TF-A needs to be patched to enable support for FEAT_TCR2 and
FEAT_SCTLR2. This new image contains updated firmware.
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
tests/functional/test_aarch64_rme_sbsaref.py | 64 ++++++++-------
tests/functional/test_aarch64_rme_virt.py | 85 +++++++-------------
2 files changed, 66 insertions(+), 83 deletions(-)
diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
index 746770e776d..cd6390b548a 100755
--- a/tests/functional/test_aarch64_rme_sbsaref.py
+++ b/tests/functional/test_aarch64_rme_sbsaref.py
@@ -10,21 +10,23 @@
# SPDX-License-Identifier: GPL-2.0-or-later
import os
+from os.path import join
+import shutil
from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
from qemu_test import exec_command_and_wait_for_pattern
-from test_aarch64_rme_virt import test_realms_guest
class Aarch64RMESbsaRefMachine(QemuSystemTest):
- # Stack is built with OP-TEE build environment from those instructions:
+ # Stack is inspired from:
# https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
- # https://github.com/pbo-linaro/qemu-rme-stack
+ # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_sbsa_release
+ # ./build.sh && ./archive_artifacts.sh out.tar.xz
ASSET_RME_STACK_SBSA = Asset(
- ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
- 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
- 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
+ ('https://github.com/pbo-linaro/qemu-linux-stack/'
+ 'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
+ '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
# This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
# and launching a nested VM using it.
@@ -35,35 +37,41 @@ def test_aarch64_rme_sbsaref(self):
self.vm.set_console()
- stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
- self.archive_extract(stack_path_tar_gz, format="tar")
+ stack_path_tar = self.ASSET_RME_STACK_SBSA.fetch()
+ self.archive_extract(stack_path_tar, format="tar")
- rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-sbsa')
- pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
- pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
- virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
- drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+ rme_stack = self.scratch_file('.')
+ pflash0 = join(rme_stack, 'out', 'SBSA_FLASH0.fd')
+ pflash1 = join(rme_stack, 'out', 'SBSA_FLASH1.fd')
+ rootfs = join(rme_stack, 'out', 'host.ext4')
- self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ efi = join(rme_stack, 'out', 'EFI')
+ os.mkdir(efi)
+ shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
+ with open(join(efi, 'startup.nsh'), 'w') as startup:
+ startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
+ ' /host/out/lkvm run --realm'
+ ' -m 256m'
+ ' --restricted_mem'
+ ' --kernel /host/out/Image'
+ ' --disk /host/out/guest.ext4'
+ ' --params "root=/dev/vda rw init=/init"')
+
+ self.vm.add_args('-cpu', 'max,x-rme=on')
+ self.vm.add_args('-smp', '2')
self.vm.add_args('-m', '2G')
self.vm.add_args('-M', 'sbsa-ref')
self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
- self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
- self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
- self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
- self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
- self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
- self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
- self.vm.add_args('-netdev', 'user,id=net0')
-
+ self.vm.add_args('-drive', f'file=fat:rw:{efi},format=raw')
+ self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+ self.vm.add_args('-virtfs',
+ f'local,path={rme_stack}/,mount_tag=host,'
+ 'security_model=mapped,readonly=off')
self.vm.launch()
- # Wait for host VM boot to complete.
- wait_for_console_pattern(self, 'Welcome to Buildroot',
- failure_message='Synchronous Exception at')
- exec_command_and_wait_for_pattern(self, 'root', '#')
-
- test_realms_guest(self)
+ # Wait for host and guest VM boot to complete.
+ wait_for_console_pattern(self, 'root@guest',
+ failure_message='Kernel panic')
if __name__ == '__main__':
QemuSystemTest.main()
diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
index 8452d27928f..bb603aaa26c 100755
--- a/tests/functional/test_aarch64_rme_virt.py
+++ b/tests/functional/test_aarch64_rme_virt.py
@@ -9,50 +9,22 @@
#
# SPDX-License-Identifier: GPL-2.0-or-later
-import os
+from os.path import join
from qemu_test import QemuSystemTest, Asset
from qemu_test import exec_command, wait_for_console_pattern
from qemu_test import exec_command_and_wait_for_pattern
-def test_realms_guest(test_rme_instance):
-
- # Boot the (nested) guest VM
- exec_command(test_rme_instance,
- 'qemu-system-aarch64 -M virt,gic-version=3 '
- '-cpu host -enable-kvm -m 512M '
- '-M confidential-guest-support=rme0 '
- '-object rme-guest,id=rme0 '
- '-device virtio-net-pci,netdev=net0,romfile= '
- '-netdev user,id=net0 '
- '-kernel /mnt/out/bin/Image '
- '-initrd /mnt/out-br/images/rootfs.cpio '
- '-serial stdio')
- # Detect Realm activation during (nested) guest boot.
