[PATCH v23 00/14] KVM: arm64: CCA: Add basic plumbing for Realms

[Mathieu Poirier]

On Wed, Oct 07, 2026 at 08:35:23AM +0100, Suzuki K Poulose wrote:
> This is a trimmed down and updated version of the v22 of Arm CCA basic
> plumbing series [0]. I have dropped the CCA specific bits for the sake keeping
> them separate. This series now only contains the framework for handling
> different VM types and lay down the path for adding Realm as one of the
> protected VMs. The full support for running Realms under KVM is available as
> an integration branch at [1].
> 
> The integration branch has been tested with the following components:
> 
>   tf-RMM:   main branch (commit 5e6e2acd) compliant to RMM-v2.0-beta3
>   kvmtool: git at git.gitlab.arm.com:linux-arm/kvmtool-cca.git tag:cca-kvm-v20
> 
> [0] Arm CCA KVM basic plumbing v22
>     https://lore.kernel.org/all/20261005090754.2140522-1-suzuki.poulose@arm.com
> [1] https://git.gitlab.arm.com/linux-arm/linux-cca/ cca/cca-host/kvm-v23/integration
> 
> Changes since v22:
>  https://lore.kernel.org/all/20261005090754.2140522-1-suzuki.poulose@arm.com
>   - Drop the CCA specific patches for now, they are on the integration branch
>   - system_supported_vcpu_features() - Start off with a base set of features for
>     the type of VM
>   - Add () around 'flavor' in KVM_VM_S2_OPS() macro
>   - Drop BUILD_BUG_ON and redefine {kvm_vm,vcpu}_is_protected() for nVHE
>   - Drop {kvm_vm,vcpu}_is_protected_pkvm() macros
> 
> Changes since v21:
>  https://lore.kernel.org/all/20261001210703.1597150-1-suzuki.poulose@arm.com
>  - Keep the kvm_arch struct packed, by moving psci_version, closer to vm_flavor and also moving the vm_s2_ops, closer to vm_flavor.
>  - Drop the kern_hyp_va() for vcpu_is_protected() in nVHE, instead ban nVHE
>    code from using vcpu_is_protected() (by using BUILD_BUG_ON()) and convert
>    all users to vcpu_is_protected_pkvm()
>  - Drop kvm_vm_is_unprotected_pkvm() in favor of open coded check against VM_PKVM
>  - Drop WARN_ON_ONCE() in the kvm_vm_ioctl_allowed() to match Fuad's fix merged in v7.3-rc5
>  - Move '&' to the KVM_*_OPS macros
>  - Nuke __unmap_stage2_range() and define per-VM callback for stage2_unmap_range, removing the KVM_PGT_FN() hack for the call, and also for the others
>  - Drop NULL check for vm_s2_ops callbacks and always define everything.
>  - Add no_age_gfn() which plugs in for pVMs and Realms for the vm_age_*gfn callbacks
> 
> Steven Price (1):
>   KVM: arm64: Avoid including linux/kvm_host.h in kvm_pgtable.h
> 
> Suzuki K Poulose (13):
>   KVM: arm64: protected VM: Handle user writes to CNTVCT_EL0/CNTPCT_EL0
>   KVM: arm64: Disable Steal time accounting for protected guests
>   KVM: arm64: Include kvm_emulate.h in kvm/arm_psci.h
>   KVM: arm64: Track the type of VM in kvm_arch
>   KVM: arm64: Don't call vcpu_set_pauth_traps for pKVM host
>   KVM: arm64: Refactor the vcpu_load to allow for VM specific callbacks
>   KVM: arm64: Add vcpu load/put call backs for flavors
>   KVM: arm64: Consolidate stage2 unmap range into kvm_stage2_unmap_range
>   KVM: arm64: Add VM specific callback for S2 MMU operations
>   KVM: arm64: Use a local kvm pointer in kvm_handle_guest_abort()
>   KVM: arm64: Abstract out memory abort handling
>   KVM: arm64: Mandate VGIC v3 for pKVM VMs and Realms
>   KVM: arm64: Prevent unsupported vcpu features for VM types
> 
>  arch/arm64/include/asm/kvm_host.h    |  73 ++++++-
>  arch/arm64/include/asm/kvm_pgtable.h |  10 +-
>  arch/arm64/include/asm/kvm_pkvm.h    |   6 +-
>  arch/arm64/kvm/arch_timer.c          |  12 +-
>  arch/arm64/kvm/arm.c                 | 275 ++++++++++++++++++++-------
>  arch/arm64/kvm/hyp/nvhe/pkvm.c       |   6 +-
>  arch/arm64/kvm/hyp/pgtable.c         |   1 +
>  arch/arm64/kvm/mmio.c                |   1 +
>  arch/arm64/kvm/mmu.c                 | 247 +++++++++++++++++-------
>  arch/arm64/kvm/pkvm.c                |   6 +-
>  arch/arm64/kvm/pvtime.c              |  14 +-
>  arch/arm64/kvm/vgic/vgic-init.c      |   2 +
>  include/kvm/arm_psci.h               |   2 +
>  13 files changed, 493 insertions(+), 162 deletions(-)

Version 5 of my QEMU-VMM patchset [1] has been tested on this kernel and things
work as expected.  Instructions to build and test on the QEMU SBSA architecture
are located here [2].

[1]. https://lore.kernel.org/kvm/20261002202026.1204110-1-mathieu.poirier@linaro.org/
[2]. https://gitlab.com/Linaro/cca-public/build-instructions/-/tree/upstream-v5-kvmv23?ref_type=heads 

> 
> -- 
> 2.43.0
> 
>