Re: [PATCH 04/11] KVM: arm64: CCA: Check for LPA2 support and SHA-256

[Steven Price]

On 03/11/2026 11:47, Suzuki K Poulose wrote:
> Hi Steven
> 
> On 02/11/2026 14:12, Steven Price wrote:
>> If KVM has enabled LPA2 support then check that the RMM also supports
>> it. If there is a mismatch then disable support for realm guests as the
>> VMM may attempt to create a guest which is incompatible with the RMM.
>>
>> Also check for SHA-256 support in the RMM as to begin with we only
>> support SHA-256 based measurements. This can be relaxed in the future.
> 
> 
> This could be merged with the patch 3.

Makes sense.

> 
>>
>> Reviewed-by: Suzuki K Poulose <suzuki.poulose@xxxxxxx>
>> Signed-off-by: Steven Price <steven.price@xxxxxxx>
> 
> 
>> ---
>>   arch/arm64/kvm/rmi.c | 25 +++++++++++++++++++++++++
>>   1 file changed, 25 insertions(+)
>>
>> diff --git a/arch/arm64/kvm/rmi.c b/arch/arm64/kvm/rmi.c
>> index 9d118768550d..5b07beff8bc9 100644
>> --- a/arch/arm64/kvm/rmi.c
>> +++ b/arch/arm64/kvm/rmi.c
>> @@ -6,8 +6,30 @@
>>   #include <linux/arm-rmi-cmds.h>
>>   #include <linux/kvm_host.h>
>>   +#include <asm/kvm_pgtable.h>
>>   #include <asm/virt.h>
>>   +static bool rmi_has_feature(int reg, unsigned long feature)
>> +{
>> +    return !!u64_get_bits(rmi_feat_reg(reg), feature);
>> +}
>> +
> 
> minor nit: Do we see this useful for others (e.g., DA) ? May be we could
> move this to the include/linux/arm-rmi-cmds.h ?
> 
> May be we could even make the above a macro, something like
> 
> 
> #define rmi_has_feature(reg, feat)
>     u64_get_bits(rmi_feat_reg(reg), RMI_FEATURE_REGISTER_#reg _#feat)
> 

Sashiko pointed out that my use of u64_get_bits() is problematic. So
I'll fix that up and more it to the header file.

Thanks,
Steve

> 
> Cheers
> Suzuki
> 
>> +static int rmm_check_features(void)
>> +{
>> +    if (kvm_lpa2_is_enabled() &&
>> +        !rmi_has_feature(0, RMI_FEATURE_REGISTER_0_LPA2)) {
>> +        kvm_err("RMM doesn't support LPA2\n");
>> +        return -ENXIO;
>> +    }
>> +
>> +    if (!rmi_has_feature(1, RMI_FEATURE_REGISTER_1_HASH_SHA_256)) {
>> +        kvm_err("RMM doesn't support SHA-256 measurements\n");
>> +        return -ENXIO;
>> +    }
>> +
>> +    return 0;
>> +}
>> +
>>   void kvm_init_rmi(void)
>>   {
>>       if (kvm_get_mode() != KVM_MODE_RMM)
>> @@ -16,5 +38,8 @@ void kvm_init_rmi(void)
>>       if (!is_rmi_available())
>>           return;
>>   +    if (rmm_check_features())
>> +        return;
>> +
>>       /* Future patch will enable static branch kvm_rmi_is_available */
>>   }
>