Error: unknown option `realm'

[qianfei11]

Error: unknown option `realm'

[abertschi]

Hello there,

The error indicates that you are using a version of kvmtool which does not contain cca patches. You need a cca-capable version of kvmtool from Arm. We have our fork included in the main repository (submodule) in /src/kvmtool [0]

There is also a pre-built binary available for Aarch64 in /assets/snapshots [1].

lkvm from assets directory

# ../lkvm --version
kvm tool 3.18.0


# ../lkvm run --help                                                                                                                                                                                                                                                                                 

 usage: lkvm run [<options>] [<kernel image>]                                                                                                                                                                                                                                                       

Basic options:                                                                                                                                                                                              
        --name <guest name>                                                                                                                                                                                                                                     
                          A name for the guest                                                                                                                                                                                                                                                       
    -c, --cpus <n>        Number of CPUs                                                                                                                                                                                                                                                             
    -m, --mem <size[BKMGTP][@addr[BKMGTP]]>                                                                                                                                                                                                                                                          
                          Virtual machine memory size and optional base address, both measured by default in megabytes (M)                                                                                                                                                                           
    -d, --disk <image or rootfs_dir>                                                                                                                                                                                                                                                                
                          Disk  image or rootfs directory                                                                                                                                                                                                                                            
        --balloon         Enable virtio balloon                                                                                                                                                                                                                                                      
        --vnc             Enable VNC framebuffer                                                                                                                                                                                                                                                     
        --gtk             Enable GTK framebuffer
        --sdl             Enable SDL framebuffer
        --rng             Enable virtio Random Number Generator
        --nodefaults      Disable implicit configuration that cannot be disabled otherwise
        --nocompat        Disable compat warnings
        --9p <dir_to_share,tag_name>
                          Enable virtio 9p to share files between host and guest
        --console <serial, virtio or hv>
                          Console to use
        --vsock <n>       Guest virtio socket CID
        --dev <device_file>
                          KVM device file
        --tty <tty id>    Remap guest TTY into a pty on the host
        --sandbox <script>
                          Run this script when booting into custom rootfs
        --hugetlbfs <path>
                          Hugetlbfs path
        --virtio-legacy   Use legacy virtio transport

Kernel options:
    -k, --kernel <kernel>
                          Kernel to boot in virtual machine
    -i, --initrd <initrd>
                          Initial RAM disk image
    -p, --params <params>
                          Kernel command line arguments
    -f, --firmware <firmware>
                          Firmware image to boot in virtual machine
    -F, --flash <flash>   Flash image to present to virtual machine

Networking options:
    -n, --network <network params>
                          Create a new guest NIC
        --no-dhcp         Disable kernel DHCP in rootfs mode

VFIO options:
        --vfio-pci <[domain:]bus:dev.fn>
                          Assign a PCI device to the virtual machine

Debug options:
        --debug           Enable debug messages
        --debug-single-step
                          Enable single stepping
        --debug-ioport    Enable ioport debugging
        --debug-mmio      Enable MMIO debugging
        --debug-iodelay <n>
                          Delay IO by millisecond

Arch-specific options:
        --aarch32         Run AArch32 guest
        --pmu             Create PMUv3 device. The emulated PMU will be set to the PMU associated with the main thread, unless --vcpu-affinity is set
        --disable-mte     Disable Memory Tagging Extension
        --vcpu-affinity <cpulist>
                          Specify the CPU affinity that will apply to all VCPUs
        --kaslr-seed <n>  Specify random seed for Kernel Address Space Layout Randomization (KASLR)
        --no-pvtime       Disable stolen time
        --disable-sve     Disable SVE
        --realm           Create VM running in a realm using Arm RME
        --measurement-algo <sha256, sha512>
                          Realm Measurement algorithm, default: sha256
        --realm-pv <personalisation value>
                          Personalisation Value (only) for Realm VMs
        --sve-vl <n>      SVE Vector Length the VM(only supported for Realms)
        --dump-dtb <.dtb file>
                          Dump generated .dtb to specified file
        --override-bad-firmware-cntfrq <n>
                          Specify Generic Timer frequency in guest DT to work around buggy secure firmware *Firmware should be updated to program CNTFRQ correctly*
        --force-pci       Force virtio devices to use PCI as their default transport
        --irqchip <[gicv2|gicv2m|gicv3|gicv3-its]>
                          Type of interrupt controller to emulate in the guest
        --firmware-address <n>
                          Address where firmware should be loaded

cheers

[0] https://github.com/sectrs-acai/acai-kvmtool-cca/tree/trusted-periph/master
[1] https://github.com/sectrs-acai/acai-assets/tree/master/snapshots

[qianfei11]

Hello there,

The error indicates that you are using a version of kvmtool which does not contain cca patches. You need a cca-capable version of kvmtool from Arm. We have our fork included in the main repository (submodule) in /src/kvmtool [0]

There is also a pre-built binary available for Aarch64 in /assets/snapshots [1].

lkvm from assets directory
cheers

[0] https://github.com/sectrs-acai/acai-kvmtool-cca/tree/trusted-periph/master [1] https://github.com/sectrs-acai/acai-assets/tree/master/snapshots

Thanks for replying! It seems that I compiled the wrong version of kvmtool, now I can run the realm vm and execute the test script successfully.