,\
>>> SYSREG_ID_AA64DFR0_EL1_DoubleLock=0xf,\
>>> SYSREG_ID_AA64ZFR0_EL1_F64MM=0x0,\
>>> SYSREG_ID_AA64ZFR0_EL1_F32MM=0x0,\
>>> SYSREG_ID_AA64ZFR0_EL1_SM4=0x0,\
>>> SYSREG_ID_AA64ZFR0_EL1_SHA3=0x0,\
>>> SYSREG_ID_AA64ZFR0_EL1_BitPerm=0x0,\
>>> SYSREG_ID_AA64ZFR0_EL1_AES=0x0,\
>>> SYSREG_ID_AA64ZFR0_EL1_SVEver=0x0,\
>>> SYSREG_CTR_EL0_L1Ip=0x2 \
>>>
>>> Connie & Eric
>>>
>>> This series can be found at:
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_eauger_qemu_tree_arm-2Dcpu-2Dmodel-2Dv7&d=DwIDAg&c=s883GpUCOChKOHiocYtGcg&r=PGWMyignA0NiDmTlyP7vOTHozBws_VN86yrVmSMkBp0&m=xh5u7-r6auXiWQScafdj-0wW70mXB4FhClh58GryHmExkx8uZN-h9j4B2c90Lowd&s=Ro4v_mjoNaLsznyxm781lzXBcRtXTudjibmgIhoJsNM&e= 
>>>
>>> History:
>>> --------
>>> v6 -> v7:
>>> - query-cpu-model-expansion now applies the sysreg props
>>> onto a scratch vcpu (POC) allowing a finer validation of settings
>>> (not perfect though as init may be revisited depending on
>>> settings)
>>> - Properly handle ValueRange (Khushit)
>>> - Remove cpu parameter in get_host_cpu_idregs call chain
>>> (Khushit)
>>>
>>> v5 -> v6:
>>> v6 is mostly for Khushit to see how he may work on top
>>> of this series. It fulfills some of his requirements:
>>> - Upon Khushit request I added description for enum values
>>> and reserved fields
>>> - set_sysreg_prop checks the input value against enum values
>>> if any
>>> - writable_bitmap is now dispatched into the sysreg descripton
>>> and not stored in vcpu state anymore (besides it is VM wide)
>>> - implemented write for qmp inspection. However this is not
>>> yet checked against KVM. That's the next step I think, ie.
>>> instantiate a scratch vcpu to test if the field value can be
>>> applied?
>>> - if some inconsistencies between writable mask and idreg
>>> field, reserved fields only produce traces
>>> - this version does not yet fix some reported issues about host
>>> supporting nested virt. I will further sync with Khushit.
>>> so this is definitively not candidate to be applied, hence the
>>> RFC tag.
>>>
>>> Cornelia Huck (3):
>>> target/arm/kvm: Retrieve writable ID reg map
>>> arm/cpu-features: document ID reg properties
>>> arm-qmp-cmds: introspection for ID register props
>>>
>>> Eric Auger (14):
>>> scripts: introduce scripts/update-aarch64-cpu-sysregs-header.py
>>> target/arm/cpu-sysregs.h.inc: Sort by name alphabetical order
>>> target/arm/cpu-sysregs.h.inc: Update with automatic generation
>>> arm/cpu: Add infra to handle generated ID register definitions
>>> scripts: Introduce scripts/aarch64_sysreg_helpers module
>>> scripts: Introduce scripts/update-aarch64-cpu-sysreg-properties.py
>>> target/arm/cpu-idregs.h.inc: generate with script
>>> target/arm/cpu-idregs.h.inc: Generate enum values
>>> arm/kvm: Initialize all writable ID registers from host
>>> target/arm/kvm: Introduce kvm_arm_expose_idreg_properties
>>> target/arm/cpu: Expose writable ID reg field properties on the kvm
>>>   host vcpu model
>>> target/arm/cpu-idregs.h.inc: Generate reserved fields
>>> target/arm/kvm: Ignore and trace unexpected writable reserved fields
>>> target/arm/kvm: add utility to write idregs in scratch vcpu
>>>
>>> Shaju Abraham (1):
>>> target/arm/cpu_idregs: generate tables for Arm64 ID registers and
