Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Arm CCA guest firmware v3 (RMM-v1.0-rel0) #6480

Open
wants to merge 57 commits into
base: master
Choose a base branch
from
Open

Support for Arm CCA guest firmware v3 (RMM-v1.0-rel0) #6480

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
57 commits
Select commit Hold shift + click to select a range
33d03a0
ArmPkg: Add helper function to detect RME
samimujawar Jul 8, 2022
571106d
ArmPkg: Introduce SetMemoryProtectionAttribute() for Realms
samimujawar Aug 17, 2023
95c8d03
ArmPkg: Extend number of parameter registers in SMC call
samimujawar Jul 11, 2022
c52c4f2
ArmVirtPkg: Add Arm CCA Realm Service Interface Library
samimujawar Jul 8, 2022
e6a862d
ArmVirtPkg: ArmCcaRsiLib: Add interfaces to manage the Realm IPA state
samimujawar Nov 28, 2022
f7deb4a
ArmVirtPkg: ArmCcaRsiLib: Add an interface to get an attestation token
samimujawar Nov 28, 2022
d231896
ArmVirtPkg: ArmCcaRsiLib: Add interfaces to get/extend REMs
samimujawar Nov 28, 2022
2776a72
ArmVirtPkg: ArmCcaRsiLib: Add an interface to make a RSI Host Call
samimujawar Nov 28, 2022
64a6ed3
ArmVirtPkg: Define a GUID HOB for IPA width of a Realm
samimujawar Jul 11, 2022
0a39bde
ArmVirtPkg: Add library for Arm CCA initialisation in PEI
samimujawar Jul 12, 2022
f3ae8ce
ArmVirtPkg: Add NULL instance of ArmCcaInitPeiLib
samimujawar Jul 12, 2022
3d4d8cb
ArmVirtPkg: Add library for Arm CCA helper functions
samimujawar Jul 8, 2022
d5b68cc
ArmVirtPkg: Add Null instance of ArmCcaLib
samimujawar Jul 8, 2022
354de43
ArmVirtPkg: Define an interface to configure MMIO regions for Arm CCA
samimujawar Jul 11, 2022
e1f5304
ArmVirtPkg: CloudHv: Add a NULL implementation of ArmCcaConfigureMmio
samimujawar Apr 14, 2023
5bcb8cb
ArmVirtPkg: Qemu: Add a NULL implementation of ArmCcaConfigureMmio
samimujawar Apr 14, 2023
5233327
ArmVirtPkg: Xen: Add a NULL implementation of ArmCcaConfigureMmio
samimujawar Apr 14, 2023
9d45084
ArmVirtPkg: Configure the MMIO regions for Arm CCA
samimujawar Jul 11, 2022
c5ec28e
ArmVirtPkg: Kvmtool: Use Null version of DebugLib in PrePi
samimujawar Mar 13, 2023
9f7b47c
ArmVirtPkg: Add Arm CCA libraries for Kvmtool guest firmware
samimujawar Jul 11, 2022
bd5b011
ArmVirtPkg: Arm CCA configure system memory in early Pei
samimujawar Jul 8, 2022
99dd7ed
ArmVirtPkg: Perform Arm CCA initialisation in the Pei phase
samimujawar Jul 11, 2022
009e0c3
ArmVirtPkg: Introduce Realm Aperture Management Protocol
samimujawar Sep 20, 2018
9faad03
ArmVirtPkg: IoMMU driver to DMA from Realms
samimujawar Nov 29, 2022
b567cb4
ArmVirtPkg: Enable Virtio communication for Arm CCA
samimujawar Jul 14, 2022
c32af9b
MdePkg: Warn if AArch64 RNDR instruction is not supported
samimujawar Apr 17, 2023
7e6f46f
ArmVirtPkg: Kvmtool: Switch to use BaseRng for AArch64
samimujawar Apr 17, 2023
ae52985
ArmVirtPkg: ArmCcaRsiLib: Fix incorrect RSI version masks
samimujawar Aug 24, 2023
56bc6aa
ArmVirtPkg: ArmCcaRsiLib: Fix size of Imm field in HostCallArgs
samimujawar Sep 12, 2023
3743ca3
