These patches enable launching a confidential guest with QEMU KVM on
Arm. The KVM changes for CCA have now been posted as v2 [1]. Launching a
confidential VM requires two additional command-line parameters:
-M confidential-guest-support=rme0
-object rme-guest,id=rme0
Since the RFC [2] I tried to address all review comments, and added a
few features:
* Enabled support for guest memfd by Xiaoyao Li and Chao Peng [3].
Guest memfd is mandatory for CCA.
* Support firmware boot (edk2).
* Use CPU command-line arguments for Realm parameters. SVE vector length
uses the existing sve<N> -cpu parameters, while breakpoints, watchpoints
and PMU counters use new CPU parameters.
The full series based on the memfd patches is at:
https://git.codelinaro.org/linaro/dcap/qemu.git branch cca/v2
Please find instructions for building and running the whole CCA stack at:
https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/Building+an+RME+stack+for+QEMU
[1] https://lore.kernel.org/kvm/20240412084056.1733704-1-steven.pr...@arm.com/
[2]
https://lore.kernel.org/all/20230127150727.612594-1-jean-phili...@linaro.org/
[3]
https://lore.kernel.org/qemu-devel/20240322181116.1228416-1-pbonz...@redhat.com/
Jean-Philippe Brucker (22):
kvm: Merge kvm_check_extension() and kvm_vm_check_extension()
target/arm: Add confidential guest support
target/arm/kvm: Return immediately on error in kvm_arch_init()
target/arm/kvm-rme: Initialize realm
hw/arm/virt: Add support for Arm RME
hw/arm/virt: Disable DTB randomness for confidential VMs
hw/arm/virt: Reserve one bit of guest-physical address for RME
target/arm/kvm: Split kvm_arch_get/put_registers
target/arm/kvm-rme: Initialize vCPU
target/arm/kvm: Create scratch VM as Realm if necessary
hw/core/loader: Add ROM loader notifier
target/arm/kvm-rme: Populate Realm memory
hw/arm/boot: Register Linux BSS section for confidential guests
target/arm/kvm-rme: Add Realm Personalization Value parameter
target/arm/kvm-rme: Add measurement algorithm property
target/arm/cpu: Set number of breakpoints and watchpoints in KVM
target/arm/cpu: Set number of PMU counters in KVM
target/arm/kvm: Disable Realm reboot
target/arm/cpu: Inform about reading confidential CPU registers
target/arm/kvm-rme: Enable guest memfd
hw/arm/virt: Move virt_flash_create() to machvirt_init()
hw/arm/virt: Use RAM instead of flash for confidential guest firmware
docs/system/arm/virt.rst | 9 +-
docs/system/confidential-guest-support.rst | 1 +
qapi/qom.json | 34 +-
include/hw/arm/boot.h | 9 +
include/hw/arm/virt.h | 2 +-
include/hw/loader.h | 15 +
include/sysemu/kvm.h | 2 -
include/sysemu/kvm_int.h | 1 +
target/arm/cpu.h | 10 +
target/arm/kvm_arm.h | 25 ++
accel/kvm/kvm-all.c | 34 +-
hw/arm/boot.c | 45 ++-
hw/arm/virt.c | 118 ++++--
hw/core/loader.c | 15 +
target/arm/arm-qmp-cmds.c | 1 +
target/arm/cpu.c | 5 +
target/arm/cpu64.c | 118 ++++++
target/arm/kvm-rme.c | 413 +++++++++++++++++++++
target/arm/kvm.c | 200 +++++++++-
target/i386/kvm/kvm.c | 6 +-
target/ppc/kvm.c | 36 +-
target/arm/meson.build | 7 +-
22 files changed, 1023 insertions(+), 83 deletions(-)
create mode 100644 target/arm/kvm-rme.c
--
2.44.0
