hw/nitro: Add nitro machine
Add a machine model to spawn a Nitro Enclave. Unlike the existing -M nitro-enclave, this machine model works exclusively with the -accel nitro accelerator to drive real Nitro Enclave creation. It supports memory allocation, number of CPU selection, both x86_64 as well as aarch64, implements the Enclave heartbeat logic and debug serial console. To use it, create an EIF file and run $ qemu-system-x86_64 -accel nitro,debug-mode=on -M nitro -nographic \ -kernel test.eif or $ qemu-system-aarch64 -accel nitro,debug-mode=on -M nitro -nographic \ -kernel test.eif Signed-off-by: Alexander Graf <graf@amazon.com> Link: https://lore.kernel.org/r/20260225220807.33092-9-graf@amazon.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Alexander Graf committed
Feb 25, 2026 at 22:08 UTC
0e7f6f6359c6204736b80d98e956cdeaf84f4534
5 files changed
+191
hw/nitro/Kconfig
+8
@@ -8,3 +8,11 @@ config NITRO_SERIAL_VSOCK
8
config NITRO_HEARTBEAT
9
bool
10
depends on NITRO_VSOCK_BUS
11
+
12
+config NITRO_MACHINE
13
+ bool
14
+ default y
15
+ depends on NITRO
16
+ select NITRO_VSOCK_BUS
17
+ select NITRO_HEARTBEAT
18
+ select NITRO_SERIAL_VSOCK
hw/nitro/machine.c
new
+161
@@ -0,0 +1,161 @@
1
+/*
2
+ * Nitro Enclaves (accel) machine
3
+ *
4
+ * Copyright © 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.
5
+ *
6
+ * Authors:
7
+ * Alexander Graf <graf@amazon.com>
8
+ *
9
+ * Nitro Enclaves machine model for -accel nitro. This machine behaves
10
+ * like the nitro-enclave machine, but uses the real Nitro Enclaves
11
+ * backend to launch the virtual machine. It requires use of the -accel
12
+ * nitro.
13
+ *
14
+ * SPDX-License-Identifier: GPL-2.0-or-later
15
+ */
16
+
17
+#include "qemu/osdep.h"
18
+#include "qemu/error-report.h"
19
+#include "qapi/error.h"
20
+#include "qom/object_interfaces.h"
21
+#include "chardev/char.h"
22
+#include "hw/core/boards.h"
23
+#include "hw/core/cpu.h"
24
+#include "hw/core/qdev-properties-system.h"
25
+#include "hw/nitro/heartbeat.h"
26
+#include "hw/nitro/machine.h"
27
+#include "hw/nitro/nitro-vsock-bus.h"
28
+#include "hw/nitro/serial-vsock.h"
29
+#include "system/address-spaces.h"
30
+#include "system/hostmem.h"
31
+#include "system/system.h"
32
+#include "system/nitro-accel.h"
33
+#include "qemu/accel.h"
34
+#include "hw/arm/machines-qom.h"
35
+
36
+#define EIF_LOAD_ADDR (8 * 1024 * 1024)
37
+
38
+static void nitro_machine_init(MachineState *machine)
39
+{
40
+ const char *eif_path = machine->kernel_filename;
41
+ const char *cpu_type = machine->cpu_type;
42
+ g_autofree char *eif_data = NULL;
43
+ gsize eif_size;
44
+
45
+ if (!nitro_enabled()) {
46
+ error_report("The 'nitro' machine requires -accel nitro");
47
+ exit(1);
48
+ }
49
+
50
+ if (!cpu_type) {
51
+ ObjectClass *oc = cpu_class_by_name(target_cpu_type(), "host");
52
+
53
+ if (!oc) {
54
+ error_report("nitro: no 'host' CPU available");
55
+ exit(1);
56
+ }
57
+ cpu_type = object_class_get_name(oc);
58
+ }
59
+
60
+ if (!eif_path) {
61
+ error_report("nitro: -kernel <eif-file> is required");
62
+ exit(1);
63
+ }
64
+
65
+ /* Expose memory as normal QEMU RAM. Needs to be huge page backed. */
66
+ memory_region_add_subregion(get_system_memory(), 0, machine->ram);
67
+
68
+ /*
69
+ * Load EIF (-kernel) as raw blob at the EIF_LOAD_ADDR into guest RAM.
70
+ * The Nitro Hypervisor will extract its contents and bootstrap the
71
+ * Enclave from it.
