From f4eee308c8f4013a52bd7d7735e64b5127c1b4a8 Mon Sep 17 00:00:00 2001 From: Fuad Tabba Date: Thu, 11 Dec 2025 10:47:06 +0000 Subject: [PATCH] KVM: arm64: Do not allow KVM_CAP_ARM_MTE for any guest in pKVM Supporting MTE in pKVM introduces significant complexity to the hypervisor at EL2, even for non-protected VMs, since it would require EL2 to handle tag management. For now, do not allow KVM_CAP_ARM_MTE for any VM type in protected mode. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20251211104710.151771-7-tabba@google.com Signed-off-by: Marc Zyngier --- arch/arm64/include/asm/kvm_pkvm.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h index cccfff96f062..09a759971653 100644 --- a/arch/arm64/include/asm/kvm_pkvm.h +++ b/arch/arm64/include/asm/kvm_pkvm.h @@ -44,6 +44,8 @@ static inline bool kvm_pkvm_ext_allowed(struct kvm *kvm, long ext) case KVM_CAP_ARM_PTRAUTH_ADDRESS: case KVM_CAP_ARM_PTRAUTH_GENERIC: return true; + case KVM_CAP_ARM_MTE: + return false; default: return !kvm || !kvm_vm_is_protected(kvm); } -- 2.47.3