* [PATCH] arm64: Query per-VM capabilities when selecting vCPU features
@ 2026-07-14 11:03 Fuad Tabba
2026-07-14 11:15 ` Suzuki K Poulose
0 siblings, 1 reply; 2+ messages in thread
From: Fuad Tabba @ 2026-07-14 11:03 UTC (permalink / raw)
To: kvm
Cc: kvmarm, Will Deacon, Julien Thierry, Alexandru Elisei,
Suzuki K Poulose, Andre Przywara, Oliver Upton, Marc Zyngier,
Fuad Tabba
kvm_cpu__select_features() and kvm_cpu__configure_features() probe vCPU
feature availability with kvm__supports_extension(), which issues
KVM_CHECK_EXTENSION on the global /dev/kvm fd. That reports the host's
raw capabilities, unaware of any per-VM restrictions.
Protected VMs support a subset of the host's features. The kernel
reflects this on the VM fd (commit a3163dca4817 ("KVM: arm64: Use KVM
extension checks for allowed protected VM capabilities")), while the
global fd still advertises capabilities such as SVE that the VM cannot
use. kvmtool then requests SVE in KVM_ARM_VCPU_INIT, which the kernel
rejects.
Query these capabilities on the VM fd via kvm__supports_vm_extension().
More generally, vCPU feature availability is a per-VM property and is
better checked against the VM fd than the global one.
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
arm64/kvm-cpu.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arm64/kvm-cpu.c b/arm64/kvm-cpu.c
index ae5a6eb..3aa7684 100644
--- a/arm64/kvm-cpu.c
+++ b/arm64/kvm-cpu.c
@@ -53,34 +53,34 @@ int kvm_cpu__register_kvm_arm_target(struct kvm_arm_target *target)
static void kvm_cpu__select_features(struct kvm *kvm, struct kvm_vcpu_init *init)
{
if (kvm->cfg.arch.aarch32_guest) {
- if (!kvm__supports_extension(kvm, KVM_CAP_ARM_EL1_32BIT))
+ if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_EL1_32BIT))
die("32bit guests are not supported\n");
init->features[0] |= 1UL << KVM_ARM_VCPU_EL1_32BIT;
}
if (kvm->cfg.arch.has_pmuv3) {
- if (!kvm__supports_extension(kvm, KVM_CAP_ARM_PMU_V3))
+ if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_PMU_V3))
die("PMUv3 is not supported");
init->features[0] |= 1UL << KVM_ARM_VCPU_PMU_V3;
}
/* Enable pointer authentication if available */
- if (kvm__supports_extension(kvm, KVM_CAP_ARM_PTRAUTH_ADDRESS) &&
- kvm__supports_extension(kvm, KVM_CAP_ARM_PTRAUTH_GENERIC)) {
+ if (kvm__supports_vm_extension(kvm, KVM_CAP_ARM_PTRAUTH_ADDRESS) &&
+ kvm__supports_vm_extension(kvm, KVM_CAP_ARM_PTRAUTH_GENERIC)) {
init->features[0] |= 1UL << KVM_ARM_VCPU_PTRAUTH_ADDRESS;
init->features[0] |= 1UL << KVM_ARM_VCPU_PTRAUTH_GENERIC;
}
/* Enable SVE if available */
- if (kvm__supports_extension(kvm, KVM_CAP_ARM_SVE))
+ if (kvm__supports_vm_extension(kvm, KVM_CAP_ARM_SVE))
init->features[0] |= 1UL << KVM_ARM_VCPU_SVE;
if (kvm->cfg.arch.nested_virt) {
- if (!kvm__supports_extension(kvm, KVM_CAP_ARM_EL2))
+ if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_EL2))
die("EL2 (nested virt) is not supported");
init->features[0] |= 1UL << KVM_ARM_VCPU_HAS_EL2;
if (kvm->cfg.arch.e2h0) {
- if (!kvm__supports_extension(kvm, KVM_CAP_ARM_EL2_E2H0))
+ if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_EL2_E2H0))
die("FEAT_E2H0 is not supported");
init->features[0] |= 1UL << KVM_ARM_VCPU_HAS_EL2_E2H0;
}
@@ -123,7 +123,7 @@ static int vcpu_configure_sve(struct kvm_cpu *vcpu)
static int kvm_cpu__configure_features(struct kvm_cpu *vcpu)
{
- if (kvm__supports_extension(vcpu->kvm, KVM_CAP_ARM_SVE))
+ if (kvm__supports_vm_extension(vcpu->kvm, KVM_CAP_ARM_SVE))
return vcpu_configure_sve(vcpu);
return 0;
--
2.39.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] arm64: Query per-VM capabilities when selecting vCPU features
2026-07-14 11:03 [PATCH] arm64: Query per-VM capabilities when selecting vCPU features Fuad Tabba
@ 2026-07-14 11:15 ` Suzuki K Poulose
0 siblings, 0 replies; 2+ messages in thread
From: Suzuki K Poulose @ 2026-07-14 11:15 UTC (permalink / raw)
To: Fuad Tabba, kvm
Cc: kvmarm, Will Deacon, Julien Thierry, Alexandru Elisei,
Andre Przywara, Oliver Upton, Marc Zyngier, Fuad Tabba
On 14/07/2026 12:03, Fuad Tabba wrote:
> kvm_cpu__select_features() and kvm_cpu__configure_features() probe vCPU
> feature availability with kvm__supports_extension(), which issues
> KVM_CHECK_EXTENSION on the global /dev/kvm fd. That reports the host's
> raw capabilities, unaware of any per-VM restrictions.