ArmVirtPkg: RMM 1.0-bet1 - Update width of RSI host call struct
samimujawar Sep 4, 2023
bb5b2bb
ArmVirtPkg: RMM 1.0-bet2 - Increase number of RSI host call args
samimujawar Jun 19, 2023
add3c5e
ArmVirtPkg: RMM 1.0-eac0 - Update RsiSetIpaState parameter usage
samimujawar May 2, 2023
67911fa
ArmVirtPkg: RMM 1.0-eac1 - Relax alignment of RSI host call arg
samimujawar Sep 4, 2023
069fedb
ArmVirtPkg: RMM 1.0-eac2 - Update RsiRealmConfig structure
samimujawar Aug 24, 2023
510d606
ArmVirtPkg: RMM 1.0-eac2 - Add RIPAS DESTROYED state
samimujawar Aug 24, 2023
fee563d
ArmVirtPkg: RMM 1.0-eac2 - Add RsiRipasChangeFlags definitions
samimujawar Aug 24, 2023
6af2c0b
ArmVirtPkg: RMM 1.0-eac2 - Add Flags to RsiSetIpaState()
samimujawar Aug 24, 2023
f1a3e5c
ArmVirtPkg: RMM 1.0-eac3 - Handle RsiSetIpaState() response
samimujawar Sep 25, 2023
da5c906
ArmVirtPkg: RMM 1.0-eac4 - Add RSI Features support
samimujawar Oct 10, 2023
2617e5f
ArmVirtPkg: RMM 1.0-eac5 - Attestation token API updates
samimujawar Aug 17, 2023
63cb1ba
ArmVirtPkg: RMM 1.0-eac5 - Update RSI Version support
samimujawar Oct 9, 2023
79791d4
ArmVirtPkg: ArmCcaLib: Cache current world value
samimujawar Nov 30, 2023
ea67920
ArmVirtPkg: ArmCcaIoMmu: Provide an implementation for SetAttribute
samimujawar Feb 5, 2024
2a745dd
ArmVirtPkg: RMM 1.0-rel0 - Update RIPAS state to add RipasDev
samimujawar Aug 14, 2024
39f68d0
ArmVirtPkg: RMM 1.0-rel0 - Add IPA range param to RsiGetIpaState()
samimujawar Jul 23, 2024
32923c2
ArmVirtPkg: RMM 1.0-rel0 - Add RPV to RealmConfig
samimujawar Aug 14, 2024
f7c1410
ArmVirtPkg: RMM 1.0-rel0 - Add RSI_ERROR_UNKNOWN return code
samimujawar Aug 14, 2024
f4b937e
ArmVirtPkg: Introduce an ArmPlatformDeviceInfo lib
samimujawar Aug 16, 2024
eb79f94
ArmVirtPkg: ArmPlarformDeviceInfoLib - add GIC parser
samimujawar Aug 16, 2024
67145cf
ArmVirtPkg: ArmPlarformDeviceInfoLib - add PCI parser
samimujawar Aug 16, 2024
5f5ad19
ArmVirtPkg: ArmPlatformDeviceInfoLib - add dev parser
samimujawar Aug 16, 2024
678cd43
ArmVirtPkg: ArmPlatformDeviceInfoLib - add serial parser
samimujawar Aug 16, 2024
c2454b2
ArmVirtPkg: ArmPlatformDeviceInfoLib - add RTC parser
samimujawar Aug 16, 2024
16f089c
ArmVirtPkg: Kvmtool - Parse FDT to populate mem map
samimujawar Aug 16, 2024
209dbf5
ArmVirtPkg: RMM 1.0-rel0 - Helper to check protected MMIO address
samimujawar Oct 9, 2024
43476c3
ArmVirtPkg: RMM 1.0-rel0 - Exclude MMIO config of Realm Devices
samimujawar Aug 22, 2024
535c33f
ArmVirtPkg: Kvmtool: Only install IORT if ITS is present
samimujawar Oct 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ArmVirtPkg/Library/ArmPlatformDeviceInfoLib/ArmPlatformDeviceInfoLib.inf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
HwInfoParser/FdtInfoParser.h
HwInfoParser/FdtUtility.c
HwInfoParser/FdtUtility.h
HwInfoParser/Pci/PciConfigSpaceParser.c
HwInfoParser/Pci/PciConfigSpaceParser.h
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this in the Arm CCA PR? On a quick glance this looks like some independent change.

