[RFC PATCH v1 0/2] KVM: arm64: CCA: Add MEC policy support for CCA Realms

[RFC PATCH v1 0/2] KVM: arm64: CCA: Add MEC policy support for CCA Realms

[Kohei Enju]

This series adds basic support for configuring the Memory Encryption
Context (MEC) policy for Arm CCA Realms.

Patch 1 introduces a new Realm VM ioctl, KVM_ARM_RMI_CONFIG, and uses it
to let userspace select the shared or private MEC policy before the
Realm is created. The default remains the shared MEC policy.

Patch 2 adds a misc cgroup resource for CCA MECIDs and charges one unit
for each Realm using the private MEC policy.

Feedback on the proposed KVM ABI and on using misc cgroup for MECID
accounting would be appreciated.

This series is based on Steven Price's CCA host series [0] [1]. I am
sending it as an RFC while the CCA host series is not yet upstreamed,
and plan to update it as needed to track future revisions of the host
series. Once the host series is merged, I plan to post a non-RFC
version.

[0] https://lore.kernel.org/all/20260715142841.80544-1-steven.price@arm.com/ 
[1] https://gitlab.arm.com/linux-arm/linux-cca  cca-host/v15

Kohei Enju (2):
  KVM: arm64: CCA: Add support for configuring the Realm MEC policy
  cgroup/misc: Add support for Arm CCA MECIDs

 Documentation/virt/kvm/api.rst   | 29 +++++++++++++
 arch/arm64/include/asm/kvm_rmi.h |  6 +++
 arch/arm64/kvm/arm.c             |  9 ++++
 arch/arm64/kvm/rmi.c             | 73 +++++++++++++++++++++++++++++++-
 drivers/firmware/arm_rmm/rmi.c   | 12 +++++-
 include/linux/arm-rmi-cmds.h     |  1 +
 include/linux/misc_cgroup.h      |  4 ++
 include/uapi/linux/kvm.h         | 17 ++++++++
 kernel/cgroup/misc.c             |  4 ++
 9 files changed, 152 insertions(+), 3 deletions(-)

-- 
2.43.0

[RFC PATCH v1 1/2] KVM: arm64: CCA: Add support for configuring the Realm MEC policy

[Kohei Enju]

Introduce the KVM_ARM_RMI_CONFIG ioctl to allow userspace to configure
Realm VM parameters before the Realm is created.

Currently, ARM_RMI_CFG_MEC_POLICY is the only supported configuration
item. Its value can be ARM_RMI_MEC_POLICY_SHARED or
ARM_RMI_MEC_POLICY_PRIVATE. Reject the private policy if the platform
does not support private MECs.

If userspace does not explicitly configure the MEC policy,
ARM_RMI_MEC_POLICY_SHARED is used by default.

Signed-off-by: Kohei Enju <enju.kohei@fujitsu.com>
---
 Documentation/virt/kvm/api.rst   | 29 +++++++++++++++++++++++++++++
 arch/arm64/include/asm/kvm_rmi.h |  4 ++++
 arch/arm64/kvm/arm.c             |  9 +++++++++
 arch/arm64/kvm/rmi.c             | 29 +++++++++++++++++++++++++++++
 drivers/firmware/arm_rmm/rmi.c   |  8 ++++++--
 include/linux/arm-rmi-cmds.h     |  1 +
 include/uapi/linux/kvm.h         | 17 +++++++++++++++++
 7 files changed, 95 insertions(+), 2 deletions(-)

diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
index 85bec9b4f021..e1c660e5eb34 100644
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -6690,6 +6690,35 @@ populated data is hashed and added to the guest's Realm Initial Measurement
 (RIM) stored by the RMM. This can then be retrieved by the guest (using the RSI
 interface) to present to an attestation server.
 
