Enforce host page-size alignment for shared buffers

When running private-memory guests, the guest kernel must apply additional constraints when allocating buffers that are shared with the hypervisor.

These shared buffers are also accessed by the host kernel and therefore must be aligned to the host’s page size, and have a size that is a multiple of the host page size.

On non-secure hosts, set_guest_memory_attributes() tracks memory at the host PAGE_SIZE granularity. This creates a mismatch when the guest applies attributes at 4K boundaries while the host uses 64K pages. In such cases, set_guest_memory_attributes() call returns -EINVAL, preventing the conversion of memory regions from private to shared.

Architectures such as Arm can tolerate realm physical address space (protected memory) PFNs being mapped as shared memory, as incorrect accesses are detected and reported as GPC faults. However, relying on this mechanism is unsafe and can still lead to kernel crashes.

This is particularly likely when guest_memfd allocations are mmapped and accessed from userspace. Once exposed to userspace, we cannot guarantee that applications will only access the intended 4K shared region rather than the full 64K page mapped into their address space. Such userspace addresses may also be passed back into the kernel and accessed via the linear map, resulting in a GPC fault and a kernel crash.

With CCA, although Stage-2 mappings managed by the RMM still operate at a 4K granularity, shared pages must nonetheless be aligned to the host-managed page size and sized as whole host pages to avoid the issues described above.

Introduce a new helper, mem_decrypt_align(), to allow callers to enforce the required alignment and size constraints for shared buffers.

The architecture-specific implementation of mem_decrypt_align() will be provided in a follow-up patch.

Note on restricted-dma-pool:
rmem_swiotlb_device_init() uses reserved-memory regions described by firmware. Those regions are not changed in-kernel to satisfy host granule alignment. This is intentional: we do not expect restricted-dma-pool allocations to be used with CCA. If restricted-dma-pool is intended for CCA shared use, firmware must provide base/size aligned to the host IPA-change granule.

Signed-off-by Aneesh Kumar K.V (Arm) <[email protected]>

---
 arch/arm64/mm/mem_encrypt.c      | 19 +++++++++++++++----
 drivers/irqchip/irq-gic-v3-its.c | 20 +++++++++++++-------
 include/linux/mem_encrypt.h      | 14 ++++++++++++++
 kernel/dma/contiguous.c          | 10 ++++++++++
 kernel/dma/direct.c              | 16 ++++++++++++++--
 kernel/dma/pool.c                |  4 +++-
 kernel/dma/swiotlb.c             | 21 +++++++++++++--------
 7 files changed, 82 insertions(+), 22 deletions(-)

drivers/irqchip/irq-gic-v3-its.c +7 -3

index 291d7668cc8d..239d7e3bc16f 100644
@@ -213,16 +213,17 @@ static gfp_t gfp_flags_quirk;
 static struct page *its_alloc_pages_node(int node, gfp_t gfp,
 					 unsigned int order)
 {
+	unsigned int new_order;
 	struct page *page;
 	int ret = 0;
 
-	page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
-
+	new_order = get_order(mem_decrypt_align((PAGE_SIZE << order)));
+	page = alloc_pages_node(node, gfp | gfp_flags_quirk, new_order);
 	if (!page)
 		return NULL;
 
 	ret = set_memory_decrypted((unsigned long)page_address(page),
-				   1 << order);
+				   1 << new_order);
 	/*
 	 * If set_memory_decrypted() fails then we don't know what state the
 	 * page is in, so we can't free it. Instead we leak it.

@@ -241,13 +242,16 @@ static struct page *its_alloc_pages(gfp_t gfp, unsigned int order)
 
 static void its_free_pages(void *addr, unsigned int order)
 {
+	int new_order;
+
+	new_order = get_order(mem_decrypt_align((PAGE_SIZE << order)));
 	/*

Quoted 4 lines

With CCA, although Stage-2 mappings managed by the RMM still operate at a 4K granularity, shared pages must nonetheless be aligned to the host-managed page size and sized as whole host pages to avoid the issues described above.

I thought that was being fixed, and that there was now a strong guarantee that RMM and host are aligned on the page size.

Even more, S2 is totally irrelevant here. The only thing that matters is the host page size vs the guest page size. Nothing else.

Quoted 26 lines · Aneesh Kumar K.V (Arm)

When running private-memory guests, the guest kernel must apply additional constraints when allocating buffers that are shared with the hypervisor.

These shared buffers are also accessed by the host kernel and therefore must be aligned to the host’s page size, and have a size that is a multiple of the host page size.

On non-secure hosts, set_guest_memory_attributes() tracks memory at the host PAGE_SIZE granularity. This creates a mismatch when the guest applies attributes at 4K boundaries while the host uses 64K pages. In such cases, set_guest_memory_attributes() call returns -EINVAL, preventing the conversion of memory regions from private to shared.

Architectures such as Arm can tolerate realm physical address space (protected memory) PFNs being mapped as shared memory, as incorrect accesses are detected and reported as GPC faults. However, relying on this mechanism is unsafe and can still lead to kernel crashes.

This is particularly likely when guest_memfd allocations are mmapped and accessed from userspace. Once exposed to userspace, we cannot guarantee that applications will only access the intended 4K shared region rather than the full 64K page mapped into their address space. Such userspace addresses may also be passed back into the kernel and accessed via the linear map, resulting in a GPC fault and a kernel crash.

Quoted 4 lines

With CCA, although Stage-2 mappings managed by the RMM still operate at a 4K granularity, shared pages must nonetheless be aligned to the host-managed page size and sized as whole host pages to avoid the issues described above.

I thought that was being fixed, and that there was now a strong guarantee that RMM and host are aligned on the page size. Even more, S2 is totally irrelevant here. The only thing that matters is the host page size vs the guest page size. Nothing else.

Quoted 27 lines

Introduce a new helper, mem_decrypt_align(), to allow callers to enforce the required alignment and size constraints for shared buffers.

The architecture-specific implementation of mem_decrypt_align() will be provided in a follow-up patch.

Note on restricted-dma-pool:
rmem_swiotlb_device_init() uses reserved-memory regions described by firmware. Those regions are not changed in-kernel to satisfy host granule alignment. This is intentional: we do not expect restricted-dma-pool allocations to be used with CCA. If restricted-dma-pool is intended for CCA shared use, firmware must provide base/size aligned to the host IPA-change granule.

Signed-off-by Aneesh Kumar K.V (Arm) <[email protected]>

---
 arch/arm64/mm/mem_encrypt.c      | 19 +++++++++++++++----
 drivers/irqchip/irq-gic-v3-its.c | 20 +++++++++++++-------
 include/linux/mem_encrypt.h      | 14 ++++++++++++++
 kernel/dma/contiguous.c          | 10 ++++++++++
 kernel/dma/direct.c              | 16 ++++++++++++++--
 kernel/dma/pool.c                |  4 +++-
 kernel/dma/swiotlb.c             | 21 +++++++++++++--------
 7 files changed, 82 insertions(+), 22 deletions(-)

[...]

