From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 85585C4345F for ; Mon, 15 Apr 2024 03:53:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=2jaDJVZqL3lRyEDlwgg1NbQCwGYC0lKXQv3yEcv+hpU=; b=YgucWV94FmCBac I7Sone/6TSqzWQdaotgk2Ruh050W3ZQpmtOCXSfcHxFTtOl8TWczpzFfJRdQWtZtV5hHl9Cq9s5j3 cQSErYJuH2uXmZsuiEqLSq+B8UkKKZLR73E6RzrLE+6wNXSSPu8UYSUoGOK1yzzAtDP9Ct8qbFbGM /Se7mvNzS84vUbHK9sZSb7tCB8+V8WeqQdyl1SRfk0MOOB+FSGxfkP3Lea5K8GjQiv5IJ8pU/OtU+ xc/nejPbGvxh34r2XScitWGkJ/0/76hG8PFla6Un4G8n8AyYSydvb0R2cESK7Y67CX6a2XDp4HW59 a3UQ81RrJ8F9zZ+skK6w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rwDP1-00000006tmw-1RBh; Mon, 15 Apr 2024 03:53:07 +0000 Received: from out-170.mta1.migadu.com ([95.215.58.170]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rwDOx-00000006tmJ-2pqX for linux-arm-kernel@lists.infradead.org; Mon, 15 Apr 2024 03:53:05 +0000 Date: Fri, 12 Apr 2024 03:54:12 +0900 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1713153178; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Sp9uhHvSslbHFr0rV64RPlTRaApRy5n5koOI6A6IDog=; b=TkkCWgG9peqecfy6NrOEHHcavSOBgxVDo+CQStt76qokqk/hP9jC0Xj9e9xA4CwZmdARvO 4Hx0GSDLANCphBT9s8H5rv4I4lEvb7/2ajvk2a2hZxNbPH7itzOmmKZYMtVJAiBYpNlrEe Lk4bTeCdzAHLMFKQVUi9QJNdB8BRwws= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Itaru Kitayama To: Steven Price Cc: kvm@vger.kernel.org, kvmarm@lists.linux.dev, Catalin Marinas , Marc Zyngier , Will Deacon , James Morse , Oliver Upton , Suzuki K Poulose , Zenghui Yu , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Joey Gouly , Alexandru Elisei , Christoffer Dall , Fuad Tabba , linux-coco@lists.linux.dev, Ganapatrao Kulkarni Subject: Re: [v2] Support for Arm CCA VMs on Linux Message-ID: References: <20240412084056.1733704-1-steven.price@arm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20240412084056.1733704-1-steven.price@arm.com> X-Migadu-Flow: FLOW_OUT X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240414_205304_456100_DD16C2CB X-CRM114-Status: GOOD ( 24.98 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Steven, On Fri, Apr 12, 2024 at 09:40:56AM +0100, Steven Price wrote: > We are happy to announce the second version of the Arm Confidential > Compute Architecture (CCA) support for the Linux stack. The intention is > to seek early feedback in the following areas: > * KVM integration of the Arm CCA; > * KVM UABI for managing the Realms, seeking to generalise the > operations where possible with other Confidential Compute solutions; > * Linux Guest support for Realms. > > See the previous RFC[1] for a more detailed overview of Arm's CCA > solution, or visible the Arm CCA Landing page[2]. > > This series is based on the final RMM v1.0 (EAC5) specification[3]. It's great to see the updated "V2" series. Since you said you like "early" feedback on V2, does that mean it's likely to be followed by V3 and V4, anticipating large code-base changes from the current form (V2)? Do you have a rough timeframe to make this Arm CCA support landed in mainline? Do you Arm folk expect this is going to be a multiple-year long project? Thanks, Itaru. > > Quick-start guide > ================= > > The easiest way of getting started with the stack is by using > Shrinkwrap[4]. Currently Shrinkwrap has a configuration for the initial > v1.0-EAC5 release[5], so the following overlay needs to be applied to > the standard 'cca-3world.yaml' file. Note that the 'rmm' component needs > updating to 'main' because there are fixes that are needed and are not > yet in a tagged release. The following will create an overlay file and > build a working environment: > > cat<cca-v2.yaml > build: > linux: > repo: > revision: cca-full/v2 > kvmtool: > repo: > kvmtool: > revision: cca/v2 > rmm: > repo: > revision: main > kvm-unit-tests: > repo: > revision: cca/v2 > EOT > > shrinkwrap build cca-3world.yaml --overlay buildroot.yaml --btvar GUEST_ROOTFS='${artifact:BUILDROOT}' --overlay cca-v2.yaml > > You will then want to modify the 'guest-disk.img' to include the files > necessary for the realm guest (see the documentation in cca-3world.yaml > for details of other options): > > cd ~/.shrinkwrap/package/cca-3world > /sbin/e2fsck -fp rootfs.ext2 > /sbin/resize2fs rootfs.ext2 256M > mkdir mnt > sudo mount rootfs.ext2 mnt/ > sudo mkdir mnt/cca > sudo cp guest-disk.img KVMTOOL_EFI.fd lkvm Image mnt/cca/ > sudo umount mnt > rmdir mnt/ > > Finally you can run the FVP with the host: > > shrinkwrap run cca-3world.yaml --rtvar ROOTFS=$HOME/.shrinkwrap/package/cca-3world/rootfs.ext2 > > And once the host kernel has booted, login (user name 'root') and start > a realm guest: > > cd /cca > ./lkvm run --realm --restricted_mem -c 2 -m 256 -k Image -p earlycon > > Be patient and you should end up in a realm guest with the host's > filesystem mounted via p9. > > It's also possible to use EFI within the realm guest, again see > cca-3world.yaml within Shrinkwrap for more details. > > An branch of kvm-unit-tests including realm-specific tests is provided > here: > https://gitlab.arm.com/linux-arm/kvm-unit-tests-cca/-/tree/cca/v2 > > [1] Previous RFC > https://lore.kernel.org/r/20230127112248.136810-1-suzuki.poulose%40arm.com > [2] Arm CCA Landing page (See Key Resources section for various documentation) > https://www.arm.com/architecture/security-features/arm-confidential-compute-architecture > [3] RMM v1.0-EAC5 specification > https://developer.arm.com/documentation/den0137/1-0eac5/ > [4] Shrinkwrap > https://git.gitlab.arm.com/tooling/shrinkwrap > [5] Linux support for Arm CCA RMM v1.0-EAC5 > https://lore.kernel.org/r/fb259449-026e-4083-a02b-f8a4ebea1f87%40arm.com _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel