kvm__arch_set_counter_offset() probes KVM_CAP_COUNTER_OFFSET with kvm__supports_extension(), which issues KVM_CHECK_EXTENSION on the global /dev/kvm fd. That reports the host's raw capabilities, unaware of any per-VM restrictions. pKVM does not offer the counter offset to a protected VM, and reflects that on the VM fd alone. kvmtool's own check passes, and the KVM_ARM_SET_COUNTER_OFFSET that follows is refused by commit b12b3b04f6ba ("KVM: arm64: Check whether a VM IOCTL is allowed in pKVM"): KVM_ARM_SET_COUNTER_OFFSET: Invalid argument Query it on the VM fd via kvm__supports_vm_extension(), so --counter-offset on a protected VM fails with kvmtool's own message: Fatal: No support for global counter offset Signed-off-by: Fuad Tabba --- arm64/kvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arm64/kvm.c b/arm64/kvm.c index 36b3284..0bb3535 100644 --- a/arm64/kvm.c +++ b/arm64/kvm.c @@ -155,7 +155,7 @@ static void kvm__arch_set_counter_offset(struct kvm *kvm) if (!kvm->cfg.arch.counter_offset) return; - if (!kvm__supports_extension(kvm, KVM_CAP_COUNTER_OFFSET)) + if (!kvm__supports_vm_extension(kvm, KVM_CAP_COUNTER_OFFSET)) die("No support for global counter offset"); if (ioctl(kvm->vm_fd, KVM_ARM_SET_COUNTER_OFFSET, &offset)) -- 2.39.5