This patchset provides minimal functionality to start a Realm VM from an Arm RME capable host using the following command line:
qemu-system-aarch64 \ -M confidential-guest-support=rme0,memory-backend=ram0 \ -object rme-guest,id=rme0,convert-in-place=on \ -object memory-backend-memfd,id=ram0,size=1G,share=on \ -cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults .. It is a refactoring of Jean-Philippe Brucker's initial work dating from a while back. It is compatible with Suzuki Poulose's basic KVM plumbing for Realms [1], supplemented with Aneesh Kumar's latest work on swiotbl [2]. This revision is based on Michael Roth's second revision of his work on guest-memfd in-place memory conversion [3], rebased to QEMU master. It was tested on the QEMU SBSA machine. For convenience a repository is hosted here [4], along with the TF-A [5], RMM [6] and kernel [7]. Instructions to compile and run the entire stack can be found here [8]. Thanks, Mathieu [1]. https://lore.kernel.org/kvm/[email protected]/T/#m6a4fb7b947ba687795a9dd3c90874d9fb1eef02e [2]. https://lore.kernel.org/all/[email protected]/ [3]. https://lore.kernel.org/kvm/[email protected]/ [4]. https://gitlab.com/Linaro/cca-public/qemu/-/tree/upstream-v5?ref_type=heads [5]. https://gitlab.com/Linaro/cca-public/tf-a/trusted-firmware-a/-/tree/cca/v13?ref_type=heads [6]. https://gitlab.com/Linaro/cca-public/rmm/-/tree/cca/v20?ref_type=heads [7]. https://gitlab.com/Linaro/cca-public/linux/-/tree/upstream-v5-kvmv21?ref_type=heads [8]. https://gitlab.com/Linaro/cca-public/build-instructions RFC v4: https://lore.kernel.org/kvm/[email protected]/ RFC v3: https://lore.kernel.org/kvm/[email protected]/ RFC v2: https://lore.kernel.org/kvm/[email protected]/ RFC v1: https://lists.gnu.org/archive/html/qemu-devel/2026-07/msg02307.html Changes since V4: - Discarded original 02/24 because it was merged (thank you Philippe). - Adjusted QEMU version i patch 03/24. - Fixed changelog in 06/24 (Kohei). - Combined patches 09 and 10 (Michael). - Moved check for "rom->addr == -1" to rom_reset() (Michael). Jean-Philippe Brucker (21): linux-headers: Add RME related definitions target/arm: Add confidential guest support target/arm/kvm: Split kvm_arch_get/put_registers target/arm/kvm-rme: Initialize vCPU target/arm/kvm: Create scratch Realm VM when requested target/arm/kvm: Use kvm_vm_check_extension() where necessary target/arm/kvm-rme: Keep track of images loaded in Realm memory target/arm/kvm-rme: Populate Realm with runtime images target/arm/cpu: Set number of breakpoints and watchpoints in KVM target/arm/cpu: Set number of PMU counters in KVM target/arm/cpu: Don't read Realm registers hw/arm/virt: Set proper conduit method for Realms hw/arm/virt: Embed Realm VM type with IPA address space hw/arm/virt: Reserve one bit of guest physical address for RME hw/arm/virt: Disable DTB randomness for confidential VMs hw/arm/virt: Move virt_flash_create() to machvirt_init() hw/arm/virt: Use RAM instead of flash for confidential guest firmware target/arm/kvm-rme: Add DMA remapping for the shared memory region docs/interop/firmware.json: Add arm-rme firmware feature hw/arm/boot: Load DTB as is for confidential VMs hw/arm/boot: Skip bootloader for confidential guests Mathieu Poirier (1): target/arm/kvm-rme: Add mechanic to initialize realms docs/interop/firmware.json | 5 +- docs/system/arm/virt.rst | 9 +- docs/system/confidential-guest-support.rst | 1 + hw/arm/boot.c | 70 ++++- hw/arm/virt.c | 142 +++++++-- hw/core/loader.c | 24 ++ include/hw/arm/boot.h | 9 + include/hw/arm/virt.h | 2 +- include/hw/core/loader.h | 17 ++ linux-headers/linux/kvm.h | 18 +- qapi/qom.json | 13 + target/arm/arm-qmp-cmds.c | 1 + target/arm/cpu.c | 5 + target/arm/cpu.h | 10 + target/arm/cpu64.c | 122 ++++++++ target/arm/kvm-rme.c | 325 +++++++++++++++++++++ target/arm/kvm-stub.c | 9 + target/arm/kvm.c | 201 ++++++++++++- target/arm/kvm_arm.h | 20 ++ target/arm/meson.build | 5 +- 20 files changed, 958 insertions(+), 50 deletions(-) create mode 100644 target/arm/kvm-rme.c -- 2.43.0