Quoted 33 lines

drivers/irqchip/irq-gic-v3-its.c +7 -3

index 291d7668cc8d..239d7e3bc16f 100644
@@ -213,16 +213,17 @@ static gfp_t gfp_flags_quirk;
 static struct page *its_alloc_pages_node(int node, gfp_t gfp,
 					 unsigned int order)
 {
+	unsigned int new_order;
 	struct page *page;
 	int ret = 0;
 
-	page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
-
+	new_order = get_order(mem_decrypt_align((PAGE_SIZE << order)));
+	page = alloc_pages_node(node, gfp | gfp_flags_quirk, new_order);
 	if (!page)
 		return NULL;
 
 	ret = set_memory_decrypted((unsigned long)page_address(page),
-				   1 << order);
+				   1 << new_order);
 	/*
 	 * If set_memory_decrypted() fails then we don't know what state the
 	 * page is in, so we can't free it. Instead we leak it.

@@ -241,13 +242,16 @@ static struct page *its_alloc_pages(gfp_t gfp, unsigned int order)
 
 static void its_free_pages(void *addr, unsigned int order)
 {
+	int new_order;
+
+	new_order = get_order(mem_decrypt_align((PAGE_SIZE << order)));
 	/*

drivers/irqchip/irq-gic-v3-its.c static struct page *its_alloc_pages(gfp_t gfp, unsigned int order) · line 256

Quoted 10 lines

drivers/irqchip/irq-gic-v3-its.c +2 -2

 	 * If the memory cannot be encrypted again then we must leak the pages.
 	 * set_memory_encrypted() will already have WARNed.
 	 */
-	if (set_memory_encrypted((unsigned long)addr, 1 << order))
+	if (set_memory_encrypted((unsigned long)addr, 1 << new_order))
 		return;
-	free_pages((unsigned long)addr, order);
+	free_pages((unsigned long)addr, new_order);
 }
 

Here's the non-obfuscated version of the two hunks above (and let it be on the record that New Order is a terrible, overrated band):

drivers/irqchip/irq-gic-v3-its.c +1 -0

index 291d7668cc8da..a4d555aaee241 100644
@@ -216,6 +216,7 @@ static struct page *its_alloc_pages_node(int node, gfp_t gfp,
 	struct page *page;
 	int ret = 0;
 
+	order = get_order(mem_decrypt_align(PAGE_SIZE << order));
 	page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
 
 	if (!page)

drivers/irqchip/irq-gic-v3-its.c static void *itt_alloc_pool(int node, int size) · line 276

Quoted 8 lines

drivers/irqchip/irq-gic-v3-its.c +2 -1

 static struct gen_pool *itt_pool;

@@ -268,11 +272,13 @@ static void *itt_alloc_pool(int node, int size)
 		if (addr)
 			break;
 
-		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, 0);
+		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO,
+					    get_order(mem_decrypt_granule_size()));

You already taught its_alloc_pages_node() about the decrypt granule size stuff. I don't think we need to see more of it (and you don't mess with the call that is just above it).

Quoted 3 lines

drivers/irqchip/irq-gic-v3-its.c +0 -0

 		if (!page)
 			break;
 

drivers/irqchip/irq-gic-v3-its.c static void *itt_alloc_pool(int node, int size) · line 281

Quoted 3 lines

drivers/irqchip/irq-gic-v3-its.c +2 -1

-		gen_pool_add(itt_pool, (unsigned long)page_address(page), PAGE_SIZE, node);
+		gen_pool_add(itt_pool, (unsigned long)page_address(page),
+			     mem_decrypt_granule_size(), node);

I'd rather see something like mem_decrypt_align(PAGE_SIZE), which keeps the intent clear.

Quoted 33 lines · Marc Zyngier

Quoted 26 lines · Aneesh Kumar K.V (Arm)

When running private-memory guests, the guest kernel must apply additional constraints when allocating buffers that are shared with the hypervisor.

These shared buffers are also accessed by the host kernel and therefore must be aligned to the host’s page size, and have a size that is a multiple of the host page size.

On non-secure hosts, set_guest_memory_attributes() tracks memory at the host PAGE_SIZE granularity. This creates a mismatch when the guest applies attributes at 4K boundaries while the host uses 64K pages. In such cases, set_guest_memory_attributes() call returns -EINVAL, preventing the conversion of memory regions from private to shared.

Architectures such as Arm can tolerate realm physical address space (protected memory) PFNs being mapped as shared memory, as incorrect accesses are detected and reported as GPC faults. However, relying on this mechanism is unsafe and can still lead to kernel crashes.

This is particularly likely when guest_memfd allocations are mmapped and accessed from userspace. Once exposed to userspace, we cannot guarantee that applications will only access the intended 4K shared region rather than the full 64K page mapped into their address space. Such userspace addresses may also be passed back into the kernel and accessed via the linear map, resulting in a GPC fault and a kernel crash.

Quoted 4 lines

With CCA, although Stage-2 mappings managed by the RMM still operate at a 4K granularity, shared pages must nonetheless be aligned to the host-managed page size and sized as whole host pages to avoid the issues described above.

Quoted 5 lines

I thought that was being fixed, and that there was now a strong guarantee that RMM and host are aligned on the page size. Even more, S2 is totally irrelevant here. The only thing that matters is the host page size vs the guest page size. Nothing else.

Yes, the latest RMM update includes the ability to change the granule size.

The section above in the commit message was intended to explain that the S2 mapping size is irrelevant. I agree it is not clear as written, so I will reword it to improve clarity.

Quoted 16 lines

Review static void *itt_alloc_pool(int node, int size) · line 276

Quoted 8 lines

static struct gen_pool *itt_pool;

(quoted diff) +2 -1

@@ -268,11 +272,13 @@ static void *itt_alloc_pool(int node, int size)
 		if (addr)
 			break;
 
-		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, 0);
+		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO,
+					    get_order(mem_decrypt_granule_size()));

You already taught its_alloc_pages_node() about the decrypt granule size stuff. I don't think we need to see more of it (and you don't mess with the call that is just above it).

Quoted 3 lines

(quoted diff) +0 -0

 		if (!page)
 			break;
 

Quoted 7 lines

Review static void *itt_alloc_pool(int node, int size) · line 281

Quoted 3 lines

(quoted diff) +2 -1

-		gen_pool_add(itt_pool, (unsigned long)page_address(page), PAGE_SIZE, node);
+		gen_pool_add(itt_pool, (unsigned long)page_address(page),
+			     mem_decrypt_granule_size(), node);

I'd rather see something like mem_decrypt_align(PAGE_SIZE), which keeps the intent clear.

The helper was added based on feedback from a previous version. I assume you are suggesting that only this caller should switch?

When running private-memory guests, the guest kernel must apply additional constraints when allocating buffers that are shared with the hypervisor.

arch/arm64/mm/mem_encrypt.c +8 -2

@@ -33,18 +32,30 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops)
 
 int set_memory_encrypted(unsigned long addr, int numpages)
 {
-	if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr)))
+	if (likely(!crypt_ops))
 		return 0;
 
+	if (WARN_ON(!IS_ALIGNED(addr, mem_decrypt_granule_size())))
+		return -EINVAL;
+
+	if (WARN_ON(!IS_ALIGNED(numpages << PAGE_SHIFT, mem_decrypt_granule_size())))
+		return -EINVAL;
+
 	return crypt_ops->encrypt(addr, numpages);
 }
 EXPORT_SYMBOL_GPL(set_memory_encrypted);
 
 int set_memory_decrypted(unsigned long addr, int numpages)
 {
-	if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr)))
+	if (likely(!crypt_ops))
 		return 0;

include/linux/mem_encrypt.h +7 -0

index 07584c5e36fb..1e01c9ac697f 100644
@@ -11,6 +11,8 @@
 #define __MEM_ENCRYPT_H__
 
 #ifndef __ASSEMBLY__
+#include <linux/align.h>
+#include <vdso/page.h>
 
 #ifdef CONFIG_ARCH_HAS_MEM_ENCRYPT
 

@@ -54,6 +56,18 @@
 #define dma_addr_canonical(x)		(x)
 #endif
 
+#ifndef mem_decrypt_granule_size
+static inline size_t mem_decrypt_granule_size(void)
+{
+	return PAGE_SIZE;
+}

Quoted 2 lines · Aneesh Kumar K.V (Arm)

When running private-memory guests, the guest kernel must apply additional constraints when allocating buffers that are shared with the hypervisor.