>
> Protected VMs support a subset of the host's features. The kernel
> reflects this on the VM fd (commit a3163dca4817 ("KVM: arm64: Use KVM
> extension checks for allowed protected VM capabilities")), while the
> global fd still advertises capabilities such as SVE that the VM cannot
> use. kvmtool then requests SVE in KVM_ARM_VCPU_INIT, which the kernel
> rejects.
>
> Query these capabilities on the VM fd via kvm__supports_vm_extension().
> More generally, vCPU feature availability is a per-VM property and is
> better checked against the VM fd than the global one.
Sounds sensible to me. We do have this with CCA as well.
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
>
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
> ---
> arm64/kvm-cpu.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/arm64/kvm-cpu.c b/arm64/kvm-cpu.c
> index ae5a6eb..3aa7684 100644
> --- a/arm64/kvm-cpu.c
> +++ b/arm64/kvm-cpu.c
> @@ -53,34 +53,34 @@ int kvm_cpu__register_kvm_arm_target(struct kvm_arm_target *target)
> static void kvm_cpu__select_features(struct kvm *kvm, struct kvm_vcpu_init *init)
> {
> if (kvm->cfg.arch.aarch32_guest) {
> - if (!kvm__supports_extension(kvm, KVM_CAP_ARM_EL1_32BIT))
> + if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_EL1_32BIT))
> die("32bit guests are not supported\n");
> init->features[0] |= 1UL << KVM_ARM_VCPU_EL1_32BIT;
> }
>
> if (kvm->cfg.arch.has_pmuv3) {
> - if (!kvm__supports_extension(kvm, KVM_CAP_ARM_PMU_V3))
> + if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_PMU_V3))
> die("PMUv3 is not supported");
> init->features[0] |= 1UL << KVM_ARM_VCPU_PMU_V3;
> }
>
> /* Enable pointer authentication if available */
> - if (kvm__supports_extension(kvm, KVM_CAP_ARM_PTRAUTH_ADDRESS) &&
> - kvm__supports_extension(kvm, KVM_CAP_ARM_PTRAUTH_GENERIC)) {
> + if (kvm__supports_vm_extension(kvm, KVM_CAP_ARM_PTRAUTH_ADDRESS) &&
> + kvm__supports_vm_extension(kvm, KVM_CAP_ARM_PTRAUTH_GENERIC)) {
> init->features[0] |= 1UL << KVM_ARM_VCPU_PTRAUTH_ADDRESS;
> init->features[0] |= 1UL << KVM_ARM_VCPU_PTRAUTH_GENERIC;
> }
>
> /* Enable SVE if available */
> - if (kvm__supports_extension(kvm, KVM_CAP_ARM_SVE))
> + if (kvm__supports_vm_extension(kvm, KVM_CAP_ARM_SVE))
> init->features[0] |= 1UL << KVM_ARM_VCPU_SVE;
>
> if (kvm->cfg.arch.nested_virt) {
> - if (!kvm__supports_extension(kvm, KVM_CAP_ARM_EL2))
> + if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_EL2))
> die("EL2 (nested virt) is not supported");
> init->features[0] |= 1UL << KVM_ARM_VCPU_HAS_EL2;
> if (kvm->cfg.arch.e2h0) {
> - if (!kvm__supports_extension(kvm, KVM_CAP_ARM_EL2_E2H0))
> + if (!kvm__supports_vm_extension(kvm, KVM_CAP_ARM_EL2_E2H0))
> die("FEAT_E2H0 is not supported");
> init->features[0] |= 1UL << KVM_ARM_VCPU_HAS_EL2_E2H0;
> }
> @@ -123,7 +123,7 @@ static int vcpu_configure_sve(struct kvm_cpu *vcpu)
>
> static int kvm_cpu__configure_features(struct kvm_cpu *vcpu)
> {
> - if (kvm__supports_extension(vcpu->kvm, KVM_CAP_ARM_SVE))
> + if (kvm__supports_vm_extension(vcpu->kvm, KVM_CAP_ARM_SVE))
> return vcpu_configure_sve(vcpu);
>
> return 0;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-14 11:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-14 11:03 [PATCH] arm64: Query per-VM capabilities when selecting vCPU features Fuad Tabba
2026-07-14 11:15 ` Suzuki K Poulose
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.