[RFC PATCH v1 1/2] KVM: arm64: CCA: Add support for configuring the Realm MEC policy
Steven Price
steven.price at arm.com
Fri Jul 31 03:59:03 PDT 2026
Hi Kohei,
Thanks for posting this - it looks good to me, but as Suzuki says it
would be good to get some maintainer feedback. One bug I spotted below.
On 24/07/2026 10:40, Kohei Enju wrote:
> Introduce the KVM_ARM_RMI_CONFIG ioctl to allow userspace to configure
> Realm VM parameters before the Realm is created.
>
> Currently, ARM_RMI_CFG_MEC_POLICY is the only supported configuration
> item. Its value can be ARM_RMI_MEC_POLICY_SHARED or
> ARM_RMI_MEC_POLICY_PRIVATE. Reject the private policy if the platform
> does not support private MECs.
>
> If userspace does not explicitly configure the MEC policy,
> ARM_RMI_MEC_POLICY_SHARED is used by default.
>
> Signed-off-by: Kohei Enju <enju.kohei at fujitsu.com>
> ---
> Documentation/virt/kvm/api.rst | 29 +++++++++++++++++++++++++++++
> arch/arm64/include/asm/kvm_rmi.h | 4 ++++
> arch/arm64/kvm/arm.c | 9 +++++++++
> arch/arm64/kvm/rmi.c | 29 +++++++++++++++++++++++++++++
> drivers/firmware/arm_rmm/rmi.c | 8 ++++++--
> include/linux/arm-rmi-cmds.h | 1 +
> include/uapi/linux/kvm.h | 17 +++++++++++++++++
> 7 files changed, 95 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
> index 85bec9b4f021..e1c660e5eb34 100644
> --- a/Documentation/virt/kvm/api.rst
> +++ b/Documentation/virt/kvm/api.rst
> @@ -6690,6 +6690,35 @@ populated data is hashed and added to the guest's Realm Initial Measurement
> (RIM) stored by the RMM. This can then be retrieved by the guest (using the RSI
> interface) to present to an attestation server.
>
> +4.147 KVM_ARM_RMI_CONFIG
> +------------------------
> +
> +:Capability: KVM_CAP_ARM_RMI
> +:Architectures: arm64
> +:Type: vm ioctl
> +:Parameters: struct kvm_arm_rmi_config (in)
> +:Returns: 0 on success, < 0 on error
> +
> +::
> +
> + struct kvm_arm_rmi_config {
> + __u32 cfg;
> + union {
> + /* cfg == ARM_RMI_CFG_MEC_POLICY */
> + __u8 mec_policy;
> +
> + /* Fix the size of the union */
> + __u8 reserved[256];
> + };
> + };
> +
> +Configures parameters of a Realm VM before the Realm is created.
> +
> +Currently, `ARM_RMI_CFG_MEC_POLICY` is the only supported configuration item.
> +`mec_policy` must be either `ARM_RMI_MEC_POLICY_SHARED` or
> +`ARM_RMI_MEC_POLICY_PRIVATE`. `ARM_RMI_MEC_POLICY_PRIVATE` is not supported if
> +no private MEC is available on the platform.
> +
> .. _kvm_run:
>
> 5. The kvm_run structure
> diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
> index 420e99fca07e..721033b132e1 100644
> --- a/arch/arm64/include/asm/kvm_rmi.h
> +++ b/arch/arm64/include/asm/kvm_rmi.h
> @@ -60,6 +60,7 @@ enum realm_state {
> * @ia_bits: Number of valid Input Address bits in the IPA
> * @stage2_unmapped: The Realm stage-2 mappings have been removed
> * @rtts_destroyed: The non-root RTTs have been torn down
> + * @mec_policy: MEC policy for the Realm VM
> */
> struct realm {
> void *rd;
> @@ -76,6 +77,7 @@ struct realm {
> unsigned int ia_bits;
> bool stage2_unmapped;
> bool rtts_destroyed;
> + unsigned int mec_policy;
> };
>
> /**
> @@ -115,6 +117,8 @@ struct kvm_arm_rmi_populate;
>
> int kvm_arm_rmi_populate(struct kvm *kvm,
> struct kvm_arm_rmi_populate *arg);
> +struct kvm_arm_rmi_config;
> +int kvm_arm_rmi_config(struct kvm *kvm, struct kvm_arm_rmi_config *arg);
> void kvm_realm_unmap_range(struct kvm *kvm,
> unsigned long ipa,
> unsigned long size,
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index 3862db30779f..17302ba2844c 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -2169,6 +2169,15 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
> return -EFAULT;
> return ret;
> }
> + case KVM_ARM_RMI_CONFIG: {
> + struct kvm_arm_rmi_config cfg;
> +
> + if (!kvm_is_realm(kvm))
> + return -ENXIO;
> + if (copy_from_user(&cfg, argp, sizeof(cfg)))
> + return -EFAULT;
> + return kvm_arm_rmi_config(kvm, &cfg);
> + }
> default:
> return -EINVAL;
> }
> diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
> index 06cc85fb5092..629dea5e8c47 100644
> --- a/arch/arm64/kvm/rmi.c
> +++ b/arch/arm64/kvm/rmi.c
> @@ -572,6 +572,9 @@ static int realm_create_rd(struct kvm *kvm)
> if (kvm_lpa2_is_enabled())
> params->flags0 |= RMI_REALM_PARAM_FLAG_LPA2;
>
> + params->flags0 |= FIELD_PREP(RMI_REALM_PARAM_FLAG_MEC_POLICY,
> + realm->mec_policy);
> +
Not your bug, but I realised this could cause problems. If the attempt
to create fails (perhaps due to the second patch and the cgroup charge
failing) and the VMM then reconfigures the MEC_POLICY then flags0
doesn't get reset. Technically that applies to a couple of other flags,
but here (with the following patch) this becomes a way of bypassing the
cgroups policy.
