zhuyifan111solutions/confidential-migvm: use hardware true random (RNDRRS + RNDR)

文件	最后提交记录	最后更新时间
.cargo	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
docs	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
sh_script	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
src	solutions/confidential-migvm: use hardware true random (RNDRRS + RNDR) Replace the weak pseudo-random generator (misnamed chacha20, 64-bit state seeded only from cntvct_el0) with ARM hardware true random numbers. Strategy (3-tier fallback in rand_u64): 1. RNDRRS (reseeded, higher entropy) — retry up to 8 times, return on first valid sample 2. RNDR — single read as fallback when RNDRRS keeps failing 3. splitmix64 software PRNG — last-resort for TCG test environments Implementation notes: - Detect RNDR/RNDRRS via ID_AA64ISAR0_EL1 before use to avoid UNDEFINED exception on cores without the Random Number Extension. - Read RNDR via system register encoding S3_3_C2_C4_0 and RNDRRS via S3_3_C2_C4_1 (the LLVM assembler does not accept the mnemonic form). - Check the V condition flag (cset vc) for success per ARM spec. - Filter 0 returns in both rndr_read() and rndrrs_read(): some VirtCCA TMM implementations misreport the V flag on RNDRRS (set V=0/success while returning 0 when the reseed source is temporarily not ready). Treat 0 as failure to avoid feeding fake randomness upstream. - init() retries RNDR up to 8 times before declaring it unavailable. - main.rs prints 16 samples each for RNDR and RNDRRS at boot for diagnosis. Verified on aarch64 VirtCCA host: - RNDR: 16/16 non-zero, all distinct - RNDRRS: 8 non-zero + 8 filtered-to-X (0 returns correctly rejected) - DHCP + TCP listen on 5001/5002: PASS - QEMU TCG: RNDR/RNDRRS unavailable, software PRNG fallback, boot PASS	21 天前
.gitignore	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
Cargo.lock	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
Cargo.toml	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
LICENSE	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
README.md	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
README_CN.md	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
aarch64-qemu.ld	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前
minimal_test.ld	solutions: add confidential-migvm — AArch64 bare-metal RA-TLS state machine Import the migvm-aarch64 project (a bare-metal `#![no_std]` payload derived from migtd) into solutions/confidential-migvm. This is the low-TCB state machine used in confidential VM live-migration to perform RA-TLS and exchange the migration session key on ARM CCA / VirtCCA. Highlights: - AArch64 port: GICv3, FDT-driven MMU/paging, virtio-mmio + PCIe enumeration, virtio-net modern with DHCP/TCP, timer, TRNG, vsock - Dual license strategy: 3 generic stub files retain Intel BSD-2-Clause-Patent; 25 AArch64-specific files now carry Huawei Mulan PSL v2; LICENSE file holds both texts; Cargo.toml license = "BSD-2-Clause-Patent AND Mulan-PSL-2.0" - Renamed migtd/td keywords to migvm/cvm across code/scripts/docs (architecture comparison section in aarch64_port_summary.md intentionally preserved) - QEMU launch script with TCG/KVM auto-detect, default QEMU_BIN=/bin/qemu-kvm - Chinese README (README_CN.md) plus language-switch links - Verified: cargo build + TCG boot (FDT -> GICv3 -> MMU -> PCIe -> virtio-net -> DHCP 10.0.2.15 -> TCP listen on 5001/5002) all green; KVM/VirtCCA/CCA-realm require a host with /dev/kvm	22 天前

MigVM AArch64

面向 CCA（ARM v9 Realm）与 VirtCCA（ARM v8 TrustZone）机密虚拟机迁移的独立裸机载荷（payload）。

快速开始

# 编译
cargo build --release --target aarch64-unknown-none

# 在 QEMU 上运行
bash sh_script/qemu.sh run

# VirtCCA 客户机模式
cargo build --release --features virtcca --target aarch64-unknown-none
bash sh_script/qemu.sh virtcca

# CCA Realm 模式（待硬件就绪）
cargo build --release --features cca --target aarch64-unknown-none

功能特性

Feature	说明
`default`	普通 QVM 虚拟机（非机密计算）
`virtcca`	VirtCCA 客户机模式（ARM v8 TrustZone S-EL2，TSI SMC 调用）
`cca`	CCA Realm 模式（ARM v9，RSI SMC 调用）

架构

AArch64 启动 (exception.S) → MMU 初始化 → FDT 解析 → GICv3 初始化 → 定时器初始化
    → PCIe 枚举 → VirtIO-net + VirtIO-vsock → smoltcp DHCP → TCP 5001/5002

文档

环境要求

Rust nightly 工具链，目标平台 aarch64-unknown-none
QEMU 8.2+（需提供 qemu-system-aarch64）
VirtCCA 运行环境：KVM 启用 kvm-type=cvm + TMM 固件

验证状态

环境	DHCP	TCP	定时器	TSI	MMU
KVM + GICv3	✅	✅	✅ 30s	N/A	✅
VirtCCA	✅	✅	✅	✅ 11/11	✅
CCA Realm	⚠️	⚠️	⚠️	⚠️ 代码就绪	⚠️

许可证

本项目采用双重许可：

BSD-2-Clause-Patent — 适用于保留原始 Intel 版权的文件（通用存根 / 标准模板：src/acpi.rs、src/mm/layout.rs、src/mm/heap.rs）。
Mulan Permissive Software License v2（木兰宽松许可证 v2，Mulan PSL v2） — 适用于所有其它源文件（AArch64 特有实现），持有华为技术有限公司版权。

完整许可证文本请参见 LICENSE 文件。每个源文件头部声明了其适用的许可证。

本项目基于 Intel x86 机密虚拟机迁移项目衍生，针对 ARMv8/ARMv9 CCA/VirtCCA 机密虚拟机迁移场景进行了适配与扩展。架构对比与移植细节详见移植概览。