From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
TF-A needs to be patched to enable support for FEAT_TCR2 and
FEAT_SCTLR2. This new image contains updated firmware.
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org>
---
tests/functional/test_aarch64_rme_sbsaref.py | 64 ++++++++-------
tests/functional/test_aarch64_rme_virt.py | 85 +++++++-------------
2 files changed, 66 insertions(+), 83 deletions(-)
diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
index 746770e776..cd6390b548 100755
--- a/tests/functional/test_aarch64_rme_sbsaref.py
+++ b/tests/functional/test_aarch64_rme_sbsaref.py
@@ -10,21 +10,23 @@
# SPDX-License-Identifier: GPL-2.0-or-later
import os
+from os.path import join
+import shutil
from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
from qemu_test import exec_command_and_wait_for_pattern
-from test_aarch64_rme_virt import test_realms_guest
class Aarch64RMESbsaRefMachine(QemuSystemTest):
- # Stack is built with OP-TEE build environment from those instructions:
+ # Stack is inspired from:
# https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
- # https://github.com/pbo-linaro/qemu-rme-stack
+ # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_sbsa_release
+ # ./build.sh && ./archive_artifacts.sh out.tar.xz
ASSET_RME_STACK_SBSA = Asset(
- ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
- 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
- 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
+ ('https://github.com/pbo-linaro/qemu-linux-stack/'
+ 'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
+ '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
# This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
# and launching a nested VM using it.
@@ -35,35 +37,41 @@ def test_aarch64_rme_sbsaref(self):
self.vm.set_console()
- stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
- self.archive_extract(stack_path_tar_gz, format="tar")
+ stack_path_tar = self.ASSET_RME_STACK_SBSA.fetch()
+ self.archive_extract(stack_path_tar, format="tar")
- rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-sbsa')
- pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
- pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
- virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
- drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+ rme_stack = self.scratch_file('.')
+ pflash0 = join(rme_stack, 'out', 'SBSA_FLASH0.fd')
+ pflash1 = join(rme_stack, 'out', 'SBSA_FLASH1.fd')
+ rootfs = join(rme_stack, 'out', 'host.ext4')
- self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ efi = join(rme_stack, 'out', 'EFI')
+ os.mkdir(efi)
+ shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
+ with open(join(efi, 'startup.nsh'), 'w') as startup:
+ startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
+ ' /host/out/lkvm run --realm'
+ ' -m 256m'
+ ' --restricted_mem'
+ ' --kernel /host/out/Image'
+ ' --disk /host/out/guest.ext4'
+ ' --params "root=/dev/vda rw init=/init"')
+
+ self.vm.add_args('-cpu', 'max,x-rme=on')
+ self.vm.add_args('-smp', '2')
self.vm.add_args('-m', '2G')
self.vm.add_args('-M', 'sbsa-ref')
self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
- self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
- self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
- self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
- self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
- self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
- self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
- self.vm.add_args('-netdev', 'user,id=net0')
-
+ self.vm.add_args('-drive', f'file=fat:rw:{efi},format=raw')
+ self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+ self.vm.add_args('-virtfs',
+ f'local,path={rme_stack}/,mount_tag=host,'
+ 'security_model=mapped,readonly=off')
self.vm.launch()
- # Wait for host VM boot to complete.
- wait_for_console_pattern(self, 'Welcome to Buildroot',
- failure_message='Synchronous Exception at')
- exec_command_and_wait_for_pattern(self, 'root', '#')
-
- test_realms_guest(self)
+ # Wait for host and guest VM boot to complete.