This patch has way too much stuff in it.

I think your patch structure should be changed around

1) Patch to add mem_decrypt_granule_size(), and explain it as the alignment & size of what can be passed to set_memory_encrypted/decrypted()

2) Add support for mem_decrypt_granule_size() to ARM

Then patches going caller by caller of set_memory_decrypted() to make them follow the new rule:

3) its

4) swiotlb

3) dma_alloc_coherent

etc.

don't forget about the new dma buf heaps too:

drivers/dma-buf/heaps/system_heap.c: ret = set_memory_decrypted(addr, nr_pages);

It is worth calling out in the cover letter that all the ARM CCA relevant places are fixed but drivers/hv/ is left for future.

Quoted 23 lines

arch/arm64/mm/mem_encrypt.c +8 -2

@@ -33,18 +32,30 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops)
 
 int set_memory_encrypted(unsigned long addr, int numpages)
 {
-	if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr)))
+	if (likely(!crypt_ops))
 		return 0;
 
+	if (WARN_ON(!IS_ALIGNED(addr, mem_decrypt_granule_size())))
+		return -EINVAL;
+
+	if (WARN_ON(!IS_ALIGNED(numpages << PAGE_SHIFT, mem_decrypt_granule_size())))
+		return -EINVAL;
+
 	return crypt_ops->encrypt(addr, numpages);
 }
 EXPORT_SYMBOL_GPL(set_memory_encrypted);
 
 int set_memory_decrypted(unsigned long addr, int numpages)
 {
-	if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr)))
+	if (likely(!crypt_ops))
 		return 0;

arch/arm64/mm/mem_encrypt.c int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops) · line 61

Quoted 10 lines

arch/arm64/mm/mem_encrypt.c +6 -0

 
+	if (WARN_ON(!IS_ALIGNED(addr, mem_decrypt_granule_size())))
+		return -EINVAL;
+
+	if (WARN_ON(!IS_ALIGNED(numpages << PAGE_SHIFT, mem_decrypt_granule_size())))
+		return -EINVAL;
+
 	return crypt_ops->decrypt(addr, numpages);
 }
 EXPORT_SYMBOL_GPL(set_memory_decrypted);

This should go in the ARM patch adding mem_decrypt_granule_size() to CCA

Quoted 31 lines

include/linux/mem_encrypt.h +14 -0

index 07584c5e36fb..1e01c9ac697f 100644
@@ -11,6 +11,8 @@
 #define __MEM_ENCRYPT_H__
 
 #ifndef __ASSEMBLY__
+#include <linux/align.h>
+#include <vdso/page.h>
 
 #ifdef CONFIG_ARCH_HAS_MEM_ENCRYPT
 

@@ -54,6 +56,18 @@
 #define dma_addr_canonical(x)		(x)
 #endif
 
+#ifndef mem_decrypt_granule_size
+static inline size_t mem_decrypt_granule_size(void)
+{
+	return PAGE_SIZE;
+}
+#endif
+
+static inline size_t mem_decrypt_align(size_t size)
+{
+	return ALIGN(size, mem_decrypt_granule_size());
+}
+
 #endif	/* __ASSEMBLY__ */
 

include/linux/mem_encrypt.h line 73

Quoted 1 line

include/linux/mem_encrypt.h +0 -0

 #endif	/* __MEM_ENCRYPT_H__ */

I know it seems a bit small, but put this in its own patch and explain how it works. I'd also like to see a kdoc here, and add a kdoc to set_memory_decrypted() that links back so people have a better chance to know about this.

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

Expose that alignment through realm_get_hyp_pagesize() and mem_decrypt_granule_size() so shared-buffer allocation and encryption/decryption paths can honor the ipa change page-size requirement.

If the host reports an invalid alignment (when alginment value is not multiple of 4K), do not enable Realm support.

This provides the host alignment information required by the shared buffer alignment changes.

Signed-off-by Aneesh Kumar K.V (Arm) <[email protected]>

---
 arch/arm64/include/asm/mem_encrypt.h |  3 ++
 arch/arm64/include/asm/rhi.h         | 24 +++++++++++++
 arch/arm64/include/asm/rsi.h         |  2 ++
 arch/arm64/include/asm/rsi_cmds.h    | 10 ++++++
 arch/arm64/include/asm/rsi_smc.h     |  7 ++++
 arch/arm64/kernel/Makefile           |  2 +-
 arch/arm64/kernel/rhi.c              | 54 ++++++++++++++++++++++++++++
 arch/arm64/kernel/rsi.c              | 13 +++++++
 arch/arm64/mm/mem_encrypt.c          |  8 +++++
 9 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100644 arch/arm64/include/asm/rhi.h
 create mode 100644 arch/arm64/kernel/rhi.c

arch/arm64/include/asm/mem_encrypt.h +3 -0

index 314b2b52025f..5541911eb028 100644
@@ -16,6 +16,9 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops);
 int set_memory_encrypted(unsigned long addr, int numpages);
 int set_memory_decrypted(unsigned long addr, int numpages);
 
+#define mem_decrypt_granule_size mem_decrypt_granule_size
+size_t mem_decrypt_granule_size(void);
+
 int realm_register_memory_enc_ops(void);
 
 static inline bool force_dma_unencrypted(struct device *dev)

arch/arm64/include/asm/rhi.h new file +24 -0

new file mode 100644
index 000000000000..0895dd92ea1d
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2026 ARM Ltd.
+ */
+
+#ifndef __ASM_RHI_H_
+#define __ASM_RHI_H_
+
+#include <linux/types.h>
+
+#define SMC_RHI_CALL(func)				\
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,		\
+			   ARM_SMCCC_SMC_64,		\
+			   ARM_SMCCC_OWNER_STANDARD_HYP,\
+			   (func))
+
+unsigned long rhi_get_ipa_change_alignment(void);
+#define RHI_HOSTCONF_VER_1_0		0x10000
+#define RHI_HOSTCONF_VERSION		SMC_RHI_CALL(0x004E)
+
+#define __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT BIT(0)
+#define RHI_HOSTCONF_FEATURES		SMC_RHI_CALL(0x004F)
+#define RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT	SMC_RHI_CALL(0x0050)
+#endif

arch/arm64/include/asm/rsi.h +2 -0

index 88b50d660e85..ae54fb3b1429 100644
@@ -67,4 +67,6 @@ static inline int rsi_set_memory_range_shared(phys_addr_t start,
 	return rsi_set_memory_range(start, end, RSI_RIPAS_EMPTY,
 				    RSI_CHANGE_DESTROYED);
 }
+
+unsigned long realm_get_hyp_pagesize(void);
 #endif /* __ASM_RSI_H_ */

arch/arm64/include/asm/rsi_cmds.h +0 -0

index 2c8763876dfb..a341ce0eeda1 100644

arch/arm64/include/asm/rsi_cmds.h +4 -0

+
+	return res.a0;
+}
+
 #endif /* __ASM_RSI_CMDS_H */

arch/arm64/include/asm/rsi_smc.h +7 -0

index e19253f96c94..9ee8b5c7612e 100644
@@ -182,6 +182,13 @@ struct realm_config {
  */
 #define SMC_RSI_IPA_STATE_GET			SMC_RSI_FID(0x198)
 
