Re: [PATCH v2 04/12] KVM: arm64: CCA: Check RMI support and features at init

[Steven Price <steven.price@arm.com>]

On 12/11/2026 16:39, Suzuki K Poulose wrote:
> Hi Steven
> 
> On 11/11/2026 14:57, Steven Price wrote:
>> Wire RMI initialization into KVM startup and select ARM_RMM_RMI.
>> Proceed only when RMM mode is selected and RMI is available. If
>> KVM uses LPA2, require RMM LPA2 support. Also require SHA-256
>> measurement support.
>>
>> Define a disabled kvm_rmi_is_available static key for later Realm
>> capability checks. The key is enabled after the remaining Realm
>> support is in place.
> 
> Given all of this is only used for the UABI (KVM_CAP_ARM_RMI and
> others), does it make sense to move this patch to the next batch
> of the CCA support and keep this only to sort out the memory
> management support ? Similarly for the Patch 1 ?

True, I can move this patch (and patch 1) out and include it as part of
a future series.

Thanks,
Steve

> Cheers
> Suzuki
> 
>>
>> Signed-off-by: Steven Price <steven.price@arm.com>
>>
>> ---
>> Changes since v1:
>> - Combine the separate v1 RMI availability and LPA2/SHA-256 feature
>>    check patches into one initialization patch.
>> ---
>>   arch/arm64/include/asm/kvm_rmi.h |  2 ++
>>   arch/arm64/include/asm/virt.h    |  1 +
>>   arch/arm64/kvm/Kconfig           |  1 +
>>   arch/arm64/kvm/Makefile          |  2 +-
>>   arch/arm64/kvm/arm.c             |  5 ++++
>>   arch/arm64/kvm/rmi.c             | 42 ++++++++++++++++++++++++++++++++
>>   include/linux/arm-rmi-cmds.h     |  5 ++++
>>   7 files changed, 57 insertions(+), 1 deletion(-)
>>   create mode 100644 arch/arm64/kvm/rmi.c
>>
>> diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/
>> asm/kvm_rmi.h
>> index 67f16793b4d0..3194daaacf2b 100644
>> --- a/arch/arm64/include/asm/kvm_rmi.h
>> +++ b/arch/arm64/include/asm/kvm_rmi.h
>> @@ -56,4 +56,6 @@ struct realm {
>>       enum realm_state state;
>>   };
>>   +void kvm_init_rmi(void);
>> +
>>   #endif /* __ASM_KVM_RMI_H */
>> diff --git a/arch/arm64/include/asm/virt.h b/arch/arm64/include/asm/
>> virt.h
>> index b546703c3ab9..92cec42952f4 100644
>> --- a/arch/arm64/include/asm/virt.h
>> +++ b/arch/arm64/include/asm/virt.h
>> @@ -87,6 +87,7 @@ void __hyp_reset_vectors(void);
>>   bool is_kvm_arm_initialised(void);
>>     DECLARE_STATIC_KEY_FALSE(kvm_protected_mode_initialized);
>> +DECLARE_STATIC_KEY_FALSE(kvm_rmi_is_available);
>>     static inline bool is_pkvm_initialized(void)
>>   {
>> diff --git a/arch/arm64/kvm/Kconfig b/arch/arm64/kvm/Kconfig
>> index cecea0820e52..d067063a3686 100644
>> --- a/arch/arm64/kvm/Kconfig
>> +++ b/arch/arm64/kvm/Kconfig
>> @@ -34,6 +34,7 @@ menuconfig KVM
>>       select GUEST_PERF_EVENTS if PERF_EVENTS
>>       select KVM_GUEST_MEMFD
>>       select KVM_GENERIC_PRE_FAULT_MEMORY
>> +    select ARM_RMM_RMI
>>       help
>>         Support hosting virtualized guest machines.
>>   diff --git a/arch/arm64/kvm/Makefile b/arch/arm64/kvm/Makefile
>> index 7aaeeb84e788..66a719ab5b6b 100644
>> --- a/arch/arm64/kvm/Makefile
>> +++ b/arch/arm64/kvm/Makefile
>> @@ -16,7 +16,7 @@ CFLAGS_handle_exit.o += -Wno-override-init
>>   kvm-y += arm.o mmu.o mmio.o psci.o hypercalls.o pvtime.o \
>>        inject_fault.o va_layout.o handle_exit.o config.o \
>>        guest.o debug.o reset.o sys_regs.o stacktrace.o \