+ wait_for_console_pattern(self, 'root@guest',
+ failure_message='Kernel panic')
if __name__ == '__main__':
QemuSystemTest.main()
diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
index 8452d27928..bb603aaa26 100755
--- a/tests/functional/test_aarch64_rme_virt.py
+++ b/tests/functional/test_aarch64_rme_virt.py
@@ -9,50 +9,22 @@
#
# SPDX-License-Identifier: GPL-2.0-or-later
-import os
+from os.path import join
from qemu_test import QemuSystemTest, Asset
from qemu_test import exec_command, wait_for_console_pattern
from qemu_test import exec_command_and_wait_for_pattern
-def test_realms_guest(test_rme_instance):
-
- # Boot the (nested) guest VM
- exec_command(test_rme_instance,
- 'qemu-system-aarch64 -M virt,gic-version=3 '
- '-cpu host -enable-kvm -m 512M '
- '-M confidential-guest-support=rme0 '
- '-object rme-guest,id=rme0 '
- '-device virtio-net-pci,netdev=net0,romfile= '
- '-netdev user,id=net0 '
- '-kernel /mnt/out/bin/Image '
- '-initrd /mnt/out-br/images/rootfs.cpio '
- '-serial stdio')
- # Detect Realm activation during (nested) guest boot.
- wait_for_console_pattern(test_rme_instance,
- 'SMC_RMI_REALM_ACTIVATE')
- # Wait for (nested) guest boot to complete.
- wait_for_console_pattern(test_rme_instance,
- 'Welcome to Buildroot')
- exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
- # query (nested) guest cca report
- exec_command(test_rme_instance, 'cca-workload-attestation report')
- wait_for_console_pattern(test_rme_instance,
- '"cca-platform-hash-algo-id": "sha-256"')
- wait_for_console_pattern(test_rme_instance,
- '"cca-realm-hash-algo-id": "sha-512"')
- wait_for_console_pattern(test_rme_instance,
- '"cca-realm-public-key-hash-algo-id": "sha-256"')
-
class Aarch64RMEVirtMachine(QemuSystemTest):
- # Stack is built with OP-TEE build environment from those instructions:
+ # Stack is inspired from:
# https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
- # https://github.com/pbo-linaro/qemu-rme-stack
+ # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_release
+ # ./build.sh && ./archive_artifacts.sh out.tar.xz
ASSET_RME_STACK_VIRT = Asset(
- ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
- 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
- '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
+ ('https://github.com/pbo-linaro/qemu-linux-stack/'
+ 'releases/download/build/rme_release-86101e5.tar.xz'),
+ 'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
# This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
# and launching a nested VM using it.
@@ -63,15 +35,16 @@ def test_aarch64_rme_virt(self):
self.vm.set_console()
- stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
- self.archive_extract(stack_path_tar_gz, format="tar")
+ stack_path_tar = self.ASSET_RME_STACK_VIRT.fetch()
+ self.archive_extract(stack_path_tar, format="tar")
- rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
- kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
- bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
- drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+ rme_stack = self.scratch_file('.')
+ kernel = join(rme_stack, 'out', 'Image')
+ bios = join(rme_stack, 'out', 'flash.bin')
+ rootfs = join(rme_stack, 'out', 'host.ext4')
- self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ self.vm.add_args('-cpu', 'max,x-rme=on')
+ self.vm.add_args('-smp', '2')
self.vm.add_args('-m', '2G')
self.vm.add_args('-M', 'virt,acpi=off,'
'virtualization=on,'
@@ -79,23 +52,25 @@ def test_aarch64_rme_virt(self):
'gic-version=3')
self.vm.add_args('-bios', bios)
self.vm.add_args('-kernel', kernel)
- self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
- self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
- self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
- self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
- self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
- self.vm.add_args('-netdev', 'user,id=net0')
+ self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+ self.vm.add_args('-virtfs',
+ f'local,path={rme_stack}/,mount_tag=host,'
+ 'security_model=mapped,readonly=off')
# We need to add nokaslr to avoid triggering this sporadic bug:
# https://gitlab.com/qemu-project/qemu/-/issues/2823
- self.vm.add_args('-append', 'root=/dev/vda nokaslr')
+ self.vm.add_args('-append',
+ 'nokaslr root=/dev/vda rw init=/init --'
+ ' /host/out/lkvm run --realm'
+ ' -m 256m'
+ ' --restricted_mem'
+ ' --kernel /host/out/Image'
+ ' --disk /host/out/guest.ext4'
+ ' --params "root=/dev/vda rw init=/init"')
self.vm.launch()
- # Wait for host VM boot to complete.
