From d363fb65ee1e271dc7609b1f693952427f78910c Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 10:06:31 +0200
Subject: [PATCH 1/9] Add draft CCA planes OpenHCL Learning Path

Failure observed: testing on tp-desktop showed the original source-build flow could not run as a public Learning Path because the CCA-dev-platform source URL was not publicly cloneable from a clean host and the documented Shrinkwrap build failed immediately when planes.yaml was absent.

Fix: add a draft Learning Path that gates the build on a published planes overlay, adds a Shrinkwrap --dry-run validation step, records the required public source inputs, and keeps the path draft:true until those inputs are available.

Additional context: tp-desktop is Ubuntu 24.04 x86_64 with Docker and aarch64-linux-gnu-gcc available but no passwordless sudo. setup.source_me succeeded after creating a venv and installing Python packages from the package index. A temporary planes.yaml based on the prototype notes passed shrinkwrap build --dry-run after escaping shell substitution as $$(...).
---
 .../cca-planes-openhcl/_index.md              |  75 +++++++
 .../cca-planes-openhcl/_next-steps.md         |   9 +
 .../cca-planes-openhcl/build-stack.md         | 185 ++++++++++++++++++
 .../cca-planes-openhcl/overview.md            |  30 +++
 .../publication-readiness.md                  |  45 +++++
 .../cca-planes-openhcl/run-auxiliary-plane.md |  57 ++++++
 .../cca-planes-openhcl/run-plane0.md          |  73 +++++++
 7 files changed, 474 insertions(+)
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_index.md
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_next-steps.md
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/overview.md
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md
 create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_index.md
new file mode 100644
index 0000000000..7c41e2dacb
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_index.md
@@ -0,0 +1,75 @@
+---
+title: Run an auxiliary plane in an Arm CCA Realm
+description: Learn how to build a planes-enabled Arm CCA software stack, boot plane 0 Linux in a Realm, and run a test microkernel in an auxiliary plane on an Arm FVP.
+
+minutes_to_complete: 180
+
+who_is_this_for: This advanced topic is for firmware, kernel, and virtualization developers who want to experiment with Arm CCA planes in an emulated environment.
+
+learning_objectives:
+    - Build a planes-enabled Arm CCA software stack with Shrinkwrap.
+    - Boot plane 0 Linux in a Realm on an Arm Fixed Virtual Platform (FVP).
+    - Run a test microkernel in an auxiliary plane from plane 0.
+    - Validate that the plane entry test reaches the expected result.
+
+prerequisites:
+    - An AArch64 or x86_64 computer running Ubuntu 24.04 LTS with at least 30 GB of free disk space.
+    - A user account with `sudo` access to install host packages, or a host where the listed packages are already installed.
+    - Completion of the [Run an application in a Realm using the Arm Confidential Compute Architecture (CCA)](/learning-paths/servers-and-cloud-computing/cca-container/) Learning Path.
+    - Familiarity with Linux kernel builds, Rust builds, Docker, and the Linux command line.
+
+author: Arm
+
+draft: true
+generate_summary_faq: true
+rerun_summary: false
+rerun_faqs: false
+
+### Tags
+skilllevels: Advanced
+subjects: Containers and Virtualization
+armips:
+    - Neoverse
+    - Cortex-A
+operatingsystems:
+    - Linux
+tools_software_languages:
+    - CCA
+    - RME
+    - FVP
+    - Docker
+    - Shrinkwrap
+    - Linux
+    - Rust
+    - OpenHCL
+    - OpenVMM
+    - kvmtool
+
+further_reading:
+    - resource:
+        title: Arm Confidential Compute Architecture
+        link: https://www.arm.com/architecture/security-features/arm-confidential-compute-architecture
+        type: website
+    - resource:
+        title: Learn the architecture - Realm Management Extension
+        link: https://developer.arm.com/documentation/den0126
+        type: documentation
+    - resource:
+        title: Realm Management Monitor specification
+        link: https://developer.arm.com/documentation/den0137/latest/
+        type: documentation
+    - resource:
+        title: Shrinkwrap documentation
+        link: https://shrinkwrap.docs.arm.com/en/latest/index.html
+        type: documentation
+    - resource:
+        title: OpenVMM and OpenHCL project
+        link: https://github.com/microsoft/openvmm
+        type: website
+
+### FIXED, DO NOT MODIFY
+# ================================================================================
+weight: 1                       # _index.md always has weight of 1 to order correctly
+layout: "learningpathall"       # All files under learning paths have this same wrapper
+learning_path_main_page: "yes"  # This should be surfaced when looking for related content. Only set for _index.md of learning path content.
+---
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_next-steps.md
new file mode 100644
index 0000000000..1b533c07ad
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/_next-steps.md
@@ -0,0 +1,9 @@
+---
+# ================================================================================
+#       FIXED, DO NOT MODIFY THIS