Re: [PATCH 02/17] KVM: arm64: Advertise the capabilities that protected VMs support

[Fuad Tabba]

On Wed, 2 Sept 2026 at 14:22, Vincent Donnefort <vdonnefort@xxxxxxxxxx> wrote:
>
> On Mon, Aug 31, 2026 at 05:34:06PM +0100, Fuad Tabba wrote:
> > kvm_pkvm_ext_allowed() denies every capability it does not name, so a
> > protected VM reports 0 for interfaces it implements: KVM_CHECK_EXTENSION
> > denies KVM_CAP_ONE_REG while KVM_{GET,SET}_ONE_REG stage the guest's
> > boot state.
> >
> > Allow the capabilities that work for a protected guest, the vGIC and
> > the I/O bus being host-managed, subject to the restrictions the rest of
> > this series adds.
> >
> > Signed-off-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>
> > ---
> >  arch/arm64/include/asm/kvm_pkvm.h | 9 +++++++++
> >  1 file changed, 9 insertions(+)
> >
> > diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h
> > index beea00e693a0a..c4c834d55e503 100644
> > --- a/arch/arm64/include/asm/kvm_pkvm.h
> > +++ b/arch/arm64/include/asm/kvm_pkvm.h
> > @@ -42,6 +42,15 @@ static inline bool kvm_pkvm_ext_allowed(struct kvm *kvm, long ext)
> >       case KVM_CAP_ARM_VM_IPA_SIZE:
> >       case KVM_CAP_ARM_PTRAUTH_ADDRESS:
> >       case KVM_CAP_ARM_PTRAUTH_GENERIC:
> > +     case KVM_CAP_ONE_REG:
>
> Shouldn't we bring the VCPU_PKVM_FINALIZED restriction in kvm_arch_vcpu_ioctl()
> first before we allow SET_ONE_REG/GET_ONE_REG?

KVM_{GET,SET}_ONE_REG don't go through kvm_pkvm_ext_allowed(), so
they're as reachable before this patch as after it.

The ordering is wrong though, and there are a few more capabilities
advertised here and restricted later. I'll fix it for all of them in
v2.

Thanks,
/fuad

>
> > +     case KVM_CAP_MP_STATE:
> > +     case KVM_CAP_VCPU_EVENTS:
> > +     case KVM_CAP_VCPU_ATTRIBUTES:
> > +     case KVM_CAP_IMMEDIATE_EXIT:
> > +     case KVM_CAP_IOEVENTFD:
> > +     case KVM_CAP_IRQFD_RESAMPLE:
> > +     case KVM_CAP_ARM_IRQ_LINE_LAYOUT_2:
> > +     case KVM_CAP_ARM_INJECT_SERROR_ESR:
> >               return true;
> >       case KVM_CAP_ARM_MTE:
> >               return false;
> > --
> > 2.39.5
> >