+4.147 KVM_ARM_RMI_CONFIG
+------------------------
+
+:Capability: KVM_CAP_ARM_RMI
+:Architectures: arm64
+:Type: vm ioctl
+:Parameters: struct kvm_arm_rmi_config (in)
+:Returns: 0 on success, < 0 on error
+
+::
+
+  struct kvm_arm_rmi_config {
+       __u32 cfg;
+       union {
+               /* cfg == ARM_RMI_CFG_MEC_POLICY */
+               __u8 mec_policy;
+
+               /* Fix the size of the union */
+               __u8 reserved[256];
+       };
+  };
+
+Configures parameters of a Realm VM before the Realm is created.
+
+Currently, `ARM_RMI_CFG_MEC_POLICY` is the only supported configuration item.
+`mec_policy` must be either `ARM_RMI_MEC_POLICY_SHARED` or
+`ARM_RMI_MEC_POLICY_PRIVATE`. `ARM_RMI_MEC_POLICY_PRIVATE` is not supported if
+no private MEC is available on the platform.
+
 .. _kvm_run:
 
 5. The kvm_run structure
diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
index 420e99fca07e..721033b132e1 100644
--- a/arch/arm64/include/asm/kvm_rmi.h
+++ b/arch/arm64/include/asm/kvm_rmi.h
@@ -60,6 +60,7 @@ enum realm_state {
  * @ia_bits: Number of valid Input Address bits in the IPA
  * @stage2_unmapped: The Realm stage-2 mappings have been removed
  * @rtts_destroyed: The non-root RTTs have been torn down
+ * @mec_policy: MEC policy for the Realm VM
  */
 struct realm {
 	void *rd;
@@ -76,6 +77,7 @@ struct realm {
 	unsigned int ia_bits;
 	bool stage2_unmapped;
 	bool rtts_destroyed;
+	unsigned int mec_policy;
 };
 
 /**
@@ -115,6 +117,8 @@ struct kvm_arm_rmi_populate;
 
 int kvm_arm_rmi_populate(struct kvm *kvm,
 			 struct kvm_arm_rmi_populate *arg);
+struct kvm_arm_rmi_config;
+int kvm_arm_rmi_config(struct kvm *kvm, struct kvm_arm_rmi_config *arg);
 void kvm_realm_unmap_range(struct kvm *kvm,
 			   unsigned long ipa,
 			   unsigned long size,
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 3862db30779f..17302ba2844c 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -2169,6 +2169,15 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
 			return -EFAULT;
 		return ret;
 	}
+	case KVM_ARM_RMI_CONFIG: {
+		struct kvm_arm_rmi_config cfg;
+
+		if (!kvm_is_realm(kvm))
+			return -ENXIO;
+		if (copy_from_user(&cfg, argp, sizeof(cfg)))
+			return -EFAULT;
+		return kvm_arm_rmi_config(kvm, &cfg);
+	}
 	default:
 		return -EINVAL;
 	}
diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
index 06cc85fb5092..629dea5e8c47 100644
--- a/arch/arm64/kvm/rmi.c
+++ b/arch/arm64/kvm/rmi.c
@@ -572,6 +572,9 @@ static int realm_create_rd(struct kvm *kvm)
 	if (kvm_lpa2_is_enabled())
 		params->flags0 |= RMI_REALM_PARAM_FLAG_LPA2;
 
+	params->flags0 |= FIELD_PREP(RMI_REALM_PARAM_FLAG_MEC_POLICY,
+				     realm->mec_policy);
+
 	r = realm_init_sve_param(kvm, params);
 	if (r)
 		goto out_undelegate_tables;
@@ -1155,6 +1158,30 @@ int kvm_arm_rmi_populate(struct kvm *kvm,
 	return ret;
 }
 
+int kvm_arm_rmi_config(struct kvm *kvm, struct kvm_arm_rmi_config *cfg)
+{
+	guard(mutex)(&kvm->arch.config_lock);
+
+	if (kvm_realm_state(kvm) != REALM_STATE_NONE)
+		return -EBUSY;
+
+	switch (cfg->cfg) {
+	case ARM_RMI_CFG_MEC_POLICY:
+		if (cfg->mec_policy != ARM_RMI_MEC_POLICY_SHARED &&
+		    cfg->mec_policy != ARM_RMI_MEC_POLICY_PRIVATE)
+			return -EINVAL;
+
+		if (cfg->mec_policy == ARM_RMI_MEC_POLICY_PRIVATE &&
+		    rmi_mec_count() == 0)
+			return -EOPNOTSUPP;
+
+		kvm->arch.realm.mec_policy = cfg->mec_policy;
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
 static void kvm_complete_ripas_change(struct kvm_vcpu *vcpu)
 {
 	struct kvm *kvm = vcpu->kvm;
@@ -1474,6 +1501,8 @@ int kvm_init_realm(struct kvm *kvm)
 {
 	struct realm *realm = &kvm->arch.realm;
 
