1*972d755fSSteven Price.. SPDX-License-Identifier: GPL-2.0 2*972d755fSSteven Price 3*972d755fSSteven Price===================================== 4*972d755fSSteven PriceArm Confidential Compute Architecture 5*972d755fSSteven Price===================================== 6*972d755fSSteven Price 7*972d755fSSteven PriceArm systems that support the Realm Management Extension (RME) contain 8*972d755fSSteven Pricehardware to allow a VM guest to be run in a way which protects the code 9*972d755fSSteven Priceand data of the guest from the hypervisor. It extends the older "two 10*972d755fSSteven Priceworld" model (Normal and Secure World) into four worlds: Normal, Secure, 11*972d755fSSteven PriceRoot and Realm. Linux can then also be run as a guest to a monitor 12*972d755fSSteven Pricerunning in the Realm world. 13*972d755fSSteven Price 14*972d755fSSteven PriceThe monitor running in the Realm world is known as the Realm Management 15*972d755fSSteven PriceMonitor (RMM) and implements the Realm Management Monitor 16*972d755fSSteven Pricespecification[1]. The monitor acts a bit like a hypervisor (e.g. it runs 17*972d755fSSteven Pricein EL2 and manages the stage 2 page tables etc of the guests running in 18*972d755fSSteven PriceRealm world), however much of the control is handled by a hypervisor 19*972d755fSSteven Pricerunning in the Normal World. The Normal World hypervisor uses the Realm 20*972d755fSSteven PriceManagement Interface (RMI) defined by the RMM specification to request 21*972d755fSSteven Pricethe RMM to perform operations (e.g. mapping memory or executing a vCPU). 22*972d755fSSteven Price 23*972d755fSSteven PriceThe RMM defines an environment for guests where the address space (IPA) 24*972d755fSSteven Priceis split into two. The lower half is protected - any memory that is 25*972d755fSSteven Pricemapped in this half cannot be seen by the Normal World and the RMM 26*972d755fSSteven Pricerestricts what operations the Normal World can perform on this memory 27*972d755fSSteven Price(e.g. the Normal World cannot replace pages in this region without the 28*972d755fSSteven Priceguest's cooperation). The upper half is shared, the Normal World is free 29*972d755fSSteven Priceto make changes to the pages in this region, and is able to emulate MMIO 30*972d755fSSteven Pricedevices in this region too. 31*972d755fSSteven Price 32*972d755fSSteven PriceA guest running in a Realm may also communicate with the RMM using the 33*972d755fSSteven PriceRealm Services Interface (RSI) to request changes in its environment or 34*972d755fSSteven Priceto perform attestation about its environment. In particular it may 35*972d755fSSteven Pricerequest that areas of the protected address space are transitioned 36*972d755fSSteven Pricebetween 'RAM' and 'EMPTY' (in either direction). This allows a Realm 37*972d755fSSteven Priceguest to give up memory to be returned to the Normal World, or to 38*972d755fSSteven Pricerequest new memory from the Normal World. Without an explicit request 39*972d755fSSteven Pricefrom the Realm guest the RMM will otherwise prevent the Normal World 40*972d755fSSteven Pricefrom making these changes. 41*972d755fSSteven Price 42*972d755fSSteven PriceLinux as a Realm Guest 43*972d755fSSteven Price---------------------- 44*972d755fSSteven Price 45*972d755fSSteven PriceTo run Linux as a guest within a Realm, the following must be provided 46*972d755fSSteven Priceeither by the VMM or by a `boot loader` run in the Realm before Linux: 47*972d755fSSteven Price 48*972d755fSSteven Price * All protected RAM described to Linux (by DT or ACPI) must be marked 49*972d755fSSteven Price RIPAS RAM before handing control over to Linux. 50*972d755fSSteven Price 51*972d755fSSteven Price * MMIO devices must be either unprotected (e.g. emulated by the Normal 52*972d755fSSteven Price World) or marked RIPAS DEV. 53*972d755fSSteven Price 54*972d755fSSteven Price * MMIO devices emulated by the Normal World and used very early in boot 55*972d755fSSteven Price (specifically earlycon) must be specified in the upper half of IPA. 56*972d755fSSteven Price For earlycon this can be done by specifying the address on the 57*972d755fSSteven Price command line, e.g. with an IPA size of 33 bits and the base address 58*972d755fSSteven Price of the emulated UART at 0x1000000: ``earlycon=uart,mmio,0x101000000`` 59*972d755fSSteven Price 60*972d755fSSteven Price * Linux will use bounce buffers for communicating with unprotected 61*972d755fSSteven Price devices. It will transition some protected memory to RIPAS EMPTY and 62*972d755fSSteven Price expect to be able to access unprotected pages at the same IPA address 63*972d755fSSteven Price but with the highest valid IPA bit set. The expectation is that the 64*972d755fSSteven Price VMM will remove the physical pages from the protected mapping and 65*972d755fSSteven Price provide those pages as unprotected pages. 66*972d755fSSteven Price 67*972d755fSSteven PriceReferences 68*972d755fSSteven Price---------- 69*972d755fSSteven Price[1] https://developer.arm.com/documentation/den0137/ 70