- wait_for_console_pattern(test_rme_instance,
- 'SMC_RMI_REALM_ACTIVATE')
- # Wait for (nested) guest boot to complete.
- wait_for_console_pattern(test_rme_instance,
- 'Welcome to Buildroot')
- exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
- # query (nested) guest cca report
- exec_command(test_rme_instance, 'cca-workload-attestation report')
- wait_for_console_pattern(test_rme_instance,
- '"cca-platform-hash-algo-id": "sha-256"')
- wait_for_console_pattern(test_rme_instance,
- '"cca-realm-hash-algo-id": "sha-512"')
- wait_for_console_pattern(test_rme_instance,
- '"cca-realm-public-key-hash-algo-id": "sha-256"')
-
class Aarch64RMEVirtMachine(QemuSystemTest):
- # Stack is built with OP-TEE build environment from those instructions:
+ # Stack is inspired from:
# https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
- # https://github.com/pbo-linaro/qemu-rme-stack
+ # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_release
+ # ./build.sh && ./archive_artifacts.sh out.tar.xz
ASSET_RME_STACK_VIRT = Asset(
- ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
- 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
- '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
+ ('https://github.com/pbo-linaro/qemu-linux-stack/'
+ 'releases/download/build/rme_release-86101e5.tar.xz'),
+ 'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
# This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
# and launching a nested VM using it.
@@ -63,15 +35,16 @@ def test_aarch64_rme_virt(self):
self.vm.set_console()
- stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
- self.archive_extract(stack_path_tar_gz, format="tar")
+ stack_path_tar = self.ASSET_RME_STACK_VIRT.fetch()
+ self.archive_extract(stack_path_tar, format="tar")
- rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
- kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
- bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
- drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+ rme_stack = self.scratch_file('.')
+ kernel = join(rme_stack, 'out', 'Image')
+ bios = join(rme_stack, 'out', 'flash.bin')
+ rootfs = join(rme_stack, 'out', 'host.ext4')
- self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ self.vm.add_args('-cpu', 'max,x-rme=on')
+ self.vm.add_args('-smp', '2')
self.vm.add_args('-m', '2G')
self.vm.add_args('-M', 'virt,acpi=off,'
'virtualization=on,'
@@ -79,23 +52,25 @@ def test_aarch64_rme_virt(self):
'gic-version=3')
self.vm.add_args('-bios', bios)
self.vm.add_args('-kernel', kernel)
- self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
- self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
- self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
- self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
- self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
- self.vm.add_args('-netdev', 'user,id=net0')
+ self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+ self.vm.add_args('-virtfs',
+ f'local,path={rme_stack}/,mount_tag=host,'
+ 'security_model=mapped,readonly=off')
# We need to add nokaslr to avoid triggering this sporadic bug:
# https://gitlab.com/qemu-project/qemu/-/issues/2823
- self.vm.add_args('-append', 'root=/dev/vda nokaslr')
+ self.vm.add_args('-append',
+ 'nokaslr root=/dev/vda rw init=/init --'
+ ' /host/out/lkvm run --realm'
+ ' -m 256m'
+ ' --restricted_mem'
+ ' --kernel /host/out/Image'
+ ' --disk /host/out/guest.ext4'
+ ' --params "root=/dev/vda rw init=/init"')
self.vm.launch()
- # Wait for host VM boot to complete.
- wait_for_console_pattern(self, 'Welcome to Buildroot',
- failure_message='Synchronous Exception at')
- exec_command_and_wait_for_pattern(self, 'root', '#')
-
- test_realms_guest(self)
+ # Wait for host and guest VM boot to complete.
+ wait_for_console_pattern(self, 'root@guest',
+ failure_message='Kernel panic')
if __name__ == '__main__':
QemuSystemTest.main()
--
2.47.2On Sat, Jul 19, 2025 at 7:00 AM Pierrick Bouvier
<pierrick.bouvier@linaro.org> wrote:
>
> TF-A needs to be patched to enable support for FEAT_TCR2 and
> FEAT_SCTLR2. This new image contains updated firmware.
