Re: [PATCH 06/11] KVM: arm64: CCA: Add basic infrastructure for creating a realm

[Suzuki K Poulose <suzuki.poulose@arm.com>]

Hi Steven

On 02/11/2026 14:12, Steven Price wrote:
> Introduce the skeleton functions for creating and destroying a realm.
> The IPA size requested is checked against what the RMM supports.
> 
> The actual work of constructing the realm will be added in future
> patches.
> 
> Signed-off-by: Steven Price <steven.price@arm.com>
> ---
>   arch/arm64/include/asm/kvm_rmi.h | 20 ++++++++++++
>   arch/arm64/kvm/arm.c             |  9 +++++
>   arch/arm64/kvm/mmu.c             | 18 ++++++++--
>   arch/arm64/kvm/rmi.c             | 56 ++++++++++++++++++++++++++++++++
>   4 files changed, 101 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
> index 3194daaacf2b..f1a1ed6b91f5 100644
> --- a/arch/arm64/include/asm/kvm_rmi.h
> +++ b/arch/arm64/include/asm/kvm_rmi.h
> @@ -6,6 +6,9 @@
>   #ifndef __ASM_KVM_RMI_H
>   #define __ASM_KVM_RMI_H
>   
> +#include <linux/arm-smccc-rmi.h>
> +#include <linux/kvm.h>
> +
>   /**
>    * enum realm_state - State of a Realm
>    *
> @@ -50,12 +53,29 @@ enum realm_state {
>   /**
>    * struct realm - Additional per VM data for a Realm
>    *
> + * @rd: Kernel mapping of the RMM-managed Realm Descriptor (RD) granule
> + * @sro: Preallocated SRO state context for Realm MMU operations
>    * @state: The lifetime state machine for the realm
> + * @ia_bits: Number of valid Input Address bits in the IPA
>    */
>   struct realm {
> +	void *rd;
> +	/*
> +	 * Reused by RTT map/unmap SRO commands. Those commands are only
> +	 * issued from Realm stage-2 map/unmap paths while kvm->mmu_lock is
> +	 * held for write, including Realm fault handling where
> +	 * kvm_fault_lock() takes the write side, so concurrent use is
> +	 * serialized.
> +	 */
> +	struct rmi_sro_state *sro;
>   	enum realm_state state;
> +	unsigned int ia_bits;
>   };
>   
>   void kvm_init_rmi(void);
> +u32 kvm_rmm_ipa_limit(void);
> +
> +int kvm_init_realm(struct kvm *kvm);
> +void kvm_destroy_realm(struct kvm *kvm);
>   
>   #endif /* __ASM_KVM_RMI_H */
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index c8599fed5902..9a7bbfaf9675 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -303,6 +303,13 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
>   
>   	bitmap_zero(kvm->arch.vcpu_features, KVM_VCPU_MAX_FEATURES);
>   
> +	/* Initialise the realm bits after the generic bits are enabled */
> +	if (kvm_vm_is_realm(kvm)) {
> +		ret = kvm_init_realm(kvm);
> +		if (ret)
> +			goto err_uninit_mmu;
> +	}
> +
>   	return 0;
>   
>   err_uninit_mmu:
> @@ -367,6 +374,8 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
>   
>   	kvm_destroy_nested(kvm);
>   	kvm_arm_teardown_hypercalls(kvm);
> +	if (kvm_vm_is_realm(kvm))
> +		kvm_destroy_realm(kvm);
>   }
>   
>   static bool kvm_has_full_ptr_auth(void)
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 1301c563d705..b049ea67d9af 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -981,10 +981,14 @@ static struct kvm_pgtable_mm_ops kvm_s2_mm_ops = {
>   
>   static int kvm_init_ipa_range(struct kvm_s2_mmu *mmu, unsigned long type)
>   {
> +	struct kvm *kvm = kvm_s2_mmu_to_kvm(mmu);
>   	u32 kvm_ipa_limit = get_kvm_ipa_limit();
>   	u64 mmfr0, mmfr1;
>   	u32 phys_shift;
>   
> +	if (kvm_vm_is_realm(kvm))
> +		kvm_ipa_limit = kvm_rmm_ipa_limit();
> +
>   	phys_shift = KVM_VM_TYPE_ARM_IPA_SIZE(type);
>   	if (is_protected_kvm_enabled()) {
>   		phys_shift = kvm_ipa_limit;
> @@ -1034,9 +1038,18 @@ static void stage2_destroy_range(struct kvm_pgtable *pgt, phys_addr_t addr,
>   
>   static void kvm_stage2_destroy(struct kvm_pgtable *pgt)
>   {
> +	struct kvm *kvm = kvm_s2_mmu_to_kvm(pgt->mmu);
>   	unsigned int ia_bits = VTCR_EL2_IPA(pgt->mmu->vtcr);
>   
> -	stage2_destroy_range(pgt, 0, BIT(ia_bits));
> +	/*
> +	 * Realm RTTs are inaccessible to the host and may contain stale data
> +	 * after the RMM has released them. The non-root RTTs are explicitly
> +	 * destroyed through RMI before the RD is destroyed; only the root PGD
> +	 * pages remain to be freed here.
> +	 */
> +	if (!kvm_vm_is_realm(kvm))
> +		stage2_destroy_range(pgt, 0, BIT(ia_bits));
> +
>   	KVM_PGT_FN(kvm_pgtable_stage2_destroy_pgd)(pgt);
>   }

