NVIDIA: add Arm CCA Realm and RME device-assignment support

MAINTAINERS

@@ -475,7 +475,9 @@ ARM KVM CPUs
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Supported
+F: include/hw/arm/rme-da.h
 F: target/arm/kvm.c
+F: target/arm/kvm-rme.c
 F: tests/functional/aarch64/test_kvm.py
 
 MIPS KVM CPUs
@@ -1115,6 +1117,7 @@ S: Supported
 F: hw/arm/virt*
 F: include/hw/arm/virt.h
 F: docs/system/arm/virt.rst
+F: tests/qtest/arm-virt-machine-test.c
 F: tests/functional/aarch64/test_*virt*.py
 F: tests/functional/aarch64/test_tuxrun.py
 F: tests/functional/arm/test_tuxrun.py

accel/kvm/kvm-all.c

@@ -1665,6 +1665,12 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
     ram_start_offset = memory_region_get_ram_addr(mr) + mr_offset;
 
     if (!add) {
+        bool clear_attrs =
+            machine_has_assigned_device_memory(current_machine) &&
+            memory_region_is_ram_device(mr) &&
+            (kvm_supported_memory_attributes &
+             KVM_MEMORY_ATTRIBUTE_PRIVATE);
+
         do {
             slot_size = MIN(kvm_max_slot_size, size);
             mem = kvm_lookup_matching_slot(kml, start_addr, slot_size);
@@ -1708,6 +1714,23 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
                         __func__, strerror(-err));
                 abort();
             }
+            /*
+             * Drop any VDEV-installed PRIVATE attributes for this slot. The
+             * mem_attr_array is per-VM and persists across slot lifecycle,
+             * so without this clear a re-mapped or recycled gfn range could
+             * inherit stale VDEV-locked state. The attribute-clear also
+             * tears down any leftover ASSIGNED-DEV S2 entries via
+             * kvm_arch_post_set_memory_attributes() / kvm_unmap_gfn_range().
+             */
+            if (clear_attrs) {
+                if (kvm_set_memory_attributes_shared(start_addr, slot_size)) {
+                    error_report("failed to clear memory attributes while "
+                                 "removing slot [0x%" HWADDR_PRIx
+                                 ", 0x%" HWADDR_PRIx ")",
+                                 start_addr, start_addr + slot_size);
+                    exit(EXIT_FAILURE);
+                }
+            }
             start_addr += slot_size;
             size -= slot_size;
             kml->nr_slots_used--;
@@ -2701,6 +2724,14 @@ static int do_kvm_create_vm(KVMState *s, int type)
             error_printf("PPC KVM module is not loaded. Try modprobe kvm_%s.\n",
                          (type == 2) ? "pr" : "hv");
         }
+#elif defined(TARGET_AARCH64)
+        if (ret == -EINVAL &&
+            (type & KVM_VM_TYPE_ARM_MASK) == KVM_VM_TYPE_ARM_REALM &&
+            KVM_VM_TYPE_ARM_IPA_SIZE(type)) {
+            error_printf("The requested Realm IPA size (%u bits) may exceed "
+                         "the RMM S2SZ limit.\n",
+                         (unsigned int)KVM_VM_TYPE_ARM_IPA_SIZE(type));
+        }
 #endif
     }
 
@@ -3377,18 +3408,51 @@ int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private)
         return ret;
     }
 
+    if (!int128_eq(section.size, int128_make64(size))) {
+        error_report("Convert memory range (0x%" HWADDR_PRIx
+                     " + 0x%" HWADDR_PRIx ") crosses a memory-region "
+                     "boundary", start, size);
+        goto out_unref;
+    }
+
     if (!memory_region_has_guest_memfd(mr)) {
         /*
-         * Because vMMIO region must be shared, guest TD may convert vMMIO
-         * region to shared explicitly.  Don't complain such case.  See
+         * Because vMMIO region may be shared, guest TD may convert vMMIO
+         * region to shared explicitly. Don't complain such case. See
          * memory_region_type() for checking if the region is MMIO region.
          */
         if (!to_private &&
-            !memory_region_is_ram(mr) &&
-            !memory_region_is_ram_device(mr) &&
+            (!memory_region_is_ram(mr) ||
+             (machine_has_assigned_device_memory(current_machine) &&
+              memory_region_is_ram_device(mr))) &&
             !memory_region_is_rom(mr) &&
             !memory_region_is_romd(mr)) {
-            ret = 0;
+            /*
+             * For ram_device regions (e.g. VFIO BARs), the realm may
+             * have marked individual gfns PRIVATE through
+             * iommufd_tsm_dev_memmap_exit() when validating a VDEV
+             * mapping. When the realm later asks to release the
+             * mapping with RSI_IPA_STATE_SET(EMPTY), the kernel
+             * surfaces it here as a !to_private convert. A silent
+             * ret=0 would leave PRIVATE set with no DEV mapping
+             * behind it; honour the release by actually clearing the
+             * attribute. The kvm_arch_post_set_memory_attributes()
+             * side-effect then tears down any leftover ASSIGNED-DEV
+             * S2 via kvm_unmap_gfn_range(KVM_FILTER_PRIVATE), keeping
+             * userspace's view in sync with the kernel's.
+             *
+             * For the non-ram_device legs of this branch (e.g. TDX
+             * vMMIO traps) no PRIVATE attribute was ever installed,
+             * so preserve the original ret=0 fast path.
+             */
+            if (machine_has_assigned_device_memory(current_machine) &&
+                memory_region_is_ram_device(mr) &&
+                (kvm_supported_memory_attributes &
+                 KVM_MEMORY_ATTRIBUTE_PRIVATE)) {
+                ret = kvm_set_memory_attributes_shared(start, size);
+            } else {
+                ret = 0;
+            }
         } else {
             error_report("Convert non guest_memfd backed memory region "
                         "(0x%"HWADDR_PRIx" ,+ 0x%"HWADDR_PRIx") to %s",
@@ -4763,6 +4827,11 @@ void kvm_mark_guest_state_protected(void)
     kvm_state->guest_state_protected = true;
 }
 