>
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> ---
> tests/functional/test_aarch64_rme_sbsaref.py | 64 ++++++++-------
> tests/functional/test_aarch64_rme_virt.py | 85 +++++++-------------
> 2 files changed, 66 insertions(+), 83 deletions(-)
>
> diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
> index 746770e776d..cd6390b548a 100755
> --- a/tests/functional/test_aarch64_rme_sbsaref.py
> +++ b/tests/functional/test_aarch64_rme_sbsaref.py
> @@ -10,21 +10,23 @@
> # SPDX-License-Identifier: GPL-2.0-or-later
>
> import os
> +from os.path import join
> +import shutil
>
> from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
> from qemu_test import exec_command_and_wait_for_pattern
> -from test_aarch64_rme_virt import test_realms_guest
>
>
> class Aarch64RMESbsaRefMachine(QemuSystemTest):
>
> - # Stack is built with OP-TEE build environment from those instructions:
> + # Stack is inspired from:
> # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
> - # https://github.com/pbo-linaro/qemu-rme-stack
> + # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_sbsa_release
> + # ./build.sh && ./archive_artifacts.sh out.tar.xz
> ASSET_RME_STACK_SBSA = Asset(
> - ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
> - 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
> - 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
> + ('https://github.com/pbo-linaro/qemu-linux-stack/'
> + 'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
> + '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
Hi Pierrick, I got:
> qemu_test.asset.AssetError: https://github.com/pbo-linaro/qemu-linux-stack/releases/download/build/rme_sbsa_release-a7f02cf.tar.xz: Download retries exceeded
Maybe fileserver.linaro.org is a better option?
> # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
> # and launching a nested VM using it.
> @@ -35,35 +37,41 @@ def test_aarch64_rme_sbsaref(self):
>
> self.vm.set_console()
>
> - stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
> - self.archive_extract(stack_path_tar_gz, format="tar")
> + stack_path_tar = self.ASSET_RME_STACK_SBSA.fetch()
> + self.archive_extract(stack_path_tar, format="tar")
>
> - rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-sbsa')
> - pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
> - pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
> - virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
> - drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
> + rme_stack = self.scratch_file('.')
> + pflash0 = join(rme_stack, 'out', 'SBSA_FLASH0.fd')
> + pflash1 = join(rme_stack, 'out', 'SBSA_FLASH1.fd')
> + rootfs = join(rme_stack, 'out', 'host.ext4')
>
> - self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
> + efi = join(rme_stack, 'out', 'EFI')
> + os.mkdir(efi)
> + shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
> + with open(join(efi, 'startup.nsh'), 'w') as startup:
> + startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
> + ' /host/out/lkvm run --realm'
> + ' -m 256m'
> + ' --restricted_mem'
> + ' --kernel /host/out/Image'
> + ' --disk /host/out/guest.ext4'
> + ' --params "root=/dev/vda rw init=/init"')
> +
> + self.vm.add_args('-cpu', 'max,x-rme=on')
> + self.vm.add_args('-smp', '2')
> self.vm.add_args('-m', '2G')
> self.vm.add_args('-M', 'sbsa-ref')
> self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
> self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
> - self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
> - self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
> - self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
> - self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
> - self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
> - self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
> - self.vm.add_args('-netdev', 'user,id=net0')
> -
> + self.vm.add_args('-drive', f'file=fat:rw:{efi},format=raw')
> + self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
> + self.vm.add_args('-virtfs',
> + f'local,path={rme_stack}/,mount_tag=host,'
> + 'security_model=mapped,readonly=off')
> self.vm.launch()
> - # Wait for host VM boot to complete.
> - wait_for_console_pattern(self, 'Welcome to Buildroot',
> - failure_message='Synchronous Exception at')
> - exec_command_and_wait_for_pattern(self, 'root', '#')
> -
> - test_realms_guest(self)
> + # Wait for host and guest VM boot to complete.