This looks like a good candidate for another callback for vm_s2_ops ? 
Something like (incomplete functionally, but this should work).
As a bonus, we can remove two instances of KVM_PGT_FN()

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 5e9c2919c509..96685c52fb6e 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1048,35 +1048,52 @@ static int kvm_init_ipa_range(struct kvm_s2_mmu 
*mmu, unsigned long type)
   * cond_resched() periodically to prevent hogging the CPU for a long time
   * and schedule something else, if required.
   */
-static void stage2_destroy_range(struct kvm_pgtable *pgt, phys_addr_t addr,
-				   phys_addr_t end)
+static void stage2_destroy_range(struct kvm_pgtable *pgt,
+				 void (*pgt_destroy_range_fn)(struct kvm_pgtable *pgt,
+							  u64 addr, u64 size))
  {
+	u64 addr = 0;
+	u64 end = BIT(VTCR_EL2_IPA(pgt->mmu->vtcr));
  	u64 next;

  	do {
  		next = stage2_range_addr_end(addr, end);
-		KVM_PGT_FN(kvm_pgtable_stage2_destroy_range)(pgt, addr,
-							     next - addr);
+		pgt_destroy_range_fn(pgt, addr, next - addr);
  		if (next != end)
  			cond_resched();
  	} while (addr = next, addr != end);
  }

+static void kvm_vm_stage2_destroy(struct kvm_pgtable *pgt)
+{
+	stage2_destroy_range(pgt, kvm_pgtable_stage2_destroy_range);
+	kvm_pgtable_stage2_destroy_pgd(pgt);
+}
+
+static void pkvm_stage2_destroy(struct kvm_pgtable *pgt)
+{
+	stage2_destroy_range(pgt, kvm_pgtable_stage2_destroy_range);
+	pkvm_pgtable_stage2_destroy_pgd(pgt);
+}
+
+/*
+* Realm RTTs are inaccessible to the host and may contain stale data
+* after the RMM has released them. The non-root RTTs are explicitly
+* destroyed through RMI before the RD is destroyed; only the root PGD
+* pages remain to be freed here.
+*/
+static void realm_stage2_destroy(struct kvm_pgtable *pgt,
+				 u64 start, u64 end)
+{
+	kvm_pgtable_destroy_pgd(pgt);
+}
+
  static void kvm_stage2_destroy(struct kvm_pgtable *pgt)
  {
  	struct kvm *kvm = kvm_s2_mmu_to_kvm(pgt->mmu);
  	unsigned int ia_bits = VTCR_EL2_IPA(pgt->mmu->vtcr);

-	/*
-	 * Realm RTTs are inaccessible to the host and may contain stale data
-	 * after the RMM has released them. The non-root RTTs are explicitly
-	 * destroyed through RMI before the RD is destroyed; only the root PGD
-	 * pages remain to be freed here.
-	 */
-	if (!kvm_vm_is_realm(kvm))
-		stage2_destroy_range(pgt, 0, BIT(ia_bits));
-
-	KVM_PGT_FN(kvm_pgtable_stage2_destroy_pgd)(pgt);
+	kvm->arch.vm_s2_ops->stage2_destroy(pgt, 0, BIT(ia_bits));
  }