>> -     vgic-sys-reg-v3.o fpsimd.o pkvm.o \
>> +     vgic-sys-reg-v3.o fpsimd.o pkvm.o rmi.o \
>>        arch_timer.o trng.o vmid.o emulate-nested.o nested.o at.o \
>>        vgic/vgic.o vgic/vgic-init.o \
>>        vgic/vgic-irqfd.o vgic/vgic-v2.o \
>> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
>> index e06cc390a3d6..318e8a4b19f8 100644
>> --- a/arch/arm64/kvm/arm.c
>> +++ b/arch/arm64/kvm/arm.c
>> @@ -42,6 +42,7 @@
>>   #include <asm/kvm_nested.h>
>>   #include <asm/kvm_pkvm.h>
>>   #include <asm/kvm_ptrauth.h>
>> +#include <asm/kvm_rmi.h>
>>   #include <asm/sections.h>
>>   #include <asm/stacktrace/nvhe.h>
>>   @@ -112,6 +113,8 @@ long kvm_get_cap_for_kvm_ioctl(unsigned int
>> ioctl, long *ext)
>>       return -EINVAL;
>>   }
>>   +DEFINE_STATIC_KEY_FALSE(kvm_rmi_is_available);
>> +
>>   DECLARE_KVM_HYP_PER_CPU(unsigned long, kvm_hyp_vector);
>>     DEFINE_PER_CPU(unsigned long, kvm_arm_hyp_stack_base);
>> @@ -3272,6 +3275,8 @@ static __init int kvm_arm_init(void)
>>         in_hyp_mode = is_kernel_in_hyp_mode();
>>   +    kvm_init_rmi();
>> +
>>       if (cpus_have_final_cap(ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE) ||
>>           cpus_have_final_cap(ARM64_WORKAROUND_1508412))
>>           kvm_info("Guests without required CPU erratum workarounds
>> can deadlock system!\n" \
>> diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
>> new file mode 100644
>> index 000000000000..f4c45021c6f7
>> --- /dev/null
>> +++ b/arch/arm64/kvm/rmi.c
>> @@ -0,0 +1,42 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +/*
>> + * Copyright (C) 2023-2026 ARM Ltd.
>> + */
>> +
>> +#include <linux/arm-rmi-cmds.h>
>> +#include <linux/kvm_host.h>
>> +
>> +#include <asm/kvm_pgtable.h>
>> +#include <asm/virt.h>
>> +
>> +static int rmm_check_features(void)
>> +{
>> +    if (kvm_lpa2_is_enabled() &&
>> +        !rmi_has_feature(0, RMI_FEATURE_REGISTER_0_LPA2)) {
>> +        kvm_err("RMM doesn't support LPA2\n");
>> +        return -ENXIO;
>> +    }
>> +
>> +    if (!rmi_has_feature(1, RMI_FEATURE_REGISTER_1_HASH_SHA_256)) {
>> +        kvm_err("RMM doesn't support SHA-256 measurements\n");
>> +        return -ENXIO;
>> +    }
>> +
>> +    return 0;
>> +}
>> +
>> +void kvm_init_rmi(void)
>> +{
>> +    if (kvm_get_mode() != KVM_MODE_RMM)
>> +        return;
>> +
>> +    if (!is_rmi_available()) {
>> +        kvm_info("Realm VM support is disabled because RMI is not
>> available\n");
>> +        return;
>> +    }
>> +
>> +    if (rmm_check_features())
>> +        return;
>> +
>> +    /* Future patch will enable static branch kvm_rmi_is_available */
>> +}
>> diff --git a/include/linux/arm-rmi-cmds.h b/include/linux/arm-rmi-cmds.h
>> index a84e50ac851c..6f43eac7c7be 100644
>> --- a/include/linux/arm-rmi-cmds.h
>> +++ b/include/linux/arm-rmi-cmds.h
>> @@ -67,6 +67,11 @@ static __always_inline void
>> rmi_smccc_invoke_once(struct arm_smccc_1_2_regs *reg
>>     unsigned long rmi_feat_reg(unsigned int index);
>>   +static inline bool rmi_has_feature(unsigned int index, unsigned
>> long feature)
>> +{
>> +    return !!(rmi_feat_reg(index) & feature);
>> +}
>> +
>>   int rmi_delegate_range(phys_addr_t phys, unsigned long size,
>>                  phys_addr_t *out_phys);
>>   int rmi_undelegate_range(phys_addr_t phys, unsigned long size);
>