> + wait_for_console_pattern(self, 'root@guest',
> + failure_message='Kernel panic')
>
> if __name__ == '__main__':
> QemuSystemTest.main()
> diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
> index 8452d27928f..bb603aaa26c 100755
> --- a/tests/functional/test_aarch64_rme_virt.py
> +++ b/tests/functional/test_aarch64_rme_virt.py
> @@ -9,50 +9,22 @@
> #
> # SPDX-License-Identifier: GPL-2.0-or-later
>
> -import os
> +from os.path import join
>
> from qemu_test import QemuSystemTest, Asset
> from qemu_test import exec_command, wait_for_console_pattern
> from qemu_test import exec_command_and_wait_for_pattern
>
> -def test_realms_guest(test_rme_instance):
> -
> - # Boot the (nested) guest VM
> - exec_command(test_rme_instance,
> - 'qemu-system-aarch64 -M virt,gic-version=3 '
> - '-cpu host -enable-kvm -m 512M '
> - '-M confidential-guest-support=rme0 '
> - '-object rme-guest,id=rme0 '
> - '-device virtio-net-pci,netdev=net0,romfile= '
> - '-netdev user,id=net0 '
> - '-kernel /mnt/out/bin/Image '
> - '-initrd /mnt/out-br/images/rootfs.cpio '
> - '-serial stdio')
> - # Detect Realm activation during (nested) guest boot.
> - wait_for_console_pattern(test_rme_instance,
> - 'SMC_RMI_REALM_ACTIVATE')
> - # Wait for (nested) guest boot to complete.
> - wait_for_console_pattern(test_rme_instance,
> - 'Welcome to Buildroot')
> - exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
> - # query (nested) guest cca report
> - exec_command(test_rme_instance, 'cca-workload-attestation report')
> - wait_for_console_pattern(test_rme_instance,
> - '"cca-platform-hash-algo-id": "sha-256"')
> - wait_for_console_pattern(test_rme_instance,
> - '"cca-realm-hash-algo-id": "sha-512"')
> - wait_for_console_pattern(test_rme_instance,
> - '"cca-realm-public-key-hash-algo-id": "sha-256"')
> -
> class Aarch64RMEVirtMachine(QemuSystemTest):
>
> - # Stack is built with OP-TEE build environment from those instructions:
> + # Stack is inspired from:
> # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
> - # https://github.com/pbo-linaro/qemu-rme-stack
> + # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_release
> + # ./build.sh && ./archive_artifacts.sh out.tar.xz
> ASSET_RME_STACK_VIRT = Asset(
> - ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
> - 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
> - '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
> + ('https://github.com/pbo-linaro/qemu-linux-stack/'
> + 'releases/download/build/rme_release-86101e5.tar.xz'),
> + 'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
>
> # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
> # and launching a nested VM using it.
> @@ -63,15 +35,16 @@ def test_aarch64_rme_virt(self):
>
> self.vm.set_console()
>
> - stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
> - self.archive_extract(stack_path_tar_gz, format="tar")
> + stack_path_tar = self.ASSET_RME_STACK_VIRT.fetch()
> + self.archive_extract(stack_path_tar, format="tar")
>
> - rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
> - kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
> - bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
> - drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
> + rme_stack = self.scratch_file('.')
> + kernel = join(rme_stack, 'out', 'Image')
> + bios = join(rme_stack, 'out', 'flash.bin')
> + rootfs = join(rme_stack, 'out', 'host.ext4')
>
> - self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
> + self.vm.add_args('-cpu', 'max,x-rme=on')
> + self.vm.add_args('-smp', '2')
> self.vm.add_args('-m', '2G')
> self.vm.add_args('-M', 'virt,acpi=off,'
> 'virtualization=on,'
> @@ -79,23 +52,25 @@ def test_aarch64_rme_virt(self):
> 'gic-version=3')
> self.vm.add_args('-bios', bios)
> self.vm.add_args('-kernel', kernel)
> - self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
> - self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
> - self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
> - self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
> - self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
> - self.vm.add_args('-netdev', 'user,id=net0')
> + self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
> + self.vm.add_args('-virtfs',
> + f'local,path={rme_stack}/,mount_tag=host,'
> + 'security_model=mapped,readonly=off')
> # We need to add nokaslr to avoid triggering this sporadic bug:
> # https://gitlab.com/qemu-project/qemu/-/issues/2823
> - self.vm.add_args('-append', 'root=/dev/vda nokaslr')
> + self.vm.add_args('-append',
> + 'nokaslr root=/dev/vda rw init=/init --'
> + ' /host/out/lkvm run --realm'
> + ' -m 256m'
> + ' --restricted_mem'
> + ' --kernel /host/out/Image'
> + ' --disk /host/out/guest.ext4'
> + ' --params "root=/dev/vda rw init=/init"')
>
> self.vm.launch()
> - # Wait for host VM boot to complete.