+	realm->mec_policy = ARM_RMI_MEC_POLICY_SHARED;
+
 	realm->params = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);
 	realm->sro = kmalloc_obj(*realm->sro);
 	if (!realm->params || !realm->sro) {
diff --git a/drivers/firmware/arm_rmm/rmi.c b/drivers/firmware/arm_rmm/rmi.c
index d0c083bdf251..e9632c35e7db 100644
--- a/drivers/firmware/arm_rmm/rmi.c
+++ b/drivers/firmware/arm_rmm/rmi.c
@@ -14,8 +14,7 @@
 
 static bool arm64_rmi_is_available;
 
-/* Currently only the first 2 registers are used by Linux */
-#define RMI_FEAT_REG_COUNT	2
+#define RMI_FEAT_REG_COUNT	5
 static __ro_after_init unsigned long rmi_feat_reg_cache[RMI_FEAT_REG_COUNT];
 
 unsigned long rmi_feat_reg(unsigned long id)
@@ -27,6 +26,11 @@ unsigned long rmi_feat_reg(unsigned long id)
 }
 EXPORT_SYMBOL_GPL(rmi_feat_reg);
 
+u64 rmi_mec_count(void)
+{
+	return u64_get_bits(rmi_feat_reg(4), RMI_FEATURE_REGISTER_4_MEC_COUNT);
+}
+
 int rmi_delegate_range(phys_addr_t phys,
 		       unsigned long size,
 		       phys_addr_t *out_phys)
diff --git a/include/linux/arm-rmi-cmds.h b/include/linux/arm-rmi-cmds.h
index 138983ab4e3c..5236600421c6 100644
--- a/include/linux/arm-rmi-cmds.h
+++ b/include/linux/arm-rmi-cmds.h
@@ -28,6 +28,7 @@ struct rmi_sro_state {
 };
 
 unsigned long rmi_feat_reg(unsigned long id);
+u64 rmi_mec_count(void);
 
 int rmi_delegate_range(phys_addr_t phys, unsigned long size,
 		       phys_addr_t *out_phys);
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index adee3936d6ae..46e62327957c 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -1704,4 +1704,21 @@ struct kvm_arm_rmi_populate {
 	__u32 reserved;
 };
 
+#define KVM_ARM_RMI_CONFIG     _IOW(KVMIO, 0xd8, struct kvm_arm_rmi_config)
+
+#define ARM_RMI_CFG_MEC_POLICY		0
+#define ARM_RMI_MEC_POLICY_SHARED	0
+#define ARM_RMI_MEC_POLICY_PRIVATE	1
+
+struct kvm_arm_rmi_config {
+	__u32 cfg;
+	union {
+		/* cfg == ARM_RMI_CFG_MEC_POLICY */
+		__u8 mec_policy;
+
+		/* Reserve space for future configuration payloads. */
+		__u8 reserved[256];
+	};
+};
+
 #endif /* __LINUX_KVM_H */
-- 
2.43.0

[RFC PATCH v1 2/2] cgroup/misc: Add support for Arm CCA MECIDs

[Kohei Enju]

Arm CCA MECIDs are limited platform resources. Add a misc cgroup
resource to allow the system administrator to account for and limit
their use.

The cca_mec resource represents the number of Realm VMs using the
private MEC policy. Each such Realm consumes one MECID. Charge the
resource when the Realm is created, and uncharge it when the Realm is
successfully destroyed.

Realms using the shared MEC policy don't consume this resource.