> @@ -1084,6 +1097,8 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t
>   		return -EINVAL;
>   	}
>   
> +	mmu->arch = &kvm->arch;
> +
>   	err = kvm_init_ipa_range(mmu, type);
>   	if (err)
>   		return err;
> @@ -1092,7 +1107,6 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t
>   	if (!pgt)
>   		return -ENOMEM;
>   
> -	mmu->arch = &kvm->arch;
>   	err = KVM_PGT_FN(kvm_pgtable_stage2_init)(pgt, mmu, &kvm_s2_mm_ops);
>   	if (err)
>   		goto out_free_pgtable;
> diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
> index 5b07beff8bc9..45ecbaa467d1 100644
> --- a/arch/arm64/kvm/rmi.c
> +++ b/arch/arm64/kvm/rmi.c
> @@ -6,6 +6,8 @@
>   #include <linux/arm-rmi-cmds.h>
>   #include <linux/kvm_host.h>
>   
> +#include <asm/kvm_emulate.h>
> +#include <asm/kvm_mmu.h>
>   #include <asm/kvm_pgtable.h>
>   #include <asm/virt.h>
>   
> @@ -14,6 +16,60 @@ static bool rmi_has_feature(int reg, unsigned long feature)
>   	return !!u64_get_bits(rmi_feat_reg(reg), feature);
>   }
>   
> +u32 kvm_rmm_ipa_limit(void)
> +{
> +	return u64_get_bits(rmi_feat_reg(0), RMI_FEATURE_REGISTER_0_S2SZ);
> +}
> +
> +void kvm_destroy_realm(struct kvm *kvm)
> +{
> +	struct realm *realm = &kvm->arch.realm;
> +	size_t pgd_size = kvm_pgtable_stage2_pgd_size(kvm->arch.mmu.vtcr);
> +
> +	if (!kvm_realm_is_created(kvm)) {
> +		kfree(realm->sro);
> +		realm->sro = NULL;
> +		return;
> +	}

Do we leak memory of the stage2 PGD if the Realm was never created ?
Should we have something like on top ?

@@ -1646,11 +1645,8 @@ void kvm_destroy_realm(struct kvm *kvm)

         guard(mutex)(&kvm->arch.config_lock);

-       if (!kvm_realm_is_created(kvm)) {
-               kfree(realm->sro);
-               realm->sro = NULL;
-               return;
-       }
+       if (!kvm_realm_is_created(kvm))
+               goto free_pgd;

         kvm_set_realm_state(kvm, REALM_STATE_DYING);

@@ -1684,6 +1680,7 @@ void kvm_destroy_realm(struct kvm *kvm)

         kvm_set_realm_state(kvm, REALM_STATE_DEAD);

+free_pgd:
         /* Now that the realm is destroyed, free the entry-level RTTs. */
         kvm_free_stage2_pgd(&kvm->arch.mmu);


Suzuki

> +
> +	kvm_set_realm_state(kvm, REALM_STATE_DYING);
> +
> +	if (realm->rd) {
> +		phys_addr_t rd_phys = virt_to_phys(realm->rd);
> +
> +		if (WARN_ON(rmi_realm_terminate(rd_phys, realm->sro)))
> +			return;
> +
> +		if (WARN_ON(rmi_realm_destroy(rd_phys, realm->sro)))
> +			return;
> +		rmi_free_delegated_page(rd_phys);
> +		realm->rd = NULL;
> +	}
> +
> +	if (WARN_ON(rmi_undelegate_range(kvm->arch.mmu.pgd_phys,
> +					 pgd_size)))
> +		return;
> +
> +	kvm_set_realm_state(kvm, REALM_STATE_DEAD);
> +
> +	/* Now that the realm is destroyed, free the entry-level RTTs. */
> +	kvm_free_stage2_pgd(&kvm->arch.mmu);
> +
> +	kfree(realm->sro);
> +	realm->sro = NULL;
> +}
> +
> +int kvm_init_realm(struct kvm *kvm)
> +{
> +	struct realm *realm = &kvm->arch.realm;
> +
> +	realm->sro = kmalloc_obj(*realm->sro);
> +	if (!realm->sro)
> +		return -ENOMEM;
> +
> +	return 0;
> +}
> +
>   static int rmm_check_features(void)
>   {
>   	if (kvm_lpa2_is_enabled() &&