+bool kvm_guest_state_protected(void)
+{
+    return kvm_state && kvm_state->guest_state_protected;
+}
+
 int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp)
 {
     int fd;

accel/stubs/kvm-stub.c

@@ -143,3 +143,13 @@ int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp)
 {
     return -ENOSYS;
 }
+
+int kvm_set_memory_attributes_private(hwaddr start, uint64_t size)
+{
+    return -ENOSYS;
+}
+
+int kvm_set_memory_attributes_shared(hwaddr start, uint64_t size)
+{
+    return -ENOSYS;
+}

docs/interop/firmware.json

@@ -161,6 +161,9 @@
 #     options related to this feature are documented in
 #     "docs/system/i386/amd-memory-encryption.rst".
 #
+# @arm-rme: The firmware supports running in a Realm, under the Arm Realm
+#     Management Extension (RME).
+#
 # @intel-tdx: The firmware supports running under Intel Trust Domain
 #     Extensions (TDX).
 #
@@ -229,7 +232,7 @@
 { 'enum' : 'FirmwareFeature',
   'data' : [ 'acpi-s3', 'acpi-s4',
              'amd-sev', 'amd-sev-es', 'amd-sev-snp',
-             'intel-tdx',
+             'arm-rme', 'intel-tdx',
              'enrolled-keys', 'requires-smm',
              'secure-boot', 'host-uefi-vars',
              'verbose-dynamic', 'verbose-static' ] }

docs/system/arm/virt.rst

@@ -218,10 +218,11 @@ dtb-randomness
   rng-seed and kaslr-seed nodes (in both "/chosen" and
   "/secure-chosen") to use for features like the random number
   generator and address space randomisation. The default is
-  ``on``. You will want to disable it if your trusted boot chain
-  will verify the DTB it is passed, since this option causes the
-  DTB to be non-deterministic. It would be the responsibility of
-  the firmware to come up with a seed and pass it on if it wants to.
+  ``off`` for confidential VMs, and ``on`` otherwise. You will want
+  to disable it if your trusted boot chain will verify the DTB it is
+  passed, since this option causes the DTB to be non-deterministic.
+  It would be the responsibility of the firmware to come up with a
+  seed and pass it on if it wants to.
 
 dtb-kaslr-seed
   A deprecated synonym for dtb-randomness.

docs/system/confidential-guest-support.rst

@@ -42,5 +42,6 @@ Currently supported confidential guest mechanisms are:
 * POWER Protected Execution Facility (PEF) (see :ref:`power-papr-protected-execution-facility-pef`)
 * s390x Protected Virtualization (PV) (see :doc:`s390x/protvirt`)
 * AWS Nitro Enclaves (see :doc:`nitro`)
+* Arm Realm Management Extension (RME)
 
 Other mechanisms may be supported in future.

hw/arm/boot.c

@@ -581,7 +581,42 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
     g_autoptr(MemoryDeviceInfoList) md_list = NULL;
     Error *err = NULL;
 