+struct rsi_host_call {
+	union {
+		u16 imm;
+		u64 padding0;
+	};
+	u64 gprs[31];
+} __aligned(0x100);
 /*
  * Make a Host call.
  *

arch/arm64/kernel/Makefile +1 -1

index fe627100d199..3e72dd9584ed 100644
@@ -34,7 +34,7 @@ obj-y			:= debug-monitors.o entry.o irq.o fpsimd.o		\
 			   cpufeature.o alternative.o cacheinfo.o		\
 			   smp.o smp_spin_table.o topology.o smccc-call.o	\
 			   syscall.o proton-pack.o idle.o patching.o pi/	\
-			   rsi.o jump_label.o
+			   rsi.o jump_label.o rhi.o
 
 obj-$(CONFIG_COMPAT)			+= sys32.o signal32.o			\
 					   sys_compat.o

arch/arm64/kernel/rhi.c new file +1 -0

new file mode 100644
index 000000000000..7cd6c5102464
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only

arch/arm64/kernel/rhi.c new file +33 -0

+unsigned long rhi_get_ipa_change_alignment(void)
+{
+	long ret;
+	unsigned long ipa_change_align;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_VERSION;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (hyp_pagesize_rhicall.gprs[0] != RHI_HOSTCONF_VER_1_0)
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_FEATURES;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (!(hyp_pagesize_rhicall.gprs[0] & __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT))
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	ipa_change_align = hyp_pagesize_rhicall.gprs[0];
+	/* This error needs special handling in the caller */
+	if (ipa_change_align & (SZ_4K - 1))
+		return 0;

arch/arm64/kernel/rsi.c +2 -0

index 9e846ce4ef9c..ff735c04e236 100644
@@ -14,8 +14,10 @@
 #include <asm/mem_encrypt.h>
 #include <asm/pgtable.h>
 #include <asm/rsi.h>
+#include <asm/rhi.h>
 
 static struct realm_config config;
+static unsigned long ipa_change_alignment = PAGE_SIZE;
 
 unsigned long prot_ns_shared;
 EXPORT_SYMBOL(prot_ns_shared);

arch/arm64/kernel/rsi.c +1 -0

+
 	prot_ns_shared = __phys_to_pte_val(BIT(config.ipa_bits - 1));
 
 	if (arm64_ioremap_prot_hook_register(realm_ioremap_hook))

arch/arm64/mm/mem_encrypt.c +0 -0

index 38c62c9e4e74..f5d64bc29c20 100644

Quoted 5 lines · Aneesh Kumar K.V (Arm)

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

I don't understand what "IPA-change" means. What you are after is the host's sharing granule size.

Quoted 90 lines

Expose that alignment through realm_get_hyp_pagesize() and mem_decrypt_granule_size() so shared-buffer allocation and encryption/decryption paths can honor the ipa change page-size requirement.

If the host reports an invalid alignment (when alginment value is not multiple of 4K), do not enable Realm support.

This provides the host alignment information required by the shared buffer alignment changes.

Signed-off-by Aneesh Kumar K.V (Arm) <[email protected]>

---
 arch/arm64/include/asm/mem_encrypt.h |  3 ++
 arch/arm64/include/asm/rhi.h         | 24 +++++++++++++
 arch/arm64/include/asm/rsi.h         |  2 ++
 arch/arm64/include/asm/rsi_cmds.h    | 10 ++++++
 arch/arm64/include/asm/rsi_smc.h     |  7 ++++
 arch/arm64/kernel/Makefile           |  2 +-
 arch/arm64/kernel/rhi.c              | 54 ++++++++++++++++++++++++++++
 arch/arm64/kernel/rsi.c              | 13 +++++++
 arch/arm64/mm/mem_encrypt.c          |  8 +++++
 9 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100644 arch/arm64/include/asm/rhi.h
 create mode 100644 arch/arm64/kernel/rhi.c

arch/arm64/include/asm/mem_encrypt.h +3 -0

index 314b2b52025f..5541911eb028 100644
@@ -16,6 +16,9 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops);
 int set_memory_encrypted(unsigned long addr, int numpages);
 int set_memory_decrypted(unsigned long addr, int numpages);
 
+#define mem_decrypt_granule_size mem_decrypt_granule_size
+size_t mem_decrypt_granule_size(void);
+
 int realm_register_memory_enc_ops(void);
 
 static inline bool force_dma_unencrypted(struct device *dev)

arch/arm64/include/asm/rhi.h new file +24 -0

new file mode 100644
index 000000000000..0895dd92ea1d
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2026 ARM Ltd.
+ */
+
+#ifndef __ASM_RHI_H_
+#define __ASM_RHI_H_
+
+#include <linux/types.h>
+
+#define SMC_RHI_CALL(func)				\
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,		\
+			   ARM_SMCCC_SMC_64,		\
+			   ARM_SMCCC_OWNER_STANDARD_HYP,\
+			   (func))
+
+unsigned long rhi_get_ipa_change_alignment(void);
+#define RHI_HOSTCONF_VER_1_0		0x10000
+#define RHI_HOSTCONF_VERSION		SMC_RHI_CALL(0x004E)
+
+#define __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT BIT(0)
+#define RHI_HOSTCONF_FEATURES		SMC_RHI_CALL(0x004F)
+#define RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT	SMC_RHI_CALL(0x0050)
+#endif

arch/arm64/include/asm/rsi.h +2 -0

index 88b50d660e85..ae54fb3b1429 100644
@@ -67,4 +67,6 @@ static inline int rsi_set_memory_range_shared(phys_addr_t start,
 	return rsi_set_memory_range(start, end, RSI_RIPAS_EMPTY,
 				    RSI_CHANGE_DESTROYED);
 }
+
+unsigned long realm_get_hyp_pagesize(void);
 #endif /* __ASM_RSI_H_ */

arch/arm64/include/asm/rsi_cmds.h +0 -0

index 2c8763876dfb..a341ce0eeda1 100644
@@ -159,4 +159,14 @@ static inline unsigned long rsi_attestation_token_continue(phys_addr_t granule,
 	return res.a0;
 }
 

arch/arm64/include/asm/rsi_cmds.h static inline unsigned long rsi_attestation_token_continue(phys_addr_t granule, · line 167

Quoted 6 lines

arch/arm64/include/asm/rsi_cmds.h +6 -0

+static inline unsigned long rsi_host_call(struct rsi_host_call *rhi_call)
+{
+	phys_addr_t addr = virt_to_phys(rhi_call);
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_invoke(SMC_RSI_HOST_CALL, addr, &res);

Errr... What guarantees that *rhi_call is *IPA contiguous*? This is incredibly fragile. You should at the very least check that this isn't vmalloc'd.

