[PATCH v16 00/45] arm64: Support for Arm CCA in KVM
Fuad Tabba
fuad.tabba at linux.dev
Tue Aug 4 07:24:00 PDT 2026
Hi Steven,
On Mon, 3 Aug 2026 at 14:44, Steven Price <steven.price at arm.com> wrote:
...
> * Rewrite Realm entry and exit handling to fit into the generic KVM
> run loop. Work which cannot be performed in the entry path is now
> completed through KVM requests, and MMIO, PSCI, RIPAS changes and
> host calls are adapted to the new flow.
Reading v16 with pKVM in mind: this rework helps, but the series still
adds a few kvm_is_realm()/vcpu_is_rec() checks to the core arm64 code,
and several sit next to, or inside the same condition as, the existing
pKVM checks (the nommu path in kvm_arch_vcpu_load(), the timer
offsets, the NISV abort injection). Both checks answer the same
question: is the guest's state owned by something other than KVM. It
might be worth a common predicate covering both.
Cheers,
/fuad
>
> * Rewrite Realm timer support to use KVM's IRQ-ops infrastructure and
> software resampling.
>
> * Improve SRO cancellation and error handling. Ensure a cancelled
> operation isn't treated as successful, wrapper return values can carry
> negative Linux errors as well as RMI return values, and those errors
> are propagated through the KVM users.
>
> * Check that the RMM supports the host page size before configuring it,
> and exclude firmware-reserved NOMAP memory when creating GPT entries.
>
> * Expand the KVM_ARM_RMI_POPULATE documentation to make clear that Arm
> CCA cannot preserve memory contents during an in-place
> shared-to-private conversion.
>
> * Allocate Realm parameters only while creating the Realm descriptor.
>
> * Document the encoding of the arm64 VM types and require
> ICH_HCR_EL2.TDIR before advertising or creating Realm VMs.
>
> This series is based on the guest_memfd in-place conversion v9 tree[1],
> which is itself based on kvm-x86/next. It is also available as a git
> repository:
>
> https://gitlab.arm.com/linux-arm/linux-cca cca-host/v16
>
> Work in progress changes for kvmtool are available from the git
> repository below:
>
> https://gitlab.arm.com/linux-arm/kvmtool-cca cca/v13
>
> The TF-RMM branch used for testing this series is available here:
>
> https://git.trustedfirmware.org/TF-RMM/tf-rmm.git topics/rmm-v2.0-poc_3
>
> There is a kvm-unit-test branch updated to support the attestation used
> in RMM v2.0 available here:
>
> https://gitlab.arm.com/linux-arm/kvm-unit-tests-cca cca/v4
>
> [0] https://developer.arm.com/documentation/den0137/2-0bet2/
> One bet2 change, which moves metadata out of the individual address
> range descriptors, has intentionally not been implemented because that
> part of the specification is expected to be reverted.
>
> [1] https://github.com/googleprodkernel/linux-cc/commits/guest_memfd-inplace-conversion-v9
>
> Jean-Philippe Brucker (6):
> KVM: arm64: CCA: Propagate breakpoint and watchpoint counts to
> userspace
> KVM: arm64: CCA: Set breakpoint parameters through SET_ONE_REG
> KVM: arm64: CCA: Propagate max SVE vector length from the RMM
> KVM: arm64: CCA: Configure max SVE vector length for a Realm
> KVM: arm64: CCA: Provide register list for unfinalized RECs
> KVM: arm64: CCA: Provide an accurate register list
>
> Joey Gouly (2):
> KVM: arm64: CCA: Allow userspace to inject aborts
> KVM: arm64: CCA: Support RSI_HOST_CALL
>
> Steven Price (34):
> firmware: arm_rmm: Add SMC definitions for calling the RMM
> firmware: arm_rmm: Add wrappers for direct RMI calls
> firmware: arm_rmm: Check for RMI support at init
> firmware: arm_rmm: Configure the RMM with the host's page size
> firmware: arm_rmm: Add support for SRO
> firmware: arm_rmm: Ensure the RMM has GPT entries for memory