I'll fix this by allocating realm->params directly in realm_create_rd()
so that it always starts off zeroed (and removing the redundant member
of the struct). I think in a previous version of the series the params
was built piecemeal, but that's not true anymore.
The upshot is you don't need to do anything - it's my bug and I'll fix
it in the next version ;)
Thanks,
Steve
> r = realm_init_sve_param(kvm, params);
> if (r)
> goto out_undelegate_tables;
> @@ -1155,6 +1158,30 @@ int kvm_arm_rmi_populate(struct kvm *kvm,
> return ret;
> }
>
> +int kvm_arm_rmi_config(struct kvm *kvm, struct kvm_arm_rmi_config *cfg)
> +{
> + guard(mutex)(&kvm->arch.config_lock);
> +
> + if (kvm_realm_state(kvm) != REALM_STATE_NONE)
> + return -EBUSY;
> +
> + switch (cfg->cfg) {
> + case ARM_RMI_CFG_MEC_POLICY:
> + if (cfg->mec_policy != ARM_RMI_MEC_POLICY_SHARED &&
> + cfg->mec_policy != ARM_RMI_MEC_POLICY_PRIVATE)
> + return -EINVAL;
> +
> + if (cfg->mec_policy == ARM_RMI_MEC_POLICY_PRIVATE &&
> + rmi_mec_count() == 0)
> + return -EOPNOTSUPP;
> +
> + kvm->arch.realm.mec_policy = cfg->mec_policy;
> + return 0;
> + default:
> + return -EINVAL;
> + }
> +}
> +
> static void kvm_complete_ripas_change(struct kvm_vcpu *vcpu)
> {
> struct kvm *kvm = vcpu->kvm;
> @@ -1474,6 +1501,8 @@ int kvm_init_realm(struct kvm *kvm)
> {
> struct realm *realm = &kvm->arch.realm;
>
> + realm->mec_policy = ARM_RMI_MEC_POLICY_SHARED;
> +
> realm->params = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);
> realm->sro = kmalloc_obj(*realm->sro);
> if (!realm->params || !realm->sro) {
> diff --git a/drivers/firmware/arm_rmm/rmi.c b/drivers/firmware/arm_rmm/rmi.c
> index d0c083bdf251..e9632c35e7db 100644
> --- a/drivers/firmware/arm_rmm/rmi.c
> +++ b/drivers/firmware/arm_rmm/rmi.c
> @@ -14,8 +14,7 @@
>
> static bool arm64_rmi_is_available;
>
> -/* Currently only the first 2 registers are used by Linux */
> -#define RMI_FEAT_REG_COUNT 2
> +#define RMI_FEAT_REG_COUNT 5
> static __ro_after_init unsigned long rmi_feat_reg_cache[RMI_FEAT_REG_COUNT];
>
> unsigned long rmi_feat_reg(unsigned long id)
> @@ -27,6 +26,11 @@ unsigned long rmi_feat_reg(unsigned long id)
> }
> EXPORT_SYMBOL_GPL(rmi_feat_reg);
>
> +u64 rmi_mec_count(void)
> +{
> + return u64_get_bits(rmi_feat_reg(4), RMI_FEATURE_REGISTER_4_MEC_COUNT);
> +}
> +
> int rmi_delegate_range(phys_addr_t phys,
> unsigned long size,
> phys_addr_t *out_phys)
> diff --git a/include/linux/arm-rmi-cmds.h b/include/linux/arm-rmi-cmds.h
> index 138983ab4e3c..5236600421c6 100644
> --- a/include/linux/arm-rmi-cmds.h
> +++ b/include/linux/arm-rmi-cmds.h
> @@ -28,6 +28,7 @@ struct rmi_sro_state {
> };
>
> unsigned long rmi_feat_reg(unsigned long id);
> +u64 rmi_mec_count(void);
>
> int rmi_delegate_range(phys_addr_t phys, unsigned long size,
> phys_addr_t *out_phys);
> diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
> index adee3936d6ae..46e62327957c 100644
> --- a/include/uapi/linux/kvm.h
> +++ b/include/uapi/linux/kvm.h
> @@ -1704,4 +1704,21 @@ struct kvm_arm_rmi_populate {
> __u32 reserved;
> };
>
> +#define KVM_ARM_RMI_CONFIG _IOW(KVMIO, 0xd8, struct kvm_arm_rmi_config)
> +
> +#define ARM_RMI_CFG_MEC_POLICY 0
> +#define ARM_RMI_MEC_POLICY_SHARED 0
> +#define ARM_RMI_MEC_POLICY_PRIVATE 1
> +
> +struct kvm_arm_rmi_config {
> + __u32 cfg;
> + union {
> + /* cfg == ARM_RMI_CFG_MEC_POLICY */
> + __u8 mec_policy;
> +
> + /* Reserve space for future configuration payloads. */
> + __u8 reserved[256];
> + };
> +};
> +
> #endif /* __LINUX_KVM_H */
More information about the linux-arm-kernel
mailing list