Quoted 48 lines

arch/arm64/include/asm/rsi_cmds.h +4 -0

+
+	return res.a0;
+}
+
 #endif /* __ASM_RSI_CMDS_H */

arch/arm64/include/asm/rsi_smc.h +7 -0

index e19253f96c94..9ee8b5c7612e 100644
@@ -182,6 +182,13 @@ struct realm_config {
  */
 #define SMC_RSI_IPA_STATE_GET			SMC_RSI_FID(0x198)
 
+struct rsi_host_call {
+	union {
+		u16 imm;
+		u64 padding0;
+	};
+	u64 gprs[31];
+} __aligned(0x100);
 /*
  * Make a Host call.
  *

arch/arm64/kernel/Makefile +1 -1

index fe627100d199..3e72dd9584ed 100644
@@ -34,7 +34,7 @@ obj-y			:= debug-monitors.o entry.o irq.o fpsimd.o		\
 			   cpufeature.o alternative.o cacheinfo.o		\
 			   smp.o smp_spin_table.o topology.o smccc-call.o	\
 			   syscall.o proton-pack.o idle.o patching.o pi/	\
-			   rsi.o jump_label.o
+			   rsi.o jump_label.o rhi.o
 
 obj-$(CONFIG_COMPAT)			+= sys32.o signal32.o			\
 					   sys_compat.o

arch/arm64/kernel/rhi.c new file +6 -0

new file mode 100644
index 000000000000..7cd6c5102464
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026 ARM Ltd.
+ */
+
+#include <linux/mm.h>

arch/arm64/kernel/rhi.c line 11

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+#include <asm/rsi.h>
+#include <asm/rhi.h>
+
+/* we need an aligned rhicall for rsi_host_call. slab is not yet ready */
+static struct rsi_host_call hyp_pagesize_rhicall;

Why the "hyp_" prefix? This has absolutely nothing to with the hypervisor.

Quoted 38 lines

arch/arm64/kernel/rhi.c new file +38 -0

+unsigned long rhi_get_ipa_change_alignment(void)
+{
+	long ret;
+	unsigned long ipa_change_align;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_VERSION;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (hyp_pagesize_rhicall.gprs[0] != RHI_HOSTCONF_VER_1_0)
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_FEATURES;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (!(hyp_pagesize_rhicall.gprs[0] & __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT))
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	ipa_change_align = hyp_pagesize_rhicall.gprs[0];
+	/* This error needs special handling in the caller */
+	if (ipa_change_align & (SZ_4K - 1))
+		return 0;
+
+	return ipa_change_align;
+
+err_out:
+	/*

arch/arm64/kernel/rhi.c line 54

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+	 * For failure condition assume host is built with 4K page size
+	 * and hence ipa change alignment can be guest PAGE_SIZE.
+	 */
+	return PAGE_SIZE;
+}

Why can't this be part of rsi.c? This is an RSI call, and it should be part of the RSI initialisation.

Quoted 16 lines

arch/arm64/kernel/rsi.c +2 -0

index 9e846ce4ef9c..ff735c04e236 100644
@@ -14,8 +14,10 @@
 #include <asm/mem_encrypt.h>
 #include <asm/pgtable.h>
 #include <asm/rsi.h>
+#include <asm/rhi.h>
 
 static struct realm_config config;
+static unsigned long ipa_change_alignment = PAGE_SIZE;
 
 unsigned long prot_ns_shared;
 EXPORT_SYMBOL(prot_ns_shared);

arch/arm64/kernel/rsi.c static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot) · line 147

Quoted 7 lines

arch/arm64/kernel/rsi.c +4 -0

@@ -139,6 +141,11 @@ static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot)
 	return 0;
 }
 
+unsigned long realm_get_hyp_pagesize(void)
+{
+	return ipa_change_alignment;
+}

Again, this has nothing to do with the hypervisor, but the host. And ipa_change_alignment is still a wording I can't wrap my small head around.

arch/arm64/kernel/rsi.c void __init arm64_rsi_init(void) · line 161

Quoted 13 lines

arch/arm64/kernel/rsi.c +6 -0

+
 void __init arm64_rsi_init(void)
 {
 	if (arm_smccc_1_1_get_conduit() != SMCCC_CONDUIT_SMC)

@@ -147,6 +154,12 @@ void __init arm64_rsi_init(void)
 		return;
 	if (WARN_ON(rsi_get_realm_config(&config)))
 		return;
+
+	ipa_change_alignment = rhi_get_ipa_change_alignment();
+	/* If we don't get a correct alignment response, don't enable realm */
+	if (!ipa_change_alignment)
+		return;

But at the same time, you override a global value with an error, and then paper over it in mem_decrypt_granule_size()...

Quoted 13 lines

arch/arm64/kernel/rsi.c +1 -0

+
 	prot_ns_shared = __phys_to_pte_val(BIT(config.ipa_bits - 1));
 
 	if (arm64_ioremap_prot_hook_register(realm_ioremap_hook))

arch/arm64/mm/mem_encrypt.c +0 -0

index 38c62c9e4e74..f5d64bc29c20 100644
@@ -59,3 +59,11 @@ int set_memory_decrypted(unsigned long addr, int numpages)
 	return crypt_ops->decrypt(addr, numpages);
 }
 EXPORT_SYMBOL_GPL(set_memory_decrypted);

arch/arm64/mm/mem_encrypt.c int set_memory_decrypted(unsigned long addr, int numpages) · line 66

Quoted 5 lines

arch/arm64/mm/mem_encrypt.c +5 -0

+
+size_t mem_decrypt_granule_size(void)
+{
+	if (is_realm_world())
+		return max(PAGE_SIZE, realm_get_hyp_pagesize());

If you didn't mess with ipa_change_alignment above, you shouldn't need this max().

Quoted 8 lines · Marc Zyngier

Quoted 5 lines · Aneesh Kumar K.V (Arm)

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

Quoted 3 lines

I don't understand what "IPA-change" means. What you are after is the host's sharing granule size.

This is part of the RHI specification, and the call is named RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT. The intent is to determine the alignment requirements for changing IPA attributes (protected vs. unprotected IPA

Quoted 11 lines

arch/arm64/include/asm/rsi_cmds.h static inline unsigned long rsi_attestation_token_continue(phys_addr_t granule, · line 167

Quoted 6 lines

arch/arm64/include/asm/rsi_cmds.h +6 -0

+static inline unsigned long rsi_host_call(struct rsi_host_call *rhi_call)
+{
+	phys_addr_t addr = virt_to_phys(rhi_call);
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_invoke(SMC_RSI_HOST_CALL, addr, &res);

Errr... What guarantees that *rhi_call is *IPA contiguous*? This is incredibly fragile. You should at the very least check that this isn't vmalloc'd.

I didn’t quite follow that. We have other RSI calls (even RMI calls) that do similar things, and the caller understands that the address should be IPA-contiguous.

Are you suggesting that all RSI calls should
add checks for this?. or are you suggesting to update the API to

unsigned long rsi_host_call(unsigned long rhi_call_phys) ?