>>>   fields
>>>
>>> docs/system/arm/cpu-features.rst              |  106 +-
>>> target/arm/cpu-idregs.h                       |   41 +
>>> target/arm/kvm_arm.h                          |   13 +
>>> target/arm/cpu-idregs.h.inc                   | 2164 +++++++++++++++++
>>> target/arm/cpu-sysregs.h.inc                  |   57 +-
>>> target/arm/arm-qmp-cmds.c                     |   98 +
>>> target/arm/cpu-idregs.c                       |   96 +
>>> target/arm/cpu64.c                            |    5 +
>>> target/arm/kvm-stub.c                         |    6 +
>>> target/arm/kvm.c                              |  360 ++-
>>> scripts/aarch64_sysreg_helpers.py             |  109 +
>>> .../update-aarch64-cpu-sysreg-properties.py   |  290 +++
>>> scripts/update-aarch64-cpu-sysregs-header.py  |   51 +
>>> target/arm/meson.build                        |    1 +
>>> target/arm/trace-events                       |    8 +
>>> 15 files changed, 3373 insertions(+), 32 deletions(-)
>>> create mode 100644 target/arm/cpu-idregs.h
>>> create mode 100644 target/arm/cpu-idregs.h.inc
>>> create mode 100644 target/arm/cpu-idregs.c
>>> create mode 100644 scripts/aarch64_sysreg_helpers.py
>>> create mode 100644 scripts/update-aarch64-cpu-sysreg-properties.py
>>> create mode 100755 scripts/update-aarch64-cpu-sysregs-header.py
>>>
>>> -- 
>>> 2.53.0
>>>
>> Hi,
>>
>> On my box the build is failing with:
>> [97/2192] Linking target qemu-system-arm
>> FAILED: qemu-system-arm
>> cc @qemu-system-arm.rsp
>> /usr/bin/ld: libsystem_arm.a.p/target_arm_arm-qmp-cmds.c.o: in function `qmp_query_cpu_model_expansion':
>> /home/ahv/qemu/build/../target/arm/arm-qmp-cmds.c:144:(.text+0x4d4): undefined reference to `kvm_check_extension'
>> /usr/bin/ld: /home/ahv/qemu/build/../target/arm/arm-qmp-cmds.c:145:(.text+0x4e4): undefined reference to `kvm_check_extension'
>> /usr/bin/ld: /home/ahv/qemu/build/../target/arm/arm-qmp-cmds.c:151:(.text+0x514): undefined reference to `kvm_check_extension'
>> /usr/bin/ld: /home/ahv/qemu/build/../target/arm/arm-qmp-cmds.c:168:(.text+0x554): undefined reference to `kvm_arm_create_scratch_host_vcpu'
>> /usr/bin/ld: /home/ahv/qemu/build/../target/arm/arm-qmp-cmds.c:152:(.text+0x7d4): undefined reference to `kvm_check_extension'
>> /usr/bin/ld: /home/ahv/qemu/build/../target/arm/arm-qmp-cmds.c:247:(.text+0x8f4): undefined reference to `kvm_arm_destroy_scratch_host_vcpu'
>> collect2: error: ld returned 1 exit status
>
> If I add appropriate stubs, Following test fails:
>   30/1079 qemu:qtest+qtest-aarch64 / qtest-aarch64/device-introspect-test         ERROR            1.58s   killed by signal 6 SIGABRT
>  126/1079 qemu:qtest+qtest-aarch64 / qtest-aarch64/qom-test                       ERROR           46.65s   killed by signal 6 SIGABRT
>  426/1079 qemu:qtest+qtest-aarch64 / qtest-aarch64/arm-cpu-features               ERROR            0.51s   killed by signal 6 SIGABRT
>  467/1079 qemu:qtest+qtest-arm / qtest-arm/arm-cpu-features                       ERROR            0.46s   killed by signal 6 SIGABRT
>  966/1079 qemu:block / io-qcow2-161                                               ERROR            1.95s   exit status 1
>
Thanks. I am currently working on it. Planning to respin this week

Eric