This patchset provides minimal functionality to start a Realm VM
from an Arm RME cabable host using the following command line:
qemu-system-aarch64 -M confidential-guest-support=rme0 -object
rme-guest,id=rme0 \
-cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults ..
This set is a refactoring of Jean-Philippe Brucker's initial work dating from
a while back. It is compatible with Steven Price's v14 revision [1] of his work
adding CCA support to KVM.
The RME capable host it was tested on is the QEMU SBSA machine. For
convenicence
a repository is hosted here [2], along with the TF-A [3], RMM [4] and Linux
kernel [5] for the SBSA machine (all compatible with Steven's v14 patchset).
Device Assignment is not included.
>From hereon I will keep this set up to date with new releases from Steven.
Thanks,
Mathieu
[1].
https://lore.kernel.org/kvm/[email protected]/T/#m06dd14216aaf76acab65b0a76fb84653141ea64f
[2]. https://gitlab.com/Linaro/cca-public/qemu/-/tree/upstream-v1?ref_type=heads
[3].
https://gitlab.com/Linaro/cca-public/tf-a/trusted-firmware-a/-/tree/cca/v13?ref_type=heads
[4]. https://gitlab.com/Linaro/cca-public/rmm/-/tree/cca/v14?ref_type=heads
[5]. https://gitlab.com/Linaro/cca-public/linux/-/tree/cca/v14?ref_type=heads
Jean-Philippe Brucker (25):
linux-headers: Add RME related definitions
target/arm/kvm: Return immediately on error in kvm_arch_init()
target/arm: Add confidential guest support
target/arm/kvm-rme: Add mechanic to initialize realms
target/arm/kvm: Split kvm_arch_get/put_registers
target/arm/kvm-rme: Initialize vCPU
target/arm/kvm: Create scratch Realm VM when requested
target/arm/kvm: Use kvm_vm_check_extension() where necessary
target/arm/kvm-rme: Initialise Realm Initial Address space
hw/core/loader: Add a ROM loader notifier
target/arm/kvm-rme: Keep track of images loaded in Realm memory
target/arm/kvm-rme: Populate Realm with runtime images
target/arm/cpu: Set number of breakpoints and watchpoints in KVM
target/arm/cpu: Set number of PMU counters in KVM
target/arm/cpu: Don't read Realm registers
hw/arm/virt: Set proper conduit method for Realms
hw/arm/virt: Embed Realm VM type with IPA address space
hw/arm/virt: Reserve one bit of guest physical address for RME
hw/arm/virt: Disable DTB randomness for confidential VMs
hw/arm/virt: Move virt_flash_create() to machvirt_init()
hw/arm/virt: Use RAM instead of flash for confidential guest firmware
target/arm/kvm-rme: Add DMA remapping for the shared memory region
docs/interop/firmware.json: Add arm-rme firmware feature
hw/arm/boot: Load DTB as is for confidential VMs
hw/arm/boot: Skip bootloader for confidential guests
docs/interop/firmware.json | 5 +-
docs/system/arm/virt.rst | 9 +-
docs/system/confidential-guest-support.rst | 1 +
hw/arm/boot.c | 74 ++++-
hw/arm/virt.c | 138 +++++++--
hw/core/loader.c | 15 +
include/hw/arm/boot.h | 9 +
include/hw/arm/virt.h | 2 +-
include/hw/core/loader.h | 17 ++
linux-headers/asm-arm64/kvm.h | 9 +
linux-headers/linux/kvm.h | 21 +-
qapi/qom.json | 1 +
target/arm/arm-qmp-cmds.c | 1 +
target/arm/cpu.c | 5 +
target/arm/cpu.h | 10 +
target/arm/cpu64.c | 122 ++++++++
target/arm/kvm-rme.c | 335 +++++++++++++++++++++
target/arm/kvm-stub.c | 23 ++
target/arm/kvm.c | 194 +++++++++++-
target/arm/kvm_arm.h | 47 +++
target/arm/meson.build | 5 +-
21 files changed, 990 insertions(+), 53 deletions(-)
create mode 100644 target/arm/kvm-rme.c
--
2.43.0