- wait_for_console_pattern(self, 'Welcome to Buildroot',
- failure_message='Synchronous Exception at')
- exec_command_and_wait_for_pattern(self, 'root', '#')
-
- test_realms_guest(self)
+ # Wait for host and guest VM boot to complete.
+ wait_for_console_pattern(self, 'root@guest',
+ failure_message='Kernel panic')
if __name__ == '__main__':
QemuSystemTest.main()
--
2.43.0On Sun, 27 Jul 2025 at 08:42, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>
> TF-A needs to be patched to enable support for FEAT_TCR2 and
> FEAT_SCTLR2. This new image contains updated firmware.
>
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org>
I see this test failing in local runs of 'make check-functional'
sometimes, complaining that it can't create the scratch/out/EFI
directory because it already exists:
stderr:
Traceback (most recent call last):
File "/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/tests/functional/test_aarch64_rme_sbsaref.py",
line 49, in test_aarch64_rme_sbsaref
os.mkdir(efi)
FileExistsError: [Errno 17] File exists:
'/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/scratch/out/EFI'
More information on
test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref
could be found here:
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/base.log
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/console.log
(test program exited with status code 1)
Is this something where we need to blow away any old output
directory for robustness ?
thanks
-- PMM
Peter Maydell <peter.maydell@linaro.org> writes: > On Sun, 27 Jul 2025 at 08:42, Richard Henderson > <richard.henderson@linaro.org> wrote: >> >> From: Pierrick Bouvier <pierrick.bouvier@linaro.org> >> >> TF-A needs to be patched to enable support for FEAT_TCR2 and >> FEAT_SCTLR2. This new image contains updated firmware. >> >> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> >> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> >> Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org> > > I see this test failing in local runs of 'make check-functional' > sometimes, complaining that it can't create the scratch/out/EFI > directory because it already exists: > > stderr: > Traceback (most recent call last): > File "/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/tests/functional/test_aarch64_rme_sbsaref.py", > line 49, in test_aarch64_rme_sbsaref > os.mkdir(efi) os.makedirs(efi, exist_ok=True) would solve that. > FileExistsError: [Errno 17] File exists: > '/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/scratch/out/EFI' > > More information on > test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref > could be found here: > /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/base.log > /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/console.log > > (test program exited with status code 1) > > > Is this something where we need to blow away any old output > directory for robustness ? Generally scratch is cleaned out once a test finishes (unless you preserve it via QEMU_TEST_KEEP_SCRATCH=1). But I guess there may be cases when it isn't cleaned out properly - does Ctrl-c get caught? > > thanks > -- PMM -- Alex Bennée Virtualisation Tech Lead @ Linaro
On 8/15/25 9:29 AM, Alex Bennée wrote: > Peter Maydell <peter.maydell@linaro.org> writes: > >> On Sun, 27 Jul 2025 at 08:42, Richard Henderson >> <richard.henderson@linaro.org> wrote: >>> >>> From: Pierrick Bouvier <pierrick.bouvier@linaro.org> >>> >>> TF-A needs to be patched to enable support for FEAT_TCR2 and >>> FEAT_SCTLR2. This new image contains updated firmware. >>> >>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> >>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> >>> Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org> >> >> I see this test failing in local runs of 'make check-functional' >> sometimes, complaining that it can't create the scratch/out/EFI >> directory because it already exists: >> >> stderr: >> Traceback (most recent call last): >> File "/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/tests/functional/test_aarch64_rme_sbsaref.py", >> line 49, in test_aarch64_rme_sbsaref >> os.mkdir(efi) > > os.makedirs(efi, exist_ok=True) > > would solve that. > Yes, probably safer to add that if we can't guarantee correctly that scratch folder gets deleted everytime. I wrote the test assuming this behaviour. >> FileExistsError: [Errno 