cca-3world.yaml
Description
Brings together a software stack to demonstrate Arm CCA running on FVP in a three-world configuration. Includes TF-A in root world, RMM in realm world, and EDK2 and Linux in Normal world on the host. Guests can be launched in-realm in a number of configurations using kvmtool. EDK2 can be optionally used as guest FW.
If the user provides an ext2/4 filesystem image via the GUEST_ROOTFS btvar, a guest disk image is created that includes a FAT16 partition containing the guest kernel (to be loaded by the guest EDK2 FW), and the provided filesystem as the rootfs. The user can provide their own filesystem image, or alternatively use a simple buildroot image created with buildroot.yaml:
$ shrinkwrap build cca-3world.yaml --overlay buildroot.yaml --btvar GUEST_ROOTFS='${artifact:BUILDROOT}'
The user can also control the guest kernel command line parameters used on the guest disk image via the GUEST_CMDLINE btvar.
Once built, the user must get some of the generated artifacts into the FVP environment. This can either be done by copying them to the host’s rootfs or by sharing them into the FVP using 9p. kvmtool cannot reliably map the guest disk directly over 9p, so copy guest-disk.img to host-local storage before launching a Realm.
The following example copies the artifacts into the host rootfs. For simplicity, it reuses the guest filesystem generated with buildroot as the host rootfs, after resizing it so that there is room for the guest’s rootfs:
$ cd ~/.shrinkwrap/package/cca-3world
$ TOOLS_PATH=~/.shrinkwrap/build/build/cca-3world/buildroot/host/sbin
$ $TOOLS_PATH/e2fsck -fp rootfs.ext2
$ $TOOLS_PATH/resize2fs rootfs.ext2 256M
$ sudo su
# mkdir mnt
# mount rootfs.ext2 mnt
# mkdir mnt/cca
# cp guest-disk.img KVMTOOL_EFI.fd lkvm mnt/cca/.
# umount mnt
# rm -rf mnt
# exit
Now you can boot the host, using the rootfs we just modified, either using DT:
$ shrinkwrap run cca-3world.yaml --rtvar ROOTFS=rootfs.ext2
Or alternatively, using ACPI:
$ shrinkwrap run cca-3world.yaml -r ROOTFS=rootfs.ext2 --rtvar CMDLINE="mem=1G earlycon root=/dev/vda ip=dhcp acpi=force"
Finally, once the host has booted, log in as “root” (no password), and launch a realm using kvmtool from the /cca directory (that was created above):
# cd /cca
# ./lkvm run --realm --irqchip=gicv3-its --firmware KVMTOOL_EFI.fd -c 1 -m 512 --no-pvtime --force-pci --disk guest-disk.img
Be patient while this boots to the UEFI shell. Navigate to “Boot Manager”, then “UEFI Shell” and wait for the startup.nsh script to execute, which will launch the kernel. Continue to be patient, and eventually you will land at a login prompt. Login as “root” (no password).
Alternatively, the package can be shared with the host using the SHARE rtvar. This only works for DT-based environments:
$ cd ~/.shrinkwrap/package/cca-3world
$ shrinkwrap run cca-3world.yaml --rtvar ROOTFS=rootfs.ext2 --rtvar SHARE=.
Once the host has booted, log in as “root” (no password), mount the shared folder to “/cca”, and copy the guest disk to host-local storage before launching the Realm:
# mkdir /cca
# mount -t 9p -o trans=virtio,version=9p2000.L FM /cca
# cd /cca
# cp guest-disk.img /tmp/guest-disk.img
# ./lkvm run --realm --irqchip=gicv3-its --firmware KVMTOOL_EFI.fd -c 1 -m 512 --no-pvtime --force-pci --disk /tmp/guest-disk.img
It is also possible to launch Linux without using EDK2 as the guest FW:
# ./lkvm run --realm --irqchip=gicv3-its -c 1 -m 512 --no-pvtime --force-pci --console virtio --kernel Image --disk /tmp/guest-disk.img -p "console=hvc0 root=/dev/vda2 swiotlb=65536"
Direct kernel boot otherwise reduces the SWIOTLB to 1 MiB, which is too small for Realm virtio I/O. The EDK2 boot path retains the kernel’s 64 MiB default and does not need this override.
This config also builds kvm-unit-tests and packages its upstream Realm test runner. A small kvmtool adapter removes its obsolete restricted-memory option and selects the basic setup smoke case, which covers SMP and memory. memstress is deliberately disabled because its shared 4K case triggers a host Granule Protection Fault on the current Linux v13, kvmtool v11, and RMM v0.9.0 stack:
# cd /cca
# REAL_LKVM=./lkvm LKVM=./cca-realm-lkvm ./kvm-unit-tests/arm/run-realm-tests -d ./kvm-unit-tests/arm
Build-Time Variables
btvar |
default |
options |
|---|---|---|
EDK2_BUILD |
RELEASE |
DEBUG, RELEASE |
GUEST_CMDLINE |
root=/dev/vda2 acpi=force ip=on |
<required> |
GUEST_ROOTFS |
<empty> |
<required> |
RMM_BASE |
0xFDC00000 |
<required> |
RMM_BUILD |
Release |
Debug, Release |
RMM_LOG_LEVEL |
40 |
<required> |
TFA_BUILD |
release |
debug, release |
TFA_LOG_LEVEL |
40 |
<required> |
Run-Time Variables
rtvar |
default |
options |
|---|---|---|
BL1 |
${artifact:BL1} |
<required> |
CMDLINE |
console=ttyAMA0 earlycon=pl011,0x1c090000 root=/dev/vda ip=dhcp |
<required> |
DTB |
${artifact:DTB} |
<required> |
EDK2FLASH |
/dev/null |
<required> |
FIP |
${artifact:FIP} |
<required> |
KERNEL |
${artifact:KERNEL} |
<required> |
LOCAL_NET_PORT |
8022 |
<required> |
ROOTFS |
<empty> |
<required> |
SHARE |
<empty> |
<required> |
Components
component |
repository |
revision |
|---|---|---|
acpica |
20260408 |
|
dt |
https://git.kernel.org/pub/scm/linux/kernel/git/devicetree/devicetree-rebasing.git |
v7.2-dts |
edk2 |
3223_arm_cca_v4 |
|
edk2-cca-guest |
3223_arm_cca_v4 |
|
edk2-platforms |
3223_arm_cca_v4 |
|
kvm-unit-tests |
cca/rmm-v1.0-rel0 |
|
kvmtool (dtc) |
v1.7.2 |
|
kvmtool (kvmtool) |
cca/v11 |
|
linux |
cca-host/v13 |
|
rmm |
tf-rmm-v0.9.0 |
|
tfa |
v2.15.0 |