[PATCH 06/11] KVM: arm64: CCA: Add basic infrastructure for creating a realm
Steven Price
steven.price at arm.com
Mon Nov 2 06:12:57 PST 2026
Introduce the skeleton functions for creating and destroying a realm.
The IPA size requested is checked against what the RMM supports.
The actual work of constructing the realm will be added in future
patches.
Signed-off-by: Steven Price <steven.price at arm.com>
---
arch/arm64/include/asm/kvm_rmi.h | 20 ++++++++++++
arch/arm64/kvm/arm.c | 9 +++++
arch/arm64/kvm/mmu.c | 18 ++++++++--
arch/arm64/kvm/rmi.c | 56 ++++++++++++++++++++++++++++++++
4 files changed, 101 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
index 3194daaacf2b..f1a1ed6b91f5 100644
--- a/arch/arm64/include/asm/kvm_rmi.h
+++ b/arch/arm64/include/asm/kvm_rmi.h
@@ -6,6 +6,9 @@
#ifndef __ASM_KVM_RMI_H
#define __ASM_KVM_RMI_H
+#include <linux/arm-smccc-rmi.h>
+#include <linux/kvm.h>
+
/**
* enum realm_state - State of a Realm
*
@@ -50,12 +53,29 @@ enum realm_state {
/**
* struct realm - Additional per VM data for a Realm
*
+ * @rd: Kernel mapping of the RMM-managed Realm Descriptor (RD) granule
+ * @sro: Preallocated SRO state context for Realm MMU operations
* @state: The lifetime state machine for the realm
+ * @ia_bits: Number of valid Input Address bits in the IPA
*/
struct realm {
+ void *rd;
+ /*
+ * Reused by RTT map/unmap SRO commands. Those commands are only
+ * issued from Realm stage-2 map/unmap paths while kvm->mmu_lock is
+ * held for write, including Realm fault handling where
+ * kvm_fault_lock() takes the write side, so concurrent use is
+ * serialized.
+ */
+ struct rmi_sro_state *sro;
enum realm_state state;
+ unsigned int ia_bits;
};
void kvm_init_rmi(void);
+u32 kvm_rmm_ipa_limit(void);
+
+int kvm_init_realm(struct kvm *kvm);
+void kvm_destroy_realm(struct kvm *kvm);
#endif /* __ASM_KVM_RMI_H */
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index c8599fed5902..9a7bbfaf9675 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -303,6 +303,13 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
bitmap_zero(kvm->arch.vcpu_features, KVM_VCPU_MAX_FEATURES);
+ /* Initialise the realm bits after the generic bits are enabled */
+ if (kvm_vm_is_realm(kvm)) {
+ ret = kvm_init_realm(kvm);
+ if (ret)
+ goto err_uninit_mmu;
+ }
+
return 0;
err_uninit_mmu:
@@ -367,6 +374,8 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
kvm_destroy_nested(kvm);
kvm_arm_teardown_hypercalls(kvm);
+ if (kvm_vm_is_realm(kvm))
+ kvm_destroy_realm(kvm);
}
static bool kvm_has_full_ptr_auth(void)
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 1301c563d705..b049ea67d9af 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -981,10 +981,14 @@ static struct kvm_pgtable_mm_ops kvm_s2_mm_ops = {
static int kvm_init_ipa_range(struct kvm_s2_mmu *mmu, unsigned long type)
{
+ struct kvm *kvm = kvm_s2_mmu_to_kvm(mmu);
u32 kvm_ipa_limit = get_kvm_ipa_limit();
u64 mmfr0, mmfr1;
u32 phys_shift;
+ if (kvm_vm_is_realm(kvm))
+ kvm_ipa_limit = kvm_rmm_ipa_limit();
+
phys_shift = KVM_VM_TYPE_ARM_IPA_SIZE(type);
if (is_protected_kvm_enabled()) {
phys_shift = kvm_ipa_limit;
@@ -1034,9 +1038,18 @@ static void stage2_destroy_range(struct kvm_pgtable *pgt, phys_addr_t addr,
static void kvm_stage2_destroy(struct kvm_pgtable *pgt)
{
+ struct kvm *kvm = kvm_s2_mmu_to_kvm(pgt->mmu);
unsigned int ia_bits = VTCR_EL2_IPA(pgt->mmu->vtcr);
- stage2_destroy_range(pgt, 0, BIT(ia_bits));
+ /*
+ * Realm RTTs are inaccessible to the host and may contain stale data
+ * after the RMM has released them. The non-root RTTs are explicitly
+ * destroyed through RMI before the RD is destroyed; only the root PGD
+ * pages remain to be freed here.