Quoted 49 lines

Quoted 49 lines

arch/arm64/include/asm/rsi_cmds.h +4 -0

+
+	return res.a0;
+}
+
 #endif /* __ASM_RSI_CMDS_H */

arch/arm64/include/asm/rsi_smc.h +7 -0

index e19253f96c94..9ee8b5c7612e 100644
@@ -182,6 +182,13 @@ struct realm_config {
  */
 #define SMC_RSI_IPA_STATE_GET			SMC_RSI_FID(0x198)
 
+struct rsi_host_call {
+	union {
+		u16 imm;
+		u64 padding0;
+	};
+	u64 gprs[31];
+} __aligned(0x100);
 /*
  * Make a Host call.
  *

arch/arm64/kernel/Makefile +1 -1

index fe627100d199..3e72dd9584ed 100644
@@ -34,7 +34,7 @@ obj-y			:= debug-monitors.o entry.o irq.o fpsimd.o		\
 			   cpufeature.o alternative.o cacheinfo.o		\
 			   smp.o smp_spin_table.o topology.o smccc-call.o	\
 			   syscall.o proton-pack.o idle.o patching.o pi/	\
-			   rsi.o jump_label.o
+			   rsi.o jump_label.o rhi.o
 
 obj-$(CONFIG_COMPAT)			+= sys32.o signal32.o			\
 					   sys_compat.o

arch/arm64/kernel/rhi.c new file +6 -0

new file mode 100644
index 000000000000..7cd6c5102464
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026 ARM Ltd.
+ */
+
+#include <linux/mm.h>

Quoted 9 lines

arch/arm64/kernel/rhi.c line 11

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+#include <asm/rsi.h>
+#include <asm/rhi.h>
+
+/* we need an aligned rhicall for rsi_host_call. slab is not yet ready */
+static struct rsi_host_call hyp_pagesize_rhicall;

Why the "hyp_" prefix? This has absolutely nothing to with the hypervisor.

Sure will update "hyp_" reference to host.

Quoted 38 lines

Quoted 38 lines

arch/arm64/kernel/rhi.c new file +38 -0

+unsigned long rhi_get_ipa_change_alignment(void)
+{
+	long ret;
+	unsigned long ipa_change_align;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_VERSION;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (hyp_pagesize_rhicall.gprs[0] != RHI_HOSTCONF_VER_1_0)
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_FEATURES;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (!(hyp_pagesize_rhicall.gprs[0] & __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT))
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	ipa_change_align = hyp_pagesize_rhicall.gprs[0];
+	/* This error needs special handling in the caller */
+	if (ipa_change_align & (SZ_4K - 1))
+		return 0;
+
+	return ipa_change_align;
+
+err_out:
+	/*

Quoted 9 lines

arch/arm64/kernel/rhi.c line 54

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+	 * For failure condition assume host is built with 4K page size
+	 * and hence ipa change alignment can be guest PAGE_SIZE.
+	 */
+	return PAGE_SIZE;
+}

Why can't this be part of rsi.c? This is an RSI call, and it should be part of the RSI initialisation.

This is an RHI call as per the specification, hence it has been added to rhi.c.

Quoted 29 lines

Quoted 17 lines

arch/arm64/kernel/rsi.c +2 -0

index 9e846ce4ef9c..ff735c04e236 100644
@@ -14,8 +14,10 @@
 #include <asm/mem_encrypt.h>
 #include <asm/pgtable.h>
 #include <asm/rsi.h>
+#include <asm/rhi.h>
 
 static struct realm_config config;
+static unsigned long ipa_change_alignment = PAGE_SIZE;
 
 unsigned long prot_ns_shared;
 EXPORT_SYMBOL(prot_ns_shared);

arch/arm64/kernel/rsi.c static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot) · line 147

Quoted 7 lines

arch/arm64/kernel/rsi.c +4 -0

@@ -139,6 +141,11 @@ static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot)
 	return 0;
 }
 
+unsigned long realm_get_hyp_pagesize(void)
+{
+	return ipa_change_alignment;
+}

Again, this has nothing to do with the hypervisor, but the host. And ipa_change_alignment is still a wording I can't wrap my small head around.

Quoted 17 lines

arch/arm64/kernel/rsi.c void __init arm64_rsi_init(void) · line 161

Quoted 13 lines

arch/arm64/kernel/rsi.c +6 -0

+
 void __init arm64_rsi_init(void)
 {
 	if (arm_smccc_1_1_get_conduit() != SMCCC_CONDUIT_SMC)

@@ -147,6 +154,12 @@ void __init arm64_rsi_init(void)
 		return;
 	if (WARN_ON(rsi_get_realm_config(&config)))
 		return;
+
+	ipa_change_alignment = rhi_get_ipa_change_alignment();
+	/* If we don't get a correct alignment response, don't enable realm */
+	if (!ipa_change_alignment)
+		return;

But at the same time, you override a global value with an error, and then paper over it in mem_decrypt_granule_size()...

I believe I received similar feedback on my previous version as well, which I didn’t quite follow.

rhi_get_ipa_change_alignment() only returns an error when the host returns a size that is not 4K-aligned. Otherwise, it returns the host-determined size, or defaults to guest PAGE_SIZE if the RHI call itself is not supported.

Quoted 8 lines

arch/arm64/kernel/rsi.c void __init arm64_rsi_init(void) · line 165

Quoted 4 lines

arch/arm64/kernel/rsi.c +4 -0

+size_t mem_decrypt_granule_size(void)
+{
+	if (is_realm_world())
+		return max(PAGE_SIZE, realm_get_hyp_pagesize());

If you didn't mess with ipa_change_alignment above, you shouldn't need this max().

size_t mem_decrypt_granule_size(void)

{
	if (is_realm_world())
		return max(PAGE_SIZE, realm_get_hyp_pagesize());
	return PAGE_SIZE;
}

That needs to use max(), because we should align to the guest PAGE_SIZE if it is larger than the host-specified alignment value.

Quoted 15 lines · Aneesh Kumar K.V

Quoted 11 lines · Marc Zyngier

Quoted 5 lines · Aneesh Kumar K.V (Arm)

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

I don't understand what "IPA-change" means. What you are after is the host's sharing granule size.

Quoted 4 lines

This is part of the RHI specification, and the call is named RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT. The intent is to determine the alignment requirements for changing IPA attributes (protected vs. unprotected IPA

This really is a terrible name. Why the 'change' part? It doesn't change, it is a constant.

Oh well...

[...]

Quoted 48 lines

Quoted 38 lines

Quoted 38 lines

arch/arm64/kernel/rhi.c new file +38 -0

+unsigned long rhi_get_ipa_change_alignment(void)
+{
+	long ret;
+	unsigned long ipa_change_align;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_VERSION;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (hyp_pagesize_rhicall.gprs[0] != RHI_HOSTCONF_VER_1_0)
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_FEATURES;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (!(hyp_pagesize_rhicall.gprs[0] & __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT))
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	ipa_change_align = hyp_pagesize_rhicall.gprs[0];
+	/* This error needs special handling in the caller */
+	if (ipa_change_align & (SZ_4K - 1))
+		return 0;
+
+	return ipa_change_align;
+
+err_out:
+	/*

Quoted 9 lines

arch/arm64/kernel/rhi.c line 54

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+	 * For failure condition assume host is built with 4K page size
+	 * and hence ipa change alignment can be guest PAGE_SIZE.
+	 */
+	return PAGE_SIZE;
+}

Why can't this be part of rsi.c? This is an RSI call, and it should be part of the RSI initialisation.

Quoted 2 lines

This is an RHI call as per the specification, hence it has been added to rhi.c.

News flash: this is the Linux kernel, not an ARM spec. We organise things based on the logical use, not on the TLA associated with it.

And RHI is implemented in terms of RSI. In rsi.c it goes. We don't need this pointless proliferation of helper files that only result in equally pointless global symbols.