72
+ */
73
+ if (!g_file_get_contents(eif_path, &eif_data, &eif_size, NULL)) {
74
+ error_report("nitro: failed to read EIF '%s'", eif_path);
75
+ exit(1);
76
+ }
77
+ address_space_write(&address_space_memory, EIF_LOAD_ADDR,
78
+ MEMTXATTRS_UNSPECIFIED, eif_data, eif_size);
79
+
80
+ if (defaults_enabled()) {
81
+ NitroVsockBridge *bridge = nitro_vsock_bridge_create();
82
+
83
+ /* Nitro Enclaves require a heartbeat device. Provide one. */
84
+ qdev_realize(qdev_new(TYPE_NITRO_HEARTBEAT),
85
+ BUS(&bridge->bus), &error_fatal);
86
+
87
+ /*
88
+ * In debug mode, Nitro Enclaves expose the guest's serial output via
89
+ * vsock. When the accel is in debug mode, wire the vsock serial to
90
+ * the machine's serial port so that -nographic automatically works
91
+ */
92
+ if (object_property_get_bool(OBJECT(current_accel()), "debug-mode", NULL)) {
93
+ Chardev *chr = serial_hd(0);
94
+
95
+ if (chr) {
96
+ DeviceState *dev = qdev_new(TYPE_NITRO_SERIAL_VSOCK);
97
+
98
+ qdev_prop_set_chr(dev, "chardev", chr);
99
+ qdev_realize(dev, BUS(&bridge->bus), &error_fatal);
100
+ }
101
+ }
102
+ }
103
+}
104
+
105
+static bool nitro_create_memfd_backend(MachineState *ms, const char *path,
106
+ Error **errp)
107
+{
108
+ MachineClass *mc = MACHINE_GET_CLASS(ms);
109
+ Object *root = object_get_objects_root();
110
+ Object *obj;
111
+ bool r = false;
112
+
113
+ obj = object_new(TYPE_MEMORY_BACKEND_MEMFD);
114
+
115
+ /* Nitro Enclaves require huge page backing */
116
+ if (!object_property_set_int(obj, "size", ms->ram_size, errp) ||
117
+ !object_property_set_bool(obj, "hugetlb", true, errp)) {
118
+ goto out;
119
+ }
120
+
121
+ object_property_add_child(root, mc->default_ram_id, obj);
122
+
123
+ if (!user_creatable_complete(USER_CREATABLE(obj), errp)) {
124
+ goto out;
125
+ }
126
+ r = object_property_set_link(OBJECT(ms), "memory-backend", obj, errp);
127
+
128
+out:
129
+ object_unref(obj);
130
+ return r;
131
+}
132
+
133
+static void nitro_machine_class_init(ObjectClass *oc, const void *data)
134
+{
135
+ MachineClass *mc = MACHINE_CLASS(oc);
136
+
137
+ mc->desc = "Nitro Enclave";
138
+ mc->init = nitro_machine_init;
139
+ mc->create_default_memdev = nitro_create_memfd_backend;
140
+ mc->default_ram_id = "ram";
141
+ mc->max_cpus = 4096;
142
+}
143
+
144
+static const TypeInfo nitro_machine_info = {
145
+ .name = TYPE_NITRO_MACHINE,
146
+ .parent = TYPE_MACHINE,
147
+ .instance_size = sizeof(NitroMachineState),
148
+ .class_init = nitro_machine_class_init,
149
+ .interfaces = (const InterfaceInfo[]) {
150
+ /* x86_64 and aarch64 only */
151
+ { TYPE_TARGET_AARCH64_MACHINE },
152
+ { }
153
+ },
154
+};
155
+
156
+static void nitro_machine_register(void)
157
+{
158
+ type_register_static(&nitro_machine_info);
159
+}
160
+
161
+type_init(nitro_machine_register);
hw/nitro/meson.build
+1
@@ -1,3 +1,4 @@
1
system_ss.add(when: 'CONFIG_NITRO_VSOCK_BUS', if_true: files('nitro-vsock-bus.c'))
2
system_ss.add(when: 'CONFIG_NITRO_SERIAL_VSOCK', if_true: files('serial-vsock.c'))
3
system_ss.add(when: 'CONFIG_NITRO_HEARTBEAT', if_true: files('heartbeat.c'))
4
+system_ss.add(when: 'CONFIG_NITRO_MACHINE', if_true: files('machine.c'))
include/hw/nitro/machine.h
new
+20
@@ -0,0 +1,20 @@
1
+/*
2
+ * Nitro Enclaves (accel) machine
3
+ *
4
+ * SPDX-License-Identifier: GPL-2.0-or-later
5
+ */
6
+
7
+#ifndef HW_NITRO_MACHINE_H
8
+#define HW_NITRO_MACHINE_H
9
+
10
+#include "hw/core/boards.h"
11
+#include "qom/object.h"
12
+
13
+#define TYPE_NITRO_MACHINE MACHINE_TYPE_NAME("nitro")
14
+OBJECT_DECLARE_SIMPLE_TYPE(NitroMachineState, NITRO_MACHINE)
15
+
16
+struct NitroMachineState {
17
+ MachineState parent;
18
+};
19
+
20
+#endif /* HW_NITRO_MACHINE_H */
tests/qtest/libqtest.c
+1
@@ -1815,6 +1815,7 @@ void qtest_cb_for_every_machine(void (*cb)(const char *machine),
1815
g_str_equal("xenpv", machines[i].name) ||
1816
g_str_equal("xenpvh", machines[i].name) ||
1817
g_str_equal("vmapple", machines[i].name) ||
1818
+ g_str_equal("nitro", machines[i].name) ||
1819
g_str_equal("nitro-enclave", machines[i].name)) {
1820
continue;
1821
}