+ */
+ if (!kvm_vm_is_realm(kvm))
+ stage2_destroy_range(pgt, 0, BIT(ia_bits));
+
KVM_PGT_FN(kvm_pgtable_stage2_destroy_pgd)(pgt);
}
@@ -1084,6 +1097,8 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t
return -EINVAL;
}
+ mmu->arch = &kvm->arch;
+
err = kvm_init_ipa_range(mmu, type);
if (err)
return err;
@@ -1092,7 +1107,6 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t
if (!pgt)
return -ENOMEM;
- mmu->arch = &kvm->arch;
err = KVM_PGT_FN(kvm_pgtable_stage2_init)(pgt, mmu, &kvm_s2_mm_ops);
if (err)
goto out_free_pgtable;
diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
index 5b07beff8bc9..45ecbaa467d1 100644
--- a/arch/arm64/kvm/rmi.c
+++ b/arch/arm64/kvm/rmi.c
@@ -6,6 +6,8 @@
#include <linux/arm-rmi-cmds.h>
#include <linux/kvm_host.h>
+#include <asm/kvm_emulate.h>
+#include <asm/kvm_mmu.h>
#include <asm/kvm_pgtable.h>
#include <asm/virt.h>
@@ -14,6 +16,60 @@ static bool rmi_has_feature(int reg, unsigned long feature)
return !!u64_get_bits(rmi_feat_reg(reg), feature);
}
+u32 kvm_rmm_ipa_limit(void)
+{
+ return u64_get_bits(rmi_feat_reg(0), RMI_FEATURE_REGISTER_0_S2SZ);
+}
+
+void kvm_destroy_realm(struct kvm *kvm)
+{
+ struct realm *realm = &kvm->arch.realm;
+ size_t pgd_size = kvm_pgtable_stage2_pgd_size(kvm->arch.mmu.vtcr);
+
+ if (!kvm_realm_is_created(kvm)) {
+ kfree(realm->sro);
+ realm->sro = NULL;
+ return;
+ }
+
+ kvm_set_realm_state(kvm, REALM_STATE_DYING);
+
+ if (realm->rd) {
+ phys_addr_t rd_phys = virt_to_phys(realm->rd);
+
+ if (WARN_ON(rmi_realm_terminate(rd_phys, realm->sro)))
+ return;
+
+ if (WARN_ON(rmi_realm_destroy(rd_phys, realm->sro)))
+ return;
+ rmi_free_delegated_page(rd_phys);
+ realm->rd = NULL;
+ }
+
+ if (WARN_ON(rmi_undelegate_range(kvm->arch.mmu.pgd_phys,
+ pgd_size)))
+ return;
+
+ kvm_set_realm_state(kvm, REALM_STATE_DEAD);
+
+ /* Now that the realm is destroyed, free the entry-level RTTs. */
+ kvm_free_stage2_pgd(&kvm->arch.mmu);
+
+ kfree(realm->sro);
+ realm->sro = NULL;
+}
+
+int kvm_init_realm(struct kvm *kvm)
+{
+ struct realm *realm = &kvm->arch.realm;
+
+ realm->sro = kmalloc_obj(*realm->sro);
+ if (!realm->sro)
+ return -ENOMEM;
+
+ return 0;
+}
+
static int rmm_check_features(void)
{
if (kvm_lpa2_is_enabled() &&
--
2.43.0
More information about the linux-arm-kernel
mailing list