Re: [PATCH v15 09/37] KVM: arm64: CCA: Allow passing the machine type in KVM creation

[Steven Price]

On 15/07/2026 17:14, Marc Zyngier wrote:
> On Wed, 15 Jul 2026 15:28:11 +0100,
> Steven Price <steven.price@xxxxxxx> wrote:
>>
>> Previously machine type was used purely for specifying the physical
>> address size of the guest. Reserve the higher bits to specify an ARM
>> specific machine type and declare a new type 'KVM_VM_TYPE_ARM_REALM'
>> used to create a realm guest.
>>
>> Signed-off-by: Steven Price <steven.price@xxxxxxx>
>> ---
>> Changes since v13:
>>  * Rework to use the two top bits for the machine type now that pKVM has
>>    merged and used the top bit for KVM_VM_TYPE_ARM_PROTECTED.
>>  * Update the documentation to include KVM_VM_TYPE_ARM_PROTECTED as
>>    well.
>> Changes since v9:
>>  * Explictly set realm.state to REALM_STATE_NONE rather than rely on the
>>    zeroing of the structure.
>> Changes since v7:
>>  * Add some documentation explaining the new machine type.
>> Changes since v6:
>>  * Make the check for kvm_rme_is_available more visible and report an
>>    error code of -EPERM (instead of -EINVAL) to make it explicit that
>>    the kernel supports RME, but the platform doesn't.
>> ---
>>  Documentation/virt/kvm/api.rst | 18 ++++++++++++++++--
>>  arch/arm64/kvm/arm.c           | 11 +++++++++++
>>  include/uapi/linux/kvm.h       |  7 ++++++-
>>  3 files changed, 33 insertions(+), 3 deletions(-)
>>
>> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
>> index b38e090ad95d..e39d146b34a3 100644
>> --- a/Documentation/virt/kvm/api.rst
>> +++ b/Documentation/virt/kvm/api.rst
>> @@ -181,8 +181,22 @@ flag KVM_VM_MIPS_VZ.
>>  ARM64:
>>  ^^^^^^
>>  
>> -On arm64, the physical address size for a VM (IPA Size limit) is limited
>> -to 40bits by default. The limit can be configured if the host supports the
>> +On arm64, the machine type identifier is used to encode a type and the
>> +physical address size for the VM. The lower byte (bits[7-0]) encode the
>> +address size and the upper bits[30-31] encode a machine type. The machine
>> +types that might be available are:
>> +
>> + =========================   ============================================
>> + KVM_VM_TYPE_ARM_NORMAL      A standard VM
>> + KVM_VM_TYPE_ARM_REALM       A "Realm" VM using the Arm Confidential
>> +                             Compute extensions, the VM's memory is
>> +                             protected from the host.
>> + KVM_VM_TYPE_ARM_PROTECTED   A "protected" VM using pKVM to isolate the
>> +                             VM from the host.
>> + =========================   ============================================
>> +
> 
> Probably worth mentioning that REALM+PROTECTED is an illegal
> combination.

The original intention was that these were enum values not separate bit
fields. Having to adapt to the pKVM changes when they were merged has
somewhat messed this up. I'll add a clarification, but hopefully we
haven't actually burnt the combination in case we have a 4th type in the
future.

Thanks,
Steve