Quoted 11 lines · Aneesh Kumar K.V

Quoted 8 lines · Marc Zyngier

Quoted 5 lines · Aneesh Kumar K.V (Arm)

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

Quoted 8 lines

Quoted 3 lines

I don't understand what "IPA-change" means. What you are after is the host's sharing granule size.

This is part of the RHI specification, and the call is named RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT. The intent is to determine the alignment requirements for changing IPA attributes (protected vs. unprotected IPA

This really is a terrible name. Why the 'change' part? It doesn't change, it is a constant.

Oh well...

[...]

Quoted 13 lines

Quoted 11 lines

arch/arm64/include/asm/rsi_cmds.h static inline unsigned long rsi_attestation_token_continue(phys_addr_t granule, · line 167

Quoted 6 lines

arch/arm64/include/asm/rsi_cmds.h +6 -0

+static inline unsigned long rsi_host_call(struct rsi_host_call *rhi_call)
+{
+	phys_addr_t addr = virt_to_phys(rhi_call);
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_invoke(SMC_RSI_HOST_CALL, addr, &res);

Errr... What guarantees that *rhi_call is *IPA contiguous*? This is incredibly fragile. You should at the very least check that this isn't vmalloc'd.

Quoted 3 lines

I didn’t quite follow that. We have other RSI calls (even RMI calls) that do similar things, and the caller understands that the address should be IPA-contiguous.

Does it? Where is it documented? All you get is a pointer, so all bets are off.

Quoted 4 lines

Are you suggesting that all RSI calls should
add checks for this?. or are you suggesting to update the API to

unsigned long rsi_host_call(unsigned long rhi_call_phys) ?

I'm suggesting that this API is subtly broken because it makes random assumption about the physical contiguity of the VA space. It does so without any check, without any documentation.

Simply changing the parameter to phys_addr_t could at the very least capture some of the requirements, but I'd like something in big bold letters.

Quoted 110 lines

Quoted 49 lines

Quoted 49 lines

arch/arm64/include/asm/rsi_cmds.h +4 -0

+
+	return res.a0;
+}
+
 #endif /* __ASM_RSI_CMDS_H */

arch/arm64/include/asm/rsi_smc.h +7 -0

index e19253f96c94..9ee8b5c7612e 100644
@@ -182,6 +182,13 @@ struct realm_config {
  */
 #define SMC_RSI_IPA_STATE_GET			SMC_RSI_FID(0x198)
 
+struct rsi_host_call {
+	union {
+		u16 imm;
+		u64 padding0;
+	};
+	u64 gprs[31];
+} __aligned(0x100);
 /*
  * Make a Host call.
  *

arch/arm64/kernel/Makefile +1 -1

index fe627100d199..3e72dd9584ed 100644
@@ -34,7 +34,7 @@ obj-y			:= debug-monitors.o entry.o irq.o fpsimd.o		\
 			   cpufeature.o alternative.o cacheinfo.o		\
 			   smp.o smp_spin_table.o topology.o smccc-call.o	\
 			   syscall.o proton-pack.o idle.o patching.o pi/	\
-			   rsi.o jump_label.o
+			   rsi.o jump_label.o rhi.o
 
 obj-$(CONFIG_COMPAT)			+= sys32.o signal32.o			\
 					   sys_compat.o

arch/arm64/kernel/rhi.c new file +6 -0

new file mode 100644
index 000000000000..7cd6c5102464
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026 ARM Ltd.
+ */
+
+#include <linux/mm.h>

Quoted 9 lines

arch/arm64/kernel/rhi.c line 11

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+#include <asm/rsi.h>
+#include <asm/rhi.h>
+
+/* we need an aligned rhicall for rsi_host_call. slab is not yet ready */
+static struct rsi_host_call hyp_pagesize_rhicall;

Why the "hyp_" prefix? This has absolutely nothing to with the hypervisor.

Sure will update "hyp_" reference to host.

Quoted 38 lines

Quoted 38 lines

arch/arm64/kernel/rhi.c new file +38 -0

+unsigned long rhi_get_ipa_change_alignment(void)
+{
+	long ret;
+	unsigned long ipa_change_align;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_VERSION;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (hyp_pagesize_rhicall.gprs[0] != RHI_HOSTCONF_VER_1_0)
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_FEATURES;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	if (!(hyp_pagesize_rhicall.gprs[0] & __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT))
+		goto err_out;
+
+	hyp_pagesize_rhicall.imm = 0;
+	hyp_pagesize_rhicall.gprs[0] = RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT;
+	ret = rsi_host_call(lm_alias(&hyp_pagesize_rhicall));
+	if (ret != RSI_SUCCESS)
+		goto err_out;
+
+	ipa_change_align = hyp_pagesize_rhicall.gprs[0];
+	/* This error needs special handling in the caller */
+	if (ipa_change_align & (SZ_4K - 1))
+		return 0;
+
+	return ipa_change_align;
+
+err_out:
+	/*

Quoted 9 lines

arch/arm64/kernel/rhi.c line 54

Quoted 5 lines

arch/arm64/kernel/rhi.c new file +5 -0

+	 * For failure condition assume host is built with 4K page size
+	 * and hence ipa change alignment can be guest PAGE_SIZE.
+	 */
+	return PAGE_SIZE;
+}

Why can't this be part of rsi.c? This is an RSI call, and it should be part of the RSI initialisation.

Quoted 2 lines

This is an RHI call as per the specification, hence it has been added to rhi.c.

News flash: this is the Linux kernel, not an ARM spec. We organise things based on the logical use, not on the TLA associated with it.

And RHI is implemented in terms of RSI. In rsi.c it goes. We don't need this pointless proliferation of helper files that only result in equally pointless global symbols.

Quoted 48 lines

Quoted 29 lines

Quoted 17 lines

arch/arm64/kernel/rsi.c +2 -0

index 9e846ce4ef9c..ff735c04e236 100644
@@ -14,8 +14,10 @@
 #include <asm/mem_encrypt.h>
 #include <asm/pgtable.h>
 #include <asm/rsi.h>
+#include <asm/rhi.h>
 
 static struct realm_config config;
+static unsigned long ipa_change_alignment = PAGE_SIZE;
 
 unsigned long prot_ns_shared;
 EXPORT_SYMBOL(prot_ns_shared);

arch/arm64/kernel/rsi.c static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot) · line 147

Quoted 7 lines

arch/arm64/kernel/rsi.c +4 -0

@@ -139,6 +141,11 @@ static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot)
 	return 0;
 }
 
+unsigned long realm_get_hyp_pagesize(void)
+{
+	return ipa_change_alignment;
+}

Again, this has nothing to do with the hypervisor, but the host. And ipa_change_alignment is still a wording I can't wrap my small head around.

Quoted 17 lines

arch/arm64/kernel/rsi.c void __init arm64_rsi_init(void) · line 161

Quoted 13 lines

arch/arm64/kernel/rsi.c +6 -0

+
 void __init arm64_rsi_init(void)
 {
 	if (arm_smccc_1_1_get_conduit() != SMCCC_CONDUIT_SMC)

@@ -147,6 +154,12 @@ void __init arm64_rsi_init(void)
 		return;
 	if (WARN_ON(rsi_get_realm_config(&config)))
 		return;
+
+	ipa_change_alignment = rhi_get_ipa_change_alignment();
+	/* If we don't get a correct alignment response, don't enable realm */
+	if (!ipa_change_alignment)
+		return;

But at the same time, you override a global value with an error, and then paper over it in mem_decrypt_granule_size()...