-    if (binfo->dtb_filename) {
+    if (binfo->dtb_filename && binfo->confidential) {
+        g_autofree char *filename = NULL;
+        int64_t file_size;
+
+        /*
+         * If the user is providing a DTB for a confidential VM, it is already
+         * tailored to this configuration and measured. Load it as is, without
+         * any modification.
+         */
+        filename = qemu_find_file(QEMU_FILE_TYPE_DTB, binfo->dtb_filename);
+        if (!filename) {
+            fprintf(stderr, "Couldn't open dtb file %s\n",
+                    binfo->dtb_filename);
+            goto fail;
+        }
+
+        file_size = get_image_size(filename, &err);
+        if (file_size <= 0 || file_size > INT_MAX) {
+            if (err) {
+                error_report_err(err);
+                err = NULL;
+            } else {
+                error_report("Invalid DTB file size for %s", filename);
+            }
+            goto fail;
+        }
+
+        if (addr_limit > addr && file_size > addr_limit - addr) {
+            return 0;
+        }
+
+        if (rom_add_file_fixed_as(filename, addr, -1, as) < 0) {
+            goto fail;
+        }
+        return file_size;
+    } else if (binfo->dtb_filename) {
         char *filename;
         filename = qemu_find_file(QEMU_FILE_TYPE_DTB, binfo->dtb_filename);
         if (!filename) {
@@ -834,7 +869,13 @@ static void do_cpu_reset(void *opaque)
             if (cpu == info->primary_cpu) {
                 AddressSpace *as = arm_boot_address_space(cpu, info);
 
-                cpu_set_pc(cs, info->loader_start);
+                if (info->confidential)  {
+                    assert(is_a64(env));
+                    env->xregs[0] = info->dtb_start;
+                    cpu_set_pc(cs, info->entry);
+                } else {
+                    cpu_set_pc(cs, info->loader_start);
+                }
 
                 if (!have_dtb(info)) {
                     set_kernel_args(info, as);
@@ -924,7 +965,8 @@ static ssize_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
 }
 
 static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
-                                   hwaddr *entry, AddressSpace *as)
+                                   hwaddr *entry, AddressSpace *as,
+                                   bool confidential)
 {
     const size_t max_bytes = LOAD_IMAGE_MAX_DECOMPRESSED_BYTES;
     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
@@ -976,7 +1018,8 @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
              * bootloader, we can just load it starting at 2MB+offset rather
              * than 0MB + offset.
              */
-            if (kernel_load_offset < BOOTLOADER_MAX_SIZE) {
+            if (kernel_load_offset < BOOTLOADER_MAX_SIZE &&
+                !confidential) {
                 kernel_load_offset += 2 * MiB;
             }
         }
@@ -1060,7 +1103,8 @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     }
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
         kernel_size = load_aarch64_image(info->kernel_filename,
-                                         info->loader_start, &entry, as);
+                                         info->loader_start, &entry, as,
+                                         info->confidential);
         is_linux = 1;
         if (kernel_size >= 0) {
             image_low_addr = entry;
@@ -1201,8 +1245,11 @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         fixupcontext[FIXUP_ENTRYPOINT_LO] = entry;
         fixupcontext[FIXUP_ENTRYPOINT_HI] = entry >> 32;
 
-        arm_write_bootloader("bootloader", as, info->loader_start,
-                             primary_loader, fixupcontext);
+        /* Immediately jump to the kernel when guest is a Realm */
+        if (!info->confidential) {
+            arm_write_bootloader("bootloader", as, info->loader_start,
+                                 primary_loader, fixupcontext);
+        }
 
         if (info->write_board_setup) {
             info->write_board_setup(cpu, info);
@@ -1222,7 +1269,41 @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     }
 }
 
-static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
+static void arm_setup_confidential_firmware_boot(ARMCPU *cpu,
+                                                 struct arm_boot_info *info,
+                                                 const char *firmware_filename)
+{
+    ssize_t fw_size;
+    g_autofree char *fname = NULL;
+    AddressSpace *as = arm_boot_address_space(cpu, info);
+
+    if (!firmware_filename) {
+        error_report("a confidential Arm guest requires either a kernel "
+                     "or a firmware image");
+        exit(1);
+    }
+
+    fname = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware_filename);
+    if (!fname) {
+        error_report("Could not find firmware image '%s'", firmware_filename);
+        exit(1);
+    }
+
+    /*
+     * Load the firmware image in the Realm's address space.  Mapping of the
+     * firmware area in the Realm's address space is done in function
+     * virt_confidential_firmware_init().
+     */
+    fw_size = load_image_targphys_as(fname, info->firmware_base,
+                                     info->firmware_max_size, as, NULL);
+    if (fw_size <= 0) {
+        error_report("could not load firmware '%s'", firmware_filename);
+        exit(1);
+    }
+}
+
+static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info,
+                                    const char *firmware_filename)
 {
     /* Set up for booting firmware (which might load a kernel via fw_cfg) */
 
@@ -1273,6 +1354,10 @@ static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
         }
     }
 
+    if (info->confidential) {
+        arm_setup_confidential_firmware_boot(cpu, info, firmware_filename);
+    }
+
     /*
      * We will start from address 0 (typically a boot ROM image) in the
      * same way as hardware. Leave env->boot_info NULL, so that
@@ -1316,7 +1401,7 @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
 
     /* Load the kernel.  */
     if (!info->kernel_filename || info->firmware_loaded) {
-        arm_setup_firmware_boot(cpu, info);
+        arm_setup_firmware_boot(cpu, info, ms->firmware);
     } else {
         arm_setup_direct_kernel_boot(cpu, info);
     }