Signed-off-by: Kohei Enju <enju.kohei@fujitsu.com>
---
 arch/arm64/include/asm/kvm_rmi.h |  2 ++
 arch/arm64/kvm/rmi.c             | 44 +++++++++++++++++++++++++++++++-
 drivers/firmware/arm_rmm/rmi.c   |  4 +++
 include/linux/misc_cgroup.h      |  4 +++
 kernel/cgroup/misc.c             |  4 +++
 5 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/include/asm/kvm_rmi.h b/arch/arm64/include/asm/kvm_rmi.h
index 721033b132e1..182bdd22014f 100644
--- a/arch/arm64/include/asm/kvm_rmi.h
+++ b/arch/arm64/include/asm/kvm_rmi.h
@@ -61,6 +61,7 @@ enum realm_state {
  * @stage2_unmapped: The Realm stage-2 mappings have been removed
  * @rtts_destroyed: The non-root RTTs have been torn down
  * @mec_policy: MEC policy for the Realm VM
+ * @misc_cg: Misc cgroup charged while the Realm owns a private MECID
  */
 struct realm {
 	void *rd;
@@ -78,6 +79,7 @@ struct realm {
 	bool stage2_unmapped;
 	bool rtts_destroyed;
 	unsigned int mec_policy;
+	struct misc_cg *misc_cg;
 };
 
 /**
diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
index 629dea5e8c47..505fa80f635d 100644
--- a/arch/arm64/kvm/rmi.c
+++ b/arch/arm64/kvm/rmi.c
@@ -5,6 +5,7 @@
 
 #include <uapi/linux/psci.h>
 #include <linux/kvm_host.h>
+#include <linux/misc_cgroup.h>
 
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_mmu.h>
@@ -525,6 +526,36 @@ static int realm_init_sve_param(struct kvm *kvm, struct realm_params *params)
 	return 0;
 }
 
+static int realm_mec_charge(struct realm *realm)
+{
+	struct misc_cg *misc_cg;
+	int ret;
+
+	if (realm->mec_policy != ARM_RMI_MEC_POLICY_PRIVATE)
+		return 0;
+
+	misc_cg = get_current_misc_cg();
+
+	ret = misc_cg_try_charge(MISC_CG_RES_CCA_MEC, misc_cg, 1);
+	if (ret) {
+		put_misc_cg(misc_cg);
+		return ret;
+	}
+
+	realm->misc_cg = misc_cg;
+	return 0;
+}
+
+static void realm_mec_uncharge(struct realm *realm)
+{
+	if (!realm->misc_cg)
+		return;
+
+	misc_cg_uncharge(MISC_CG_RES_CCA_MEC, realm->misc_cg, 1);
+	put_misc_cg(realm->misc_cg);
+	realm->misc_cg = NULL;
+}
+
 static int realm_create_rd(struct kvm *kvm)
 {
 	struct realm *realm = &kvm->arch.realm;
@@ -579,11 +610,15 @@ static int realm_create_rd(struct kvm *kvm)
 	if (r)
 		goto out_undelegate_tables;
 
+	r = realm_mec_charge(realm);
+	if (r)
+		goto out_undelegate_tables;
+
 	params_phys = virt_to_phys(params);
 
 	if (rmi_realm_create(rd_phys, params_phys, realm->sro)) {
 		r = -ENXIO;
-		goto out_undelegate_tables;
+		goto out_uncharge_misc_cg;
 	}
 
 	realm->rd = rd;
@@ -594,6 +629,8 @@ static int realm_create_rd(struct kvm *kvm)
 
 	return 0;
 
+out_uncharge_misc_cg:
+	realm_mec_uncharge(realm);
 out_undelegate_tables:
 	if (WARN_ON(rmi_undelegate_range(kvm->arch.mmu.pgd_phys, top_delegated - kvm->arch.mmu.pgd_phys))) {
 		/* Leak the pages if they cannot be returned */
@@ -1478,10 +1515,15 @@ void kvm_destroy_realm(struct kvm *kvm)
 		if (WARN_ON(realm_destroy_rtts(kvm)))
 			return;
 
