linux-kernel - Re: [PATCH v4 00/15] arm64: Support for running as a guest in Arm CCA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <09fdebd7-32a0-4a88-9002-0f24eebe00a8@nvidia.com>
Date: Thu, 15 Aug 2024 17:16:22 -0500
From: Shanker Donthineni <sdonthineni@...dia.com>
To: Matias Ezequiel Vara Larsen <mvaralar@...hat.com>,
 Steven Price <steven.price@....com>
Cc: kvm@...r.kernel.org, kvmarm@...ts.linux.dev,
 Catalin Marinas <catalin.marinas@....com>, Marc Zyngier <maz@...nel.org>,
 Will Deacon <will@...nel.org>, James Morse <james.morse@....com>,
 Oliver Upton <oliver.upton@...ux.dev>,
 Suzuki K Poulose <suzuki.poulose@....com>, Zenghui Yu
 <yuzenghui@...wei.com>, linux-arm-kernel@...ts.infradead.org,
 linux-kernel@...r.kernel.org, Joey Gouly <joey.gouly@....com>,
 Alexandru Elisei <alexandru.elisei@....com>,
 Christoffer Dall <christoffer.dall@....com>, Fuad Tabba <tabba@...gle.com>,
 linux-coco@...ts.linux.dev,
 Ganapatrao Kulkarni <gankulkarni@...amperecomputing.com>
Subject: Re: [PATCH v4 00/15] arm64: Support for running as a guest in Arm CCA

Hi Steven,

On 7/12/24 03:54, Matias Ezequiel Vara Larsen wrote:
> On Mon, Jul 01, 2024 at 10:54:50AM +0100, Steven Price wrote:
>> This series adds support for running Linux in a protected VM under the
>> Arm Confidential Compute Architecture (CCA). This has been updated
>> following the feedback from the v3 posting[1]. Thanks for the feedback!
>> Individual patches have a change log. But things to highlight:
>>
>>   * a new patch ("firmware/psci: Add psci_early_test_conduit()") to
>>     prevent SMC calls being made on systems which don't support them -
>>     i.e. systems without EL2/EL3 - thanks Jean-Philippe!
>>
>>   * two patches dropped (overriding set_fixmap_io). Instead
>>     FIXMAP_PAGE_IO is modified to include PROT_NS_SHARED. When support
>>     for assigning hardware devices to a realm guest is added this will
>>     need to be brought back in some form. But for now it's just adding
>>     complixity and confusion for no gain.
>>
>>   * a new patch ("arm64: mm: Avoid TLBI when marking pages as valid")
>>     which avoids doing an extra TLBI when doing the break-before-make.
>>     Note that this changes the behaviour in other cases when making
>>     memory valid. This should be safe (and saves a TLBI for those cases),
>>     but it's a separate patch in case of regressions.
>>
>>   * GIC ITT allocation now uses a custom genpool-based allocator. I
>>     expect this will be replaced with a generic way of allocating
>>     decrypted memory (see [4]), but for now this gets things working
>>     without wasting too much memory.
>>
>> The ABI to the RMM from a realm (the RSI) is based on the final RMM v1.0
>> (EAC 5) specification[2]. Future RMM specifications will be backwards
>> compatible so a guest using the v1.0 specification (i.e. this series)
>> will be able to run on future versions of the RMM without modification.
>>
>> This series is based on v6.10-rc1. It is also available as a git
>> repository:
>>
>> https://gitlab.arm.com/linux-arm/linux-cca cca-guest/v4

Which cca-host branch should I use for testing cca-guest/v4?

I'm getting compilation errors with cca-host/v3 and cca-guest/v4, is there
any known WAR or fix to resolve this issue?


arch/arm64/kvm/rme.c: In function ‘kvm_realm_reset_id_aa64dfr0_el1’:
././include/linux/compiler_types.h:487:45: error: call to ‘__compiletime_assert_650’ declared with attribute error: FIELD_PREP: value too large for the field
   487 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
       |                                             ^
././include/linux/compiler_types.h:468:25: note: in definition of macro ‘__compiletime_assert’
   468 |                         prefix ## suffix();                             \
       |                         ^~~~~~
././include/linux/compiler_types.h:487:9: note: in expansion of macro ‘_compiletime_assert’
   487 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
       |         ^~~~~~~~~~~~~~~~~~~
./include/linux/build_bug.h:39:37: note: in expansion of macro ‘compiletime_assert’
    39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
       |                                     ^~~~~~~~~~~~~~~~~~
./include/linux/bitfield.h:68:17: note: in expansion of macro ‘BUILD_BUG_ON_MSG’
    68 |                 BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ?           \
       |                 ^~~~~~~~~~~~~~~~
./include/linux/bitfield.h:115:17: note: in expansion of macro ‘__BF_FIELD_CHECK’
   115 |                 __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: ");    \
       |                 ^~~~~~~~~~~~~~~~
arch/arm64/kvm/rme.c:315:16: note: in expansion of macro ‘FIELD_PREP’
   315 |         val |= FIELD_PREP(ID_AA64DFR0_EL1_BRPs_MASK, bps - 1) |
       |                ^~~~~~~~~~
make[5]: *** [scripts/Makefile.build:244: arch/arm64/kvm/rme.o] Error 1
make[4]: *** [scripts/Makefile.build:485: arch/arm64/kvm] Error 2
make[3]: *** [scripts/Makefile.build:485: arch/arm64] Error 2
make[3]: *** Waiting for unfinished jobs....

I'm using gcc-13.3.0 compiler and cross-compiling on X86 machine.


-Shanker