Re: [PATCH v15 09/37] KVM: arm64: CCA: Allow passing the machine type in KVM creation

[Marc Zyngier]

On Wed, 15 Jul 2026 15:28:11 +0100,
Steven Price <steven.price@xxxxxxx> wrote:
> 
> Previously machine type was used purely for specifying the physical
> address size of the guest. Reserve the higher bits to specify an ARM
> specific machine type and declare a new type 'KVM_VM_TYPE_ARM_REALM'
> used to create a realm guest.
> 
> Signed-off-by: Steven Price <steven.price@xxxxxxx>
> ---
> Changes since v13:
>  * Rework to use the two top bits for the machine type now that pKVM has
>    merged and used the top bit for KVM_VM_TYPE_ARM_PROTECTED.
>  * Update the documentation to include KVM_VM_TYPE_ARM_PROTECTED as
>    well.
> Changes since v9:
>  * Explictly set realm.state to REALM_STATE_NONE rather than rely on the
>    zeroing of the structure.
> Changes since v7:
>  * Add some documentation explaining the new machine type.
> Changes since v6:
>  * Make the check for kvm_rme_is_available more visible and report an
>    error code of -EPERM (instead of -EINVAL) to make it explicit that
>    the kernel supports RME, but the platform doesn't.
> ---
>  Documentation/virt/kvm/api.rst | 18 ++++++++++++++++--
>  arch/arm64/kvm/arm.c           | 11 +++++++++++
>  include/uapi/linux/kvm.h       |  7 ++++++-
>  3 files changed, 33 insertions(+), 3 deletions(-)
> 
> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> index b38e090ad95d..e39d146b34a3 100644
> --- a/Documentation/virt/kvm/api.rst
> +++ b/Documentation/virt/kvm/api.rst
> @@ -181,8 +181,22 @@ flag KVM_VM_MIPS_VZ.
>  ARM64:
>  ^^^^^^
>  
> -On arm64, the physical address size for a VM (IPA Size limit) is limited
> -to 40bits by default. The limit can be configured if the host supports the
> +On arm64, the machine type identifier is used to encode a type and the
> +physical address size for the VM. The lower byte (bits[7-0]) encode the
> +address size and the upper bits[30-31] encode a machine type. The machine
> +types that might be available are:
> +
> + =========================   ============================================
> + KVM_VM_TYPE_ARM_NORMAL      A standard VM
> + KVM_VM_TYPE_ARM_REALM       A "Realm" VM using the Arm Confidential
> +                             Compute extensions, the VM's memory is
> +                             protected from the host.
> + KVM_VM_TYPE_ARM_PROTECTED   A "protected" VM using pKVM to isolate the
> +                             VM from the host.
> + =========================   ============================================
> +

Probably worth mentioning that REALM+PROTECTED is an illegal
combination.

	M.

-- 
Jazz isn't dead. It just smells funny.