+		/*
+		 * Keep the misc cgroup charge if RMI_REALM_DESTROY fails, as
+		 * the corresponding MECID may still be allocated by the RMM.
+		 */
 		if (WARN_ON(rmi_realm_destroy(rd_phys, realm->sro)))
 			return;
 		free_delegated_page(rd_phys);
 		realm->rd = NULL;
+		realm_mec_uncharge(realm);
 	}
 
 	if (WARN_ON(rmi_undelegate_range(kvm->arch.mmu.pgd_phys,
diff --git a/drivers/firmware/arm_rmm/rmi.c b/drivers/firmware/arm_rmm/rmi.c
index e9632c35e7db..85a7e6686d2b 100644
--- a/drivers/firmware/arm_rmm/rmi.c
+++ b/drivers/firmware/arm_rmm/rmi.c
@@ -6,6 +6,7 @@
 #include <linux/cpufeature.h>
 #include <linux/memblock.h>
 #include <linux/arm-rmi-cmds.h>
+#include <linux/misc_cgroup.h>
 #include <linux/processor.h>
 #include <linux/slab.h>
 
@@ -714,6 +715,9 @@ static int __init arm64_init_rmi(void)
 	if (ret)
 		return ret;
 
+	WARN_ON_ONCE(misc_cg_set_capacity(MISC_CG_RES_CCA_MEC,
+					  rmi_mec_count()));
+
 	arm64_rmi_is_available = true;
 	pr_info("RMI configured");
 
diff --git a/include/linux/misc_cgroup.h b/include/linux/misc_cgroup.h
index 0cb36a3ffc47..b542502dc52a 100644
--- a/include/linux/misc_cgroup.h
+++ b/include/linux/misc_cgroup.h
@@ -21,6 +21,10 @@ enum misc_res_type {
 #ifdef CONFIG_INTEL_TDX_HOST
 	/** @MISC_CG_RES_TDX: Intel TDX HKIDs resource */
 	MISC_CG_RES_TDX,
+#endif
+#ifdef CONFIG_ARM_RMM
+	/** @MISC_CG_RES_CCA_MEC: ARM64 CCA MECIDs resource */
+	MISC_CG_RES_CCA_MEC,
 #endif
 	/** @MISC_CG_RES_TYPES: count of enum misc_res_type constants */
 	MISC_CG_RES_TYPES
diff --git a/kernel/cgroup/misc.c b/kernel/cgroup/misc.c
index 4a9e2557141c..69259085115e 100644
--- a/kernel/cgroup/misc.c
+++ b/kernel/cgroup/misc.c
@@ -28,6 +28,10 @@ static const char *const misc_res_name[] = {
 	/* Intel TDX HKIDs resource */
 	"tdx",
 #endif
+#ifdef CONFIG_ARM_RMM
+	/* ARM64 CCA MECIDs resource */
+	"cca_mec",
+#endif
 };
 
 /* Root misc cgroup */
-- 
2.43.0

Re: [RFC PATCH v1 2/2] cgroup/misc: Add support for Arm CCA MECIDs

[Michal Koutný]

[-- Attachment #1: Type: text/plain, Size: 1239 bytes --]

Hello Kohei.

On Fri, Jul 24, 2026 at 06:40:56PM +0900, Kohei Enju <enju.kohei@fujitsu.com> wrote:
> Arm CCA MECIDs are limited platform resources. Add a misc cgroup
> resource to allow the system administrator to account for and limit
> their use.
> 
> The cca_mec resource represents the number of Realm VMs using the
> private MEC policy. Each such Realm consumes one MECID. Charge the
> resource when the Realm is created, and uncharge it when the Realm is
> successfully destroyed.
> 
> Realms using the shared MEC policy don't consume this resource.
> 
> Signed-off-by: Kohei Enju <enju.kohei@fujitsu.com>
> ---
>  arch/arm64/include/asm/kvm_rmi.h |  2 ++
>  arch/arm64/kvm/rmi.c             | 44 +++++++++++++++++++++++++++++++-
>  drivers/firmware/arm_rmm/rmi.c   |  4 +++

(mainly for this)
>  include/linux/misc_cgroup.h      |  4 +++
>  kernel/cgroup/misc.c             |  4 +++
>  5 files changed, 57 insertions(+), 1 deletion(-)

Conditional
Acked-by: Michal Koutný <mkoutny@suse.com>
(it makes sense along the other arches' miscresurces)

Why? I see this [1] (or followup) needs to be added first.

Thanks,
Michal

[1] https://lore.kernel.org/r/20260715142739.80398-4-steven.price@arm.com/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 265 bytes --]