17] File exists: >> '/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/scratch/out/EFI' >> >> More information on >> test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref >> could be found here: >> /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/base.log >> /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-clang/tests/functional/aarch64/test_aarch64_rme_sbsaref.Aarch64RMESbsaRefMachine.test_aarch64_rme_sbsaref/console.log >> >> (test program exited with status code 1) >> >> >> Is this something where we need to blow away any old output >> directory for robustness ? > > Generally scratch is cleaned out once a test finishes (unless you > preserve it via QEMU_TEST_KEEP_SCRATCH=1). But I guess there may be > cases when it isn't cleaned out properly - does Ctrl-c get caught? > >> >> thanks >> -- PMM >
On Sat, 16 Aug 2025 at 01:09, Pierrick Bouvier <pierrick.bouvier@linaro.org> wrote: > > On 8/15/25 9:29 AM, Alex Bennée wrote: > > Peter Maydell <peter.maydell@linaro.org> writes: > > > >> On Sun, 27 Jul 2025 at 08:42, Richard Henderson > >> <richard.henderson@linaro.org> wrote: > >>> > >>> From: Pierrick Bouvier <pierrick.bouvier@linaro.org> > >>> > >>> TF-A needs to be patched to enable support for FEAT_TCR2 and > >>> FEAT_SCTLR2. This new image contains updated firmware. > >>> > >>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> > >>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> > >>> Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org> > >> > >> I see this test failing in local runs of 'make check-functional' > >> sometimes, complaining that it can't create the scratch/out/EFI > >> directory because it already exists: > >> > >> stderr: > >> Traceback (most recent call last): > >> File "/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/tests/functional/test_aarch64_rme_sbsaref.py", > >> line 49, in test_aarch64_rme_sbsaref > >> os.mkdir(efi) > > > > os.makedirs(efi, exist_ok=True) > > > > would solve that. > > > > Yes, probably safer to add that if we can't guarantee correctly that > scratch folder gets deleted everytime. I wrote the test assuming this > behaviour. I folded the os.makedirs() fix into my copy of this patch in target-arm.next. -- PMM
On 2025-08-28 10:27, Peter Maydell wrote: > On Sat, 16 Aug 2025 at 01:09, Pierrick Bouvier > <pierrick.bouvier@linaro.org> wrote: >> >> On 8/15/25 9:29 AM, Alex Bennée wrote: >>> Peter Maydell <peter.maydell@linaro.org> writes: >>> >>>> On Sun, 27 Jul 2025 at 08:42, Richard Henderson >>>> <richard.henderson@linaro.org> wrote: >>>>> >>>>> From: Pierrick Bouvier <pierrick.bouvier@linaro.org> >>>>> >>>>> TF-A needs to be patched to enable support for FEAT_TCR2 and >>>>> FEAT_SCTLR2. This new image contains updated firmware. >>>>> >>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> >>>>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> >>>>> Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org> >>>> >>>> I see this test failing in local runs of 'make check-functional' >>>> sometimes, complaining that it can't create the scratch/out/EFI >>>> directory because it already exists: >>>> >>>> stderr: >>>> Traceback (most recent call last): >>>> File "/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/tests/functional/test_aarch64_rme_sbsaref.py", >>>> line 49, in test_aarch64_rme_sbsaref >>>> os.mkdir(efi) >>> >>> os.makedirs(efi, exist_ok=True) >>> >>> would solve that. >>> >> >> Yes, probably safer to add that if we can't guarantee correctly that >> scratch folder gets deleted everytime. I wrote the test assuming this >> behaviour. > > I folded the os.makedirs() fix into my copy of this patch in > target-arm.next. > Thanks Peter, you did well. Pierrick > -- PMM
On 27/7/25 09:41, Richard Henderson wrote: > From: Pierrick Bouvier <pierrick.bouvier@linaro.org> > > TF-A needs to be patched to enable support for FEAT_TCR2 and > FEAT_SCTLR2. This new image contains updated firmware. > > Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> > Signed-off-by: Richard Henderson <richard.henderson@linaro.org> > Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org> > --- > tests/functional/test_aarch64_rme_sbsaref.py | 64 ++++++++------- > tests/functional/test_aarch64_rme_virt.py | 85 +++++++------------- > 2 files changed, 66 insertions(+), 83 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
© 2016 - 2025 Red Hat, Inc.