.. # Copyright (c) 2023, Arm Limited. # # SPDX-License-Identifier: MIT ############### cca-3world.yaml ############### Description ########### Brings together a software stack to demonstrate Arm CCA running on FVP in a three-world configuration. Includes TF-A in root world, RMM in realm world, and EDK2 and Linux in Normal world on the host. Guests can be launched in-realm in a number of configurations using kvmtool. EDK2 can be optionally used as guest FW. If the user provides an ext2/4 filesystem image via the GUEST_ROOTFS btvar, a guest disk image is created that includes a FAT16 partition containing the guest kernel (to be loaded by the guest EDK2 FW), and the provided filesystem as the rootfs. The user can provide their own filesystem image, or alternatively use a simple buildroot image created with buildroot.yaml: .. code-block:: shell $ shrinkwrap build cca-3world.yaml --overlay buildroot.yaml --btvar GUEST_ROOTFS='${artifact:BUILDROOT}' The user can also control the guest kernel command line parameters used on the guest disk image via the GUEST_CMDLINE btvar. Once built, the user must get some of the generated artifacts into the FVP environment. This can either be done by copying them to the host's rootfs or by sharing them into the FVP using 9p. kvmtool cannot reliably map the guest disk directly over 9p, so copy guest-disk.img to host-local storage before launching a Realm. The following example copies the artifacts into the host rootfs. For simplicity, it reuses the guest filesystem generated with buildroot as the host rootfs, after resizing it so that there is room for the guest's rootfs: .. code-block:: shell $ cd ~/.shrinkwrap/package/cca-3world $ TOOLS_PATH=~/.shrinkwrap/build/build/cca-3world/buildroot/host/sbin $ $TOOLS_PATH/e2fsck -fp rootfs.ext2 $ $TOOLS_PATH/resize2fs rootfs.ext2 256M $ sudo su # mkdir mnt # mount rootfs.ext2 mnt # mkdir mnt/cca # cp guest-disk.img KVMTOOL_EFI.fd lkvm mnt/cca/. # umount mnt # rm -rf mnt # exit Now you can boot the host, using the rootfs we just modified, either using DT: .. code-block:: shell $ shrinkwrap run cca-3world.yaml --rtvar ROOTFS=rootfs.ext2 Or alternatively, using ACPI: .. code-block:: shell $ shrinkwrap run cca-3world.yaml -r ROOTFS=rootfs.ext2 --rtvar CMDLINE="mem=1G earlycon root=/dev/vda ip=dhcp acpi=force" Finally, once the host has booted, log in as "root" (no password), and launch a realm using kvmtool from the /cca directory (that was created above): .. code-block:: shell # cd /cca # ./lkvm run --realm --irqchip=gicv3-its --firmware KVMTOOL_EFI.fd -c 1 -m 512 --no-pvtime --force-pci --disk guest-disk.img Be patient while this boots to the UEFI shell. Navigate to "Boot Manager", then "UEFI Shell" and wait for the startup.nsh script to execute, which will launch the kernel. Continue to be patient, and eventually you will land at a login prompt. Login as "root" (no password). Alternatively, the package can be shared with the host using the SHARE rtvar. This only works for DT-based environments: .. code-block:: shell $ cd ~/.shrinkwrap/package/cca-3world $ shrinkwrap run cca-3world.yaml --rtvar ROOTFS=rootfs.ext2 --rtvar SHARE=. Once the host has booted, log in as "root" (no password), mount the shared folder to "/cca", and copy the guest disk to host-local storage before launching the Realm: .. code-block:: shell # mkdir /cca # mount -t 9p -o trans=virtio,version=9p2000.L FM /cca # cd /cca # cp guest-disk.img /tmp/guest-disk.img # ./lkvm run --realm --irqchip=gicv3-its --firmware KVMTOOL_EFI.fd -c 1 -m 512 --no-pvtime --force-pci --disk /tmp/guest-disk.img It is also possible to launch Linux without using EDK2 as the guest FW: .. code-block:: shell # ./lkvm run --realm --irqchip=gicv3-its -c 1 -m 512 --no-pvtime --force-pci --console virtio --kernel Image --disk /tmp/guest-disk.img -p "console=hvc0 root=/dev/vda2 swiotlb=65536" Direct kernel boot otherwise reduces the SWIOTLB to 1 MiB, which is too small for Realm virtio I/O. The EDK2 boot path retains the kernel's 64 MiB default and does not need this override. This config also builds kvm-unit-tests and packages its upstream Realm test runner. A small kvmtool adapter adds ``--no-pvtime`` and runs every supported test. Realm PMU tests are explicitly skipped because RMM v2.0 disables PMU support: .. code-block:: shell # cd /cca # REAL_LKVM=./lkvm LKVM=./cca-realm-lkvm ./kvm-unit-tests/arm/run-realm-tests -d ./kvm-unit-tests/arm Build-Time Variables #################### ============= =============================== ============== btvar default options ============= =============================== ============== EDK2_BUILD RELEASE DEBUG, RELEASE GUEST_CMDLINE root=/dev/vda2 acpi=force ip=on GUEST_ROOTFS RMM_BASE 0xFDC00000 RMM_BUILD Release Debug, Release RMM_LOG_LEVEL 40 TFA_BUILD release debug, release TFA_LOG_LEVEL 40 ============= =============================== ============== Run-Time Variables ################## ============== ================================================================================ ========== rtvar default options ============== ================================================================================ ========== BL1 ${artifact:BL1} CMDLINE console=ttyAMA0 earlycon=pl011,0x1c090000 root=/dev/vda ip=dhcp kvm-arm.mode=rmm DTB ${artifact:DTB} EDK2FLASH /dev/null FIP ${artifact:FIP} KERNEL ${artifact:KERNEL} LOCAL_NET_PORT 8022 ROOTFS SHARE ============== ================================================================================ ========== Components ########## ================= ================================================================================== ======================================== component repository revision ================= ================================================================================== ======================================== acpica https://github.com/acpica/acpica.git 20260408 dt https://git.kernel.org/pub/scm/linux/kernel/git/devicetree/devicetree-rebasing.git v7.2-dts edk2 https://git.gitlab.arm.com/linux-arm/edk2-cca.git 3223_arm_cca_v4 edk2-cca-guest https://git.gitlab.arm.com/linux-arm/edk2-cca.git 3223_arm_cca_v4 edk2-platforms https://git.gitlab.arm.com/linux-arm/edk2-platforms-cca.git 3223_arm_cca_v4 kvm-unit-tests https://gitlab.arm.com/linux-arm/kvm-unit-tests-cca cca-rmm-v2.0 kvmtool (dtc) https://git.kernel.org/pub/scm/utils/dtc/dtc.git v1.7.2 kvmtool (kvmtool) https://gitlab.arm.com/linux-arm/kvmtool-cca cca-kvm-v20 linux https://git.gitlab.arm.com/linux-arm/linux-cca.git 16b5782a3f8fc9b6c796662c84fcc3af1d575157 rmm https://git.trustedfirmware.org/TF-RMM/tf-rmm.git eba8e742128079135cfbce3de3256c5d326b530b tfa https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git v2.15.0 ================= ================================================================================== ========================================