> - wait_for_console_pattern(self, 'Welcome to Buildroot',
> - failure_message='Synchronous Exception at')
> - exec_command_and_wait_for_pattern(self, 'root', '#')
> -
> - test_realms_guest(self)
> + # Wait for host and guest VM boot to complete.
> + wait_for_console_pattern(self, 'root@guest',
> + failure_message='Kernel panic')
>
> if __name__ == '__main__':
> QemuSystemTest.main()
> --
> 2.47.2
>
>
On 7/19/25 3:57 AM, Manos Pitsidianakis wrote:
> On Sat, Jul 19, 2025 at 7:00 AM Pierrick Bouvier
> <pierrick.bouvier@linaro.org> wrote:
>>
>> TF-A needs to be patched to enable support for FEAT_TCR2 and
>> FEAT_SCTLR2. This new image contains updated firmware.
>>
>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>> ---
>> tests/functional/test_aarch64_rme_sbsaref.py | 64 ++++++++-------
>> tests/functional/test_aarch64_rme_virt.py | 85 +++++++-------------
>> 2 files changed, 66 insertions(+), 83 deletions(-)
>>
>> diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
>> index 746770e776d..cd6390b548a 100755
>> --- a/tests/functional/test_aarch64_rme_sbsaref.py
>> +++ b/tests/functional/test_aarch64_rme_sbsaref.py
>> @@ -10,21 +10,23 @@
>> # SPDX-License-Identifier: GPL-2.0-or-later
>>
>> import os
>> +from os.path import join
>> +import shutil
>>
>> from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
>> from qemu_test import exec_command_and_wait_for_pattern
>> -from test_aarch64_rme_virt import test_realms_guest
>>
>>
>> class Aarch64RMESbsaRefMachine(QemuSystemTest):
>>
>> - # Stack is built with OP-TEE build environment from those instructions:
>> + # Stack is inspired from:
>> # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
>> - # https://github.com/pbo-linaro/qemu-rme-stack
>> + # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_sbsa_release
>> + # ./build.sh && ./archive_artifacts.sh out.tar.xz
>> ASSET_RME_STACK_SBSA = Asset(
>> - ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
>> - 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
>> - 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
>> + ('https://github.com/pbo-linaro/qemu-linux-stack/'
>> + 'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
>> + '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
>
> Hi Pierrick, I got:
>
>> qemu_test.asset.AssetError: https://github.com/pbo-linaro/qemu-linux-stack/releases/download/build/rme_sbsa_release-a7f02cf.tar.xz: Download retries exceeded
>
> Maybe fileserver.linaro.org is a better option?
>
In years of using GitHub releases to download various sources/artifacts,
I found that it is very reliable (as much as cloning code from GitHub),
so I would favor this over any custom solution.
Were you able to download it manually when you had a failure?
Assets download in test infra can be very picky, especially if you
Ctrl-C when it was downloading.
>> # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
>> # and launching a nested VM using it.
>> @@ -35,35 +37,41 @@ def test_aarch64_rme_sbsaref(self):
>>
>> self.vm.set_console()
>>
>> - stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
>> - self.archive_extract(stack_path_tar_gz, format="tar")
>> + stack_path_tar = self.ASSET_RME_STACK_SBSA.fetch()
>> + self.archive_extract(stack_path_tar, format="tar")
>>
>> - rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-sbsa')
>> - pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
>> - pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
>> - virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
>> - drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
>> + rme_stack = self.scratch_file('.')
>> + pflash0 = join(rme_stack, 'out', 'SBSA_FLASH0.fd')
>> + pflash1 = join(rme_stack, 'out', 'SBSA_FLASH1.fd')
>> + rootfs = join(rme_stack, 'out', 'host.ext4')
>>
>> - self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
>> + efi = join(rme_stack, 'out', 'EFI')
>> + os.mkdir(efi)
>> + shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
>> + with open(join(efi, 'startup.nsh'), 'w') as startup:
>> + startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
>> + ' /host/out/lkvm run --realm'
>> + ' -m 256m'
>> + ' --restricted_mem'
>> + ' --kernel /host/out/Image'
>> + ' --disk /host/out/guest.ext4'
>> + ' --params "root=/dev/vda rw init=/init"')
>> +
>> + self.vm.add_args('-cpu', 'max,x-rme=on')
>> + self.vm.add_args('-smp', '2')
>> self.vm.add_args('-m', '2G')
>> self.vm.add_args('-M', 'sbsa-ref')
>> self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
>> self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
>> - self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
>> - self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
>> - self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
>> - self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
>> - self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
>> - self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
>> - self.vm.add_args('-netdev', 'user,id=net0')
>> -
>> + self.vm.add_args('-drive', f'file=fat:rw:{efi},format=raw')
>> + self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
>> + self.vm.add_args('-virtfs',
>> + f'local,path={rme_stack}/,mount_tag=host,'
>> + 'security_model=mapped,readonly=off')
>> self.vm.launch()
>> - # Wait for host VM boot to complete.
