From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id EDC43C4345F for ; Fri, 12 Apr 2024 08:41:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=BaLePXWX8hHTTUh1X85DEkCNdWbBSqf0iq9tWjZ2aVs=; b=SCWmg0rbt0eEai C3QfJacIwOPbWHkJynkRDHJUt55ivyTZkQK3lk4o0lf64eDNbVVArcL6etXnlXkZPmiCaAMG+K6wu s4RFQUPZfa3cCu5opaLH6DQqpIhcANEjkN3AgGvQlvFe+QjIImE1kdC8DZBvrb6/+hfkulzNsmKXT tPLJZ/0ZvBo1RtSGpUJxLqRm6MvDfKcKcoorgYOqj0Xf9zxBn4O0n9oUTEWNwi1mc+BuOeQ5ONuhr CfeayEZnnLJblMkMA2oay/F8ketvIrfcCIncgNaCfdyj4uJ1sIlQ1RPTOszhDFuZTf8BjiFWlYmQn Nq/rHpJXNpbib1Vz0eYw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rvCTN-0000000G6vD-1UT9; Fri, 12 Apr 2024 08:41:25 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rvCTJ-0000000G6ud-3T3w for linux-arm-kernel@lists.infradead.org; Fri, 12 Apr 2024 08:41:23 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D7890339; Fri, 12 Apr 2024 01:41:47 -0700 (PDT) Received: from e112269-lin.cambridge.arm.com (e112269-lin.cambridge.arm.com [10.1.194.51]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 7EDFC3F6C4; Fri, 12 Apr 2024 01:41:16 -0700 (PDT) From: Steven Price To: kvm@vger.kernel.org, kvmarm@lists.linux.dev Cc: Steven Price , Catalin Marinas , Marc Zyngier , Will Deacon , James Morse , Oliver Upton , Suzuki K Poulose , Zenghui Yu , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Joey Gouly , Alexandru Elisei , Christoffer Dall , Fuad Tabba , linux-coco@lists.linux.dev, Ganapatrao Kulkarni Subject: [v2] Support for Arm CCA VMs on Linux Date: Fri, 12 Apr 2024 09:40:56 +0100 Message-Id: <20240412084056.1733704-1-steven.price@arm.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240412_014121_975694_BE2188B8 X-CRM114-Status: GOOD ( 11.05 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org We are happy to announce the second version of the Arm Confidential Compute Architecture (CCA) support for the Linux stack. The intention is to seek early feedback in the following areas: * KVM integration of the Arm CCA; * KVM UABI for managing the Realms, seeking to generalise the operations where possible with other Confidential Compute solutions; * Linux Guest support for Realms. See the previous RFC[1] for a more detailed overview of Arm's CCA solution, or visible the Arm CCA Landing page[2]. This series is based on the final RMM v1.0 (EAC5) specification[3]. Quick-start guide ================= The easiest way of getting started with the stack is by using Shrinkwrap[4]. Currently Shrinkwrap has a configuration for the initial v1.0-EAC5 release[5], so the following overlay needs to be applied to the standard 'cca-3world.yaml' file. Note that the 'rmm' component needs updating to 'main' because there are fixes that are needed and are not yet in a tagged release. The following will create an overlay file and build a working environment: cat<cca-v2.yaml build: linux: repo: revision: cca-full/v2 kvmtool: repo: kvmtool: revision: cca/v2 rmm: repo: revision: main kvm-unit-tests: repo: revision: cca/v2 EOT shrinkwrap build cca-3world.yaml --overlay buildroot.yaml --btvar GUEST_ROOTFS='${artifact:BUILDROOT}' --overlay cca-v2.yaml You will then want to modify the 'guest-disk.img' to include the files necessary for the realm guest (see the documentation in cca-3world.yaml for details of other options): cd ~/.shrinkwrap/package/cca-3world /sbin/e2fsck -fp rootfs.ext2 /sbin/resize2fs rootfs.ext2 256M mkdir mnt sudo mount rootfs.ext2 mnt/ sudo mkdir mnt/cca sudo cp guest-disk.img KVMTOOL_EFI.fd lkvm Image mnt/cca/ sudo umount mnt rmdir mnt/ Finally you can run the FVP with the host: shrinkwrap run cca-3world.yaml --rtvar ROOTFS=$HOME/.shrinkwrap/package/cca-3world/rootfs.ext2 And once the host kernel has booted, login (user name 'root') and start a realm guest: cd /cca ./lkvm run --realm --restricted_mem -c 2 -m 256 -k Image -p earlycon Be patient and you should end up in a realm guest with the host's filesystem mounted via p9. It's also possible to use EFI within the realm guest, again see cca-3world.yaml within Shrinkwrap for more details. An branch of kvm-unit-tests including realm-specific tests is provided here: https://gitlab.arm.com/linux-arm/kvm-unit-tests-cca/-/tree/cca/v2 [1] Previous RFC https://lore.kernel.org/r/20230127112248.136810-1-suzuki.poulose%40arm.com [2] Arm CCA Landing page (See Key Resources section for various documentation) https://www.arm.com/architecture/security-features/arm-confidential-compute-architecture [3] RMM v1.0-EAC5 specification https://developer.arm.com/documentation/den0137/1-0eac5/ [4] Shrinkwrap https://git.gitlab.arm.com/tooling/shrinkwrap [5] Linux support for Arm CCA RMM v1.0-EAC5 https://lore.kernel.org/r/fb259449-026e-4083-a02b-f8a4ebea1f87%40arm.com _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel