Re: [PATCH v9 4/7] arm64: realm: Move Realm memory encryption ops to RSI code

[Aneesh Kumar K.V <aneesh.kumar@kernel.org>]

Suzuki K Poulose <suzuki.poulose@arm.com> writes:

> On 05/08/2026 07:32, Aneesh Kumar K.V (Arm) wrote:
>> Realm memory encryption callbacks are CCA-specific. Keep the Realm callback
>> registration with the RSI initialization code instead of pageattr.c, which
>> only needs to provide the low-level page-attribute transition helper.
>> 
>> Export __set_memory_enc_dec() within arm64 so the RSI code can wrap it with
>> the Realm-specific encrypt/decrypt callbacks and warning policy.
>> 
>> No functional changes in this patch.
>> 
>> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
>> ---
>>   arch/arm64/include/asm/mem_encrypt.h |  3 +--
>>   arch/arm64/mm/pageattr.c             | 38 +---------------------------
>>   drivers/firmware/arm_rmm/rsi.c       | 34 +++++++++++++++++++++++++
>>   3 files changed, 36 insertions(+), 39 deletions(-)
>> 
>> diff --git a/arch/arm64/include/asm/mem_encrypt.h b/arch/arm64/include/asm/mem_encrypt.h
>> index f03b9d7b83b4..ef8b8463e52b 100644
>> --- a/arch/arm64/include/asm/mem_encrypt.h
>> +++ b/arch/arm64/include/asm/mem_encrypt.h
>> @@ -16,8 +16,7 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops);
>>   
>>   int set_memory_encrypted(unsigned long addr, int numpages);
>>   int set_memory_decrypted(unsigned long addr, int numpages);
>> -
>> -int realm_register_memory_enc_ops(void);
>> +int __set_memory_enc_dec(unsigned long addr, int numpages, bool encrypt);
>>   
>>   static inline bool force_dma_unencrypted(struct device *dev)
>>   {
>> diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
>> index bbe98ac9ad8c..14b2a3801f40 100644
>> --- a/arch/arm64/mm/pageattr.c
>> +++ b/arch/arm64/mm/pageattr.c
>> @@ -275,9 +275,7 @@ int set_direct_map_default_noflush(struct page *page)
>>   				 PAGE_SIZE, set_mask, clear_mask);
>>   }
>>   
>> -static int __set_memory_enc_dec(unsigned long addr,
>> -				int numpages,
>> -				bool encrypt)
>> +int __set_memory_enc_dec(unsigned long addr, int numpages, bool encrypt)
>>   {
>>   	unsigned long set_prot = 0, clear_prot = 0;
>>   	phys_addr_t start, end;
>> @@ -321,40 +319,6 @@ static int __set_memory_enc_dec(unsigned long addr,
>>   				      __pgprot(PTE_PRESENT_INVALID));
>>   }
>
> This calls "rsi_set_memory_range_protected/shared(). Should we add call 
> backs for those too in the arm64_mem_crypt_ops and take those away too ?
>
> something like :
>
> 	pre_enc_dec_phys_range(start, end, bool encrypt) ?
>
> and implement that in firmware/arm_rmm/rsi.c ?
>

__set_memory_enc_dec() is a helper that is only used for realms. We do
have a check:

if (!is_realm_world())
	return 0;

(We should probably change the return value to -EINVAL.)

The only reason it is in arch/arm64/mm/pageattr.c is that it calls
__change_memory_common(). That function is more of an internal helper
for the page table update routines. I wasn't sure whether we want to
expose this API which can also be used for updating linear map
attributes.

Currently, we restrict such updates to vmap mappings, with the only
exception being the Realm use case through __set_memory_enc_dec().

-aneesh