>> - wait_for_console_pattern(self, 'Welcome to Buildroot',
>> - failure_message='Synchronous Exception at')
>> - exec_command_and_wait_for_pattern(self, 'root', '#')
>> -
>> - test_realms_guest(self)
>> + # Wait for host and guest VM boot to complete.
>> + wait_for_console_pattern(self, 'root@guest',
>> + failure_message='Kernel panic')
>>
>> if __name__ == '__main__':
>> QemuSystemTest.main()
>> diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
>> index 8452d27928f..bb603aaa26c 100755
>> --- a/tests/functional/test_aarch64_rme_virt.py
>> +++ b/tests/functional/test_aarch64_rme_virt.py
>> @@ -9,50 +9,22 @@
>> #
>> # SPDX-License-Identifier: GPL-2.0-or-later
>>
>> -import os
>> +from os.path import join
>>
>> from qemu_test import QemuSystemTest, Asset
>> from qemu_test import exec_command, wait_for_console_pattern
>> from qemu_test import exec_command_and_wait_for_pattern
>>
>> -def test_realms_guest(test_rme_instance):
>> -
>> - # Boot the (nested) guest VM
>> - exec_command(test_rme_instance,
>> - 'qemu-system-aarch64 -M virt,gic-version=3 '
>> - '-cpu host -enable-kvm -m 512M '
>> - '-M confidential-guest-support=rme0 '
>> - '-object rme-guest,id=rme0 '
>> - '-device virtio-net-pci,netdev=net0,romfile= '
>> - '-netdev user,id=net0 '
>> - '-kernel /mnt/out/bin/Image '
>> - '-initrd /mnt/out-br/images/rootfs.cpio '
>> - '-serial stdio')
>> - # Detect Realm activation during (nested) guest boot.
>> - wait_for_console_pattern(test_rme_instance,
>> - 'SMC_RMI_REALM_ACTIVATE')
>> - # Wait for (nested) guest boot to complete.
>> - wait_for_console_pattern(test_rme_instance,
>> - 'Welcome to Buildroot')
>> - exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
>> - # query (nested) guest cca report
>> - exec_command(test_rme_instance, 'cca-workload-attestation report')
>> - wait_for_console_pattern(test_rme_instance,
>> - '"cca-platform-hash-algo-id": "sha-256"')
>> - wait_for_console_pattern(test_rme_instance,
>> - '"cca-realm-hash-algo-id": "sha-512"')
>> - wait_for_console_pattern(test_rme_instance,
>> - '"cca-realm-public-key-hash-algo-id": "sha-256"')
>> -
>> class Aarch64RMEVirtMachine(QemuSystemTest):
>>
>> - # Stack is built with OP-TEE build environment from those instructions:
>> + # Stack is inspired from:
>> # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
>> - # https://github.com/pbo-linaro/qemu-rme-stack
>> + # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_release
>> + # ./build.sh && ./archive_artifacts.sh out.tar.xz
>> ASSET_RME_STACK_VIRT = Asset(
>> - ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
>> - 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
>> - '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
>> + ('https://github.com/pbo-linaro/qemu-linux-stack/'
>> + 'releases/download/build/rme_release-86101e5.tar.xz'),
>> + 'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
>>
>> # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
>> # and launching a nested VM using it.
>> @@ -63,15 +35,16 @@ def test_aarch64_rme_virt(self):
>>
>> self.vm.set_console()
>>
>> - stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
>> - self.archive_extract(stack_path_tar_gz, format="tar")
>> + stack_path_tar = self.ASSET_RME_STACK_VIRT.fetch()
>> + self.archive_extract(stack_path_tar, format="tar")
>>
>> - rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
>> - kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
>> - bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
>> - drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
>> + rme_stack = self.scratch_file('.')
