Re: [PATCH v15 09/37] KVM: arm64: CCA: Allow passing the machine type in KVM creation

On Thu, 16 Jul 2026 10:17:21 +0100,
Steven Price <[email protected]> wrote:
> 
> On 15/07/2026 17:14, Marc Zyngier wrote:
> > On Wed, 15 Jul 2026 15:28:11 +0100,
> > Steven Price <[email protected]> wrote:
> >>
> >> Previously machine type was used purely for specifying the physical
> >> address size of the guest. Reserve the higher bits to specify an ARM
> >> specific machine type and declare a new type 'KVM_VM_TYPE_ARM_REALM'
> >> used to create a realm guest.
> >>
> >> Signed-off-by: Steven Price <[email protected]>
> >> ---
> >> Changes since v13:
> >>  * Rework to use the two top bits for the machine type now that pKVM has
> >>    merged and used the top bit for KVM_VM_TYPE_ARM_PROTECTED.
> >>  * Update the documentation to include KVM_VM_TYPE_ARM_PROTECTED as
> >>    well.
> >> Changes since v9:
> >>  * Explictly set realm.state to REALM_STATE_NONE rather than rely on the
> >>    zeroing of the structure.
> >> Changes since v7:
> >>  * Add some documentation explaining the new machine type.
> >> Changes since v6:
> >>  * Make the check for kvm_rme_is_available more visible and report an
> >>    error code of -EPERM (instead of -EINVAL) to make it explicit that
> >>    the kernel supports RME, but the platform doesn't.
> >> ---
> >>  Documentation/virt/kvm/api.rst | 18 ++++++++++++++++--
> >>  arch/arm64/kvm/arm.c           | 11 +++++++++++
> >>  include/uapi/linux/kvm.h       |  7 ++++++-
> >>  3 files changed, 33 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> >> index b38e090ad95d..e39d146b34a3 100644
> >> --- a/Documentation/virt/kvm/api.rst
> >> +++ b/Documentation/virt/kvm/api.rst
> >> @@ -181,8 +181,22 @@ flag KVM_VM_MIPS_VZ.
> >>  ARM64:
> >>  ^^^^^^
> >>  
> >> -On arm64, the physical address size for a VM (IPA Size limit) is limited
> >> -to 40bits by default. The limit can be configured if the host supports the
> >> +On arm64, the machine type identifier is used to encode a type and the
> >> +physical address size for the VM. The lower byte (bits[7-0]) encode the
> >> +address size and the upper bits[30-31] encode a machine type. The machine
> >> +types that might be available are:
> >> +
> >> + =========================   ============================================
> >> + KVM_VM_TYPE_ARM_NORMAL      A standard VM
> >> + KVM_VM_TYPE_ARM_REALM       A "Realm" VM using the Arm Confidential
> >> +                             Compute extensions, the VM's memory is
> >> +                             protected from the host.
> >> + KVM_VM_TYPE_ARM_PROTECTED   A "protected" VM using pKVM to isolate the
> >> +                             VM from the host.
> >> + =========================   ============================================
> >> +
> > 
> > Probably worth mentioning that REALM+PROTECTED is an illegal
> > combination.
> 
> The original intention was that these were enum values not separate bit
> fields. Having to adapt to the pKVM changes when they were merged has
> somewhat messed this up. I'll add a clarification, but hopefully we
> haven't actually burnt the combination in case we have a 4th type in the
> future.

A good way to avoid ambiguity would be to list the actual values for
the [31:30] field (0b00, 0b01, 0b10).

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.