Quoted 2 lines

I believe I received similar feedback on my previous version as well, which I didn’t quite follow.

And you didn't think of asking? Sometimes I wonder what these patch reviews are for... Just to waste some more electrons, I guess :-/.

Quoted 5 lines

rhi_get_ipa_change_alignment() only returns an error when the host returns a size that is not 4K-aligned. Otherwise, it returns the host-determined size, or defaults to guest PAGE_SIZE if the RHI call itself is not supported.

You encode the error as 0. You override ipa_change_alignment with 0.

Then...

Quoted 10 lines

Quoted 8 lines

arch/arm64/kernel/rsi.c void __init arm64_rsi_init(void) · line 165

Quoted 4 lines

arch/arm64/kernel/rsi.c +4 -0

+size_t mem_decrypt_granule_size(void)
+{
+	if (is_realm_world())
+		return max(PAGE_SIZE, realm_get_hyp_pagesize());

If you didn't mess with ipa_change_alignment above, you shouldn't need this max().

size_t mem_decrypt_granule_size(void)

Quoted 8 lines

{
	if (is_realm_world())
		return max(PAGE_SIZE, realm_get_hyp_pagesize());
	return PAGE_SIZE;
}

That needs to use max(), because we should align to the guest PAGE_SIZE if it is larger than the host-specified alignment value.

... you need to correct that back to PAGE_SIZE because you have stored something smaller than PAGE_SIZE.

Isn't the problem really obvious? ipa_change_alignment can *NEVER* go down. It should never be allowed to reduce, because that's exactly the property you are trying to enforce.

Quoted 15 lines · Aneesh Kumar K.V

Quoted 11 lines · Marc Zyngier

Quoted 5 lines · Aneesh Kumar K.V (Arm)

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

I don't understand what "IPA-change" means. What you are after is the host's sharing granule size.

Quoted 4 lines

This is part of the RHI specification, and the call is named RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT. The intent is to determine the alignment requirements for changing IPA attributes (protected vs. unprotected IPA

This really is a terrible name. Why the 'change' part? It doesn't change, it is a constant.

Oh well...

[...]

Quoted 13 lines

Quoted 11 lines

arch/arm64/include/asm/rsi_cmds.h static inline unsigned long rsi_attestation_token_continue(phys_addr_t granule, · line 167

Quoted 6 lines

arch/arm64/include/asm/rsi_cmds.h +6 -0

+static inline unsigned long rsi_host_call(struct rsi_host_call *rhi_call)
+{
+	phys_addr_t addr = virt_to_phys(rhi_call);
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_invoke(SMC_RSI_HOST_CALL, addr, &res);

Errr... What guarantees that *rhi_call is *IPA contiguous*? This is incredibly fragile. You should at the very least check that this isn't vmalloc'd.

Quoted 3 lines

I didn’t quite follow that. We have other RSI calls (even RMI calls) that do similar things, and the caller understands that the address should be IPA-contiguous.

Does it? Where is it documented? All you get is a pointer, so all bets are off.

Quoted 5 lines

Are you suggesting that all RSI calls should
add checks for this?. or are you suggesting to update the API to

unsigned long rsi_host_call(unsigned long rhi_call_phys) ?

I'm suggesting that this API is subtly broken because it makes random assumption about the physical contiguity of the VA space. It does so without any check, without any documentation.

Simply changing the parameter to phys_addr_t could at the very least capture some of the requirements, but I'd like something in big bold letters.

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

Expose that alignment through realm_get_hyp_pagesize() and mem_decrypt_granule_size() so shared-buffer allocation and encryption/decryption paths can honor the ipa change page-size requirement.

If the host reports an invalid alignment (when alginment value is not multiple of 4K), do not enable Realm support.

This provides the host alignment information required by the shared buffer alignment changes.

Signed-off-by Aneesh Kumar K.V (Arm) <[email protected]>

---
 arch/arm64/include/asm/mem_encrypt.h |  3 ++
 arch/arm64/include/asm/rhi.h         | 24 +++++++++++++
 arch/arm64/include/asm/rsi.h         |  2 ++
 arch/arm64/include/asm/rsi_cmds.h    | 10 ++++++
 arch/arm64/include/asm/rsi_smc.h     |  7 ++++
 arch/arm64/kernel/Makefile           |  2 +-
 arch/arm64/kernel/rhi.c              | 54 ++++++++++++++++++++++++++++
 arch/arm64/kernel/rsi.c              | 13 +++++++
 arch/arm64/mm/mem_encrypt.c          |  8 +++++
 9 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100644 arch/arm64/include/asm/rhi.h
 create mode 100644 arch/arm64/kernel/rhi.c

arch/arm64/mm/mem_encrypt.c +0 -0

index 38c62c9e4e74..f5d64bc29c20 100644

[+Seb for the ITS]

Quoted 29 lines · Aneesh Kumar K.V (Arm)

Add the Realm Host Interface support needed to query host configuration from a Realm guest. Define the RHI hostconf SMCs, add rsi_host_call(), and use them during Realm initialization to retrieve the host IPA-change alignment size.

Expose that alignment through realm_get_hyp_pagesize() and mem_decrypt_granule_size() so shared-buffer allocation and encryption/decryption paths can honor the ipa change page-size requirement.

If the host reports an invalid alignment (when alginment value is not multiple of 4K), do not enable Realm support.

This provides the host alignment information required by the shared buffer alignment changes.

Signed-off-by Aneesh Kumar K.V (Arm) <[email protected]>

---
 arch/arm64/include/asm/mem_encrypt.h |  3 ++
 arch/arm64/include/asm/rhi.h         | 24 +++++++++++++
 arch/arm64/include/asm/rsi.h         |  2 ++
 arch/arm64/include/asm/rsi_cmds.h    | 10 ++++++
 arch/arm64/include/asm/rsi_smc.h     |  7 ++++
 arch/arm64/kernel/Makefile           |  2 +-
 arch/arm64/kernel/rhi.c              | 54 ++++++++++++++++++++++++++++
 arch/arm64/kernel/rsi.c              | 13 +++++++
 arch/arm64/mm/mem_encrypt.c          |  8 +++++
 9 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100644 arch/arm64/include/asm/rhi.h
 create mode 100644 arch/arm64/kernel/rhi.c

[...]

Quoted 11 lines

arch/arm64/mm/mem_encrypt.c +3 -0

index 38c62c9e4e74..f5d64bc29c20 100644
@@ -59,3 +59,11 @@ int set_memory_decrypted(unsigned long addr, int numpages)
 	return crypt_ops->decrypt(addr, numpages);
 }
 EXPORT_SYMBOL_GPL(set_memory_decrypted);
+
+size_t mem_decrypt_granule_size(void)
+{

arch/arm64/mm/mem_encrypt.c int set_memory_decrypted(unsigned long addr, int numpages) · line 67

Quoted 3 lines

arch/arm64/mm/mem_encrypt.c +3 -0

+	if (is_realm_world())
+		return max(PAGE_SIZE, realm_get_hyp_pagesize());
+	return PAGE_SIZE;

No, this should be indirected via 'struct arm64_mem_crypt_ops' because there's nothing particularly unique to realms here. For pKVM protected guests using a smaller page-size than the host, we'd presumably need something similar for the ITS (where restricted-dma isn't used).