KVM gains Arm CCA support for confidential Realm VMs

Arm engineers have posted the sixteenth revision of a 45-patch series that adds KVM support for protected virtual machines under the Arm Confidential Compute Architecture (CCA). The work lets a host create and run Realm VMs whose memory and CPU state stay inaccessible to the normal hypervisor, talking to Arm’s Realm Management Monitor (RMM) firmware over the Realm Management Interface.

Confidential computing on Arm has trailed x86 offerings such as AMD SEV and Intel TDX. Realms close that gap by placing guest memory under RMM control so that even a compromised host kernel cannot inspect or tamper with it. Steven Price of Arm is driving the series, which implements the RMM 2.0 beta 2 specification and is expected to stay largely compatible with the imminent beta 3 release.

The first patches introduce a generic firmware layer for RMI calls: discovery and configuration of the RMM, wrappers for the interface, and Stateful RMI Operations that can span multiple secure-monitor calls while the RMM borrows or returns host memory. The remainder of the series extends KVM so userspace can create Realm VMs, populate their memory, and run them inside the ordinary KVM run loop. Realm entry and exit, timers, PSCI, MMIO emulation, and guest-to-host calls are all adapted to that path.

Several limits remain. Physical device assignment is deliberately left out and will arrive in a later series; for now KVM refuses to map device pages into a Realm. The RMM only lets the VMM set general-purpose registers and the program counter, SError injection into Realms is forbidden, and Realm support is advertised only on systems that provide the GICv3 trap bit required for safe interrupt handling. Userspace discovers the feature through KVM_CAP_ARM_RMI, creates Realms with a dedicated VM type, and configures breakpoints, watchpoints and SVE vector length from values reported by the RMM before the Realm is activated.