>> + kernel = join(rme_stack, 'out', 'Image')
>> + bios = join(rme_stack, 'out', 'flash.bin')
>> + rootfs = join(rme_stack, 'out', 'host.ext4')
>>
>> - self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
>> + self.vm.add_args('-cpu', 'max,x-rme=on')
>> + self.vm.add_args('-smp', '2')
>> self.vm.add_args('-m', '2G')
>> self.vm.add_args('-M', 'virt,acpi=off,'
>> 'virtualization=on,'
>> @@ -79,23 +52,25 @@ def test_aarch64_rme_virt(self):
>> 'gic-version=3')
>> self.vm.add_args('-bios', bios)
>> self.vm.add_args('-kernel', kernel)
>> - self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
>> - self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
>> - self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
>> - self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
>> - self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
>> - self.vm.add_args('-netdev', 'user,id=net0')
>> + self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
>> + self.vm.add_args('-virtfs',
>> + f'local,path={rme_stack}/,mount_tag=host,'
>> + 'security_model=mapped,readonly=off')
>> # We need to add nokaslr to avoid triggering this sporadic bug:
>> # https://gitlab.com/qemu-project/qemu/-/issues/2823
>> - self.vm.add_args('-append', 'root=/dev/vda nokaslr')
>> + self.vm.add_args('-append',
>> + 'nokaslr root=/dev/vda rw init=/init --'
>> + ' /host/out/lkvm run --realm'
>> + ' -m 256m'
>> + ' --restricted_mem'
>> + ' --kernel /host/out/Image'
>> + ' --disk /host/out/guest.ext4'
>> + ' --params "root=/dev/vda rw init=/init"')
>>
>> self.vm.launch()
>> - # Wait for host VM boot to complete.
>> - wait_for_console_pattern(self, 'Welcome to Buildroot',
>> - failure_message='Synchronous Exception at')
>> - exec_command_and_wait_for_pattern(self, 'root', '#')
>> -
>> - test_realms_guest(self)
>> + # Wait for host and guest VM boot to complete.
>> + wait_for_console_pattern(self, 'root@guest',
>> + failure_message='Kernel panic')
>>
>> if __name__ == '__main__':
>> QemuSystemTest.main()
>> --
>> 2.47.2
>>
>>
On 19/7/25 17:38, Pierrick Bouvier wrote:
> On 7/19/25 3:57 AM, Manos Pitsidianakis wrote:
>> On Sat, Jul 19, 2025 at 7:00 AM Pierrick Bouvier
>> <pierrick.bouvier@linaro.org> wrote:
>>>
>>> TF-A needs to be patched to enable support for FEAT_TCR2 and
>>> FEAT_SCTLR2. This new image contains updated firmware.
>>>
>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>>> ---
>>> tests/functional/test_aarch64_rme_sbsaref.py | 64 ++++++++-------
>>> tests/functional/test_aarch64_rme_virt.py | 85 +++++++-------------
>>> 2 files changed, 66 insertions(+), 83 deletions(-)
>>> class Aarch64RMESbsaRefMachine(QemuSystemTest):
>>>
>>> - # Stack is built with OP-TEE build environment from those
>>> instructions:
>>> + # Stack is inspired from:
>>> # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
>>> - # https://github.com/pbo-linaro/qemu-rme-stack
>>> + # https://github.com/pbo-linaro/qemu-linux-stack/tree/
>>> rme_sbsa_release
>>> + # ./build.sh && ./archive_artifacts.sh out.tar.xz
>>> ASSET_RME_STACK_SBSA = Asset(
>>> - ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
>>> - 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
>>> -
>>> 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
>>> + ('https://github.com/pbo-linaro/qemu-linux-stack/'
>>> + 'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
>>> +
>>> '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
>>
>> Hi Pierrick, I got:
>>
>>> qemu_test.asset.AssetError: https://github.com/pbo-linaro/qemu-linux-
>>> stack/releases/download/build/rme_sbsa_release-a7f02cf.tar.xz:
>>> Download retries exceeded
>>
>> Maybe fileserver.linaro.org is a better option?
>>
>
> In years of using GitHub releases to download various sources/artifacts,
> I found that it is very reliable (as much as cloning code from GitHub),
> so I would favor this over any custom solution.
GitHub releases has the advantage of not involving manual steps to
upload to fileserver and generate a shared URL.
Another downside of fileserver.linaro.org is its bandwidth is limited.
My 2 cents anyway ;)
© 2016 - 2025 Red Hat, Inc.