Also why put this into ArmVirt? We have other platforms like riscv which use device trees too and can probably use this code too, so I think OvmfPkg would be a better place for it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Gerd,

Thank you for reviewing the patch series and for the feedback.

Why is this in the Arm CCA PR? On a quick glance this looks like some independent change.

Yes, I agree this is an independent change and is a general improvement for normal VMs as well. However, this was introduced as this a requirement for a Realm VM, please see
43476c3 and therefore submitted along with this series.
However, please do let me know if you think I should submit this as a separate patch.

Also why put this into ArmVirt? We have other platforms like riscv which use device trees too and can probably use this code too, so I think OvmfPkg would be a better place for it.

I agree this can be utilised by other architectures as well and it can be moved to OvmfPkg. However, I think there may be some additional changes required for supporting other architectures, e.g. there is a pending series that should help pave the way for this change, see a1f2654

Since this patch is a subset of the FdtHwInfoParser, I think similar changes would apply here as well. Considering that, I think it would be good to pursue this effort once the RiscV support is enabled in Dynamic Tables.

Please do let me know if you think otherwise, and I will update this PR accordingly.

Regards,

Sami Mujawar

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Phew. Is there some overview how the hardware detection works in for Realm VMs? Apparently this is different from the usual qemu workflow, where qemu generates both FDT and ACPI tables, the guest firmware simply downloads them via FwCfg and installs them in guest memory.

So Realm VMs get a FDT only apparently (where does it come from?), then use DynamicTablesPkg to generate the ACPI tables inside the guest, correct? Where exactly in this workflow is this change needed? Parse the FDT and generate descriptions tables which DynamicTablesPkg can consume?

On riscv: Yes, sure, additinal changes will be needed to have the riscv firmware actually use this (and this is obviously beyond the scope of this PR).. But if this is something which is likely to happen we should merge the code into OvmfPkg right away instead of merging to ArmVirt and move over to OvmfPkg later on.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe the ACPI table generation is specific to the ArmVirtKvmTool. If I remember correctly, ArmVirtQemu and ArmVirtCloudHv don't have it, so it's not (yet) a property of Realm VMs, only Kvmtool VMs. At the moment in my experimental Realm support for ArmVirtQemu, QEMU still generates ACPI tables in addition to FDT (though I haven't tested ACPI boot).

There is a larger question of whether we should create a single edk2 image for all Realm VMs, based on ArmVirtKvmtool but supporting QEMU, cloud-hypervisor and others. Given that Realm VMs have specific needs (initialization through RMM RSI, early attestation, lack of NV storage, reduced attack surface...) it would be nice to have all those things in a single image rather than porting them to each existing ArmVirt*. I've been meaning to investigate this but haven't found the time.

Having FDT->ACPI generation on this single image could also be useful for attestation. Given that firmware tables are measured (to ensure the untrusted host does not include harmful data in them), a verifier needs to be able to independently reconstruct the firmware tables, and it would reduce the efforts needed by verifiers to only measure one set of firmware tables rather than both FDT and ACPI. In QEMU the FDT is placed in memory, and ACPI tables are sent via FwCfg (whose address is found in the FDT). I believe CloudHV places both in memory and the project doesn't want to implement FwCfg.

This would require FDT to be able to represent everything ACPI can (at least for arm64 VMs), and some things may be missing. vCPU hotplug is a recent feature on Arm and I believe still requires ACPI at the moment. There might be others.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One of the reasons qemu generates ACPI tables for the guest is to decouple firmware and qemu, i.e. qemu can add new features which require ACPI table updates without depending on firmware updates.

This might be less of a concern for Realm VMs. I'm wondering whenever it is actually possible to support cpu hotplug (or memory hotplug) for Realm VMs, and there are probably more features which are not useful for CC guests.

So the idea to have a single Realm VM firmware image and have the image generate ACPI tables from FDT looks workable to me.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While being at it: Setting PcdConfidentialComputingGuestAttr probably makes sense.


[Packages]
ArmVirtPkg/ArmVirtPkg.dec
Expand Down
2 changes: 2 additions & 0 deletions ArmVirtPkg/Library/ArmPlatformDeviceInfoLib/HwInfoParser/FdtInfoParser.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
#include "FdtUtility.h"
#include "FdtInfoParser.h"
#include "Arm/Gic/ArmGicDispatcher.h"
#include "PciConfigSpaceParser.h"

/** Function pointer to a parser function.

Expand Down Expand Up @@ -43,6 +44,7 @@ EFI_STATUS
*/
STATIC CONST FDT_HW_INFO_PARSER_FUNC HwInfoParserTable[] = {
ArmGicDispatcher,
PciConfigInfoParser,
};

/** Main dispatcher: sequentially call the parsers/dispatchers
Expand Down
Loading