> arm64: mm: Handle Granule Protection Faults (GPFs)
> KVM: arm64: Avoid including linux/kvm_host.h in kvm_pgtable.h
> KVM: arm64: CCA: Add wrappers for realm related RMIs
> KVM: arm64: CCA: Check for RMI support at KVM init
> KVM: arm64: CCA: Check for LPA2 support
> KVM: arm64: CCA: Define the user ABI
> KVM: arm64: CCA: Add basic infrastructure for creating a realm
> KVM: arm64: CCA: Allow passing the machine type in KVM creation
> KVM: arm64: CCA: Tear down RTTs
> KVM: arm64: CCA: Allocate and free RECs to match vCPUs
> KVM: arm64: CCA: Support the VGIC in realms
> KVM: arm64: CCA: Support timers in realm RECs
> KVM: arm64: CCA: Handle realm enter/exit
> KVM: arm64: CCA: Handle RMI_EXIT_RIPAS_CHANGE
> KVM: arm64: CCA: Handle realm MMIO emulation
> KVM: arm64: Expose support for private memory
> KVM: arm64: CCA: Create the realm descriptor
> KVM: arm64: CCA: Activate realms on first vCPU run
> KVM: arm64: CCA: Allow populating initial contents
> KVM: arm64: CCA: Set RIPAS of initial memslots
> KVM: arm64: CCA: Support runtime faulting of memory
> KVM: arm64: CCA: Handle realm vCPU load
> KVM: arm64: CCA: Validate register access for Realm VMs
> KVM: arm64: CCA: Handle Realm PSCI requests
> KVM: arm64: WARN on injected undef exceptions
> KVM: arm64: CCA: Prevent Device mappings for realms
> KVM: arm64: CCA: Require ICH_HCR_EL2.TDIR for realms
> KVM: arm64: CCA: Enable realms to be created
>
> Suzuki K Poulose (3):
> KVM: arm64: Include kvm_emulate.h in kvm/arm_psci.h
> KVM: arm64: CCA: Don't expose unsupported capabilities for realm
> guests
> KVM: arm64: CCA: Allow checking SVE on VM instance
>
> Documentation/virt/kvm/api.rst | 70 +-
> arch/arm64/Kconfig | 1 +
> arch/arm64/include/asm/kvm_asm.h | 2 +
> arch/arm64/include/asm/kvm_emulate.h | 37 +
> arch/arm64/include/asm/kvm_host.h | 12 +-
> arch/arm64/include/asm/kvm_pgtable.h | 6 +-
> arch/arm64/include/asm/kvm_pkvm.h | 2 +-
> arch/arm64/include/asm/kvm_rmi.h | 139 +++
> arch/arm64/include/asm/rmi_cmds.h | 465 ++++++++
> arch/arm64/include/asm/virt.h | 1 +
> arch/arm64/kernel/cpufeature.c | 1 +
> arch/arm64/kvm/Kconfig | 2 +
> arch/arm64/kvm/Makefile | 2 +-
> arch/arm64/kvm/arch_timer.c | 34 +-
> arch/arm64/kvm/arm.c | 139 ++-
> arch/arm64/kvm/guest.c | 93 +-
> arch/arm64/kvm/handle_exit.c | 14 +
> arch/arm64/kvm/hyp/pgtable.c | 1 +
> arch/arm64/kvm/hypercalls.c | 4 +-
> arch/arm64/kvm/inject_fault.c | 5 +-
> arch/arm64/kvm/mmio.c | 16 +-
> arch/arm64/kvm/mmu.c | 144 ++-
> arch/arm64/kvm/reset.c | 13 +-
> arch/arm64/kvm/rmi-exit.c | 178 +++
> arch/arm64/kvm/rmi.c | 1561 ++++++++++++++++++++++++++
> arch/arm64/kvm/sys_regs.c | 47 +-
> arch/arm64/kvm/vgic/vgic-init.c | 2 +-
> arch/arm64/mm/fault.c | 28 +-
> drivers/firmware/Kconfig | 1 +
> drivers/firmware/Makefile | 1 +
> drivers/firmware/arm_rmm/Kconfig | 26 +
> drivers/firmware/arm_rmm/Makefile | 2 +
> drivers/firmware/arm_rmm/rmi.c | 776 +++++++++++++
> include/kvm/arm_psci.h | 2 +
> include/linux/arm-rmi-cmds.h | 201 ++++
> include/linux/arm-smccc-rmi.h | 493 ++++++++
> include/uapi/linux/kvm.h | 20 +-
> 37 files changed, 4446 insertions(+), 95 deletions(-)
> create mode 100644 arch/arm64/include/asm/kvm_rmi.h
> create mode 100644 arch/arm64/include/asm/rmi_cmds.h
> create mode 100644 arch/arm64/kvm/rmi-exit.c
> create mode 100644 arch/arm64/kvm/rmi.c
> create mode 100644 drivers/firmware/arm_rmm/Kconfig
> create mode 100644 drivers/firmware/arm_rmm/Makefile
> create mode 100644 drivers/firmware/arm_rmm/rmi.c
> create mode 100644 include/linux/arm-rmi-cmds.h
> create mode 100644 include/linux/arm-smccc-rmi.h
>
> --
> 2.43.0
>
More information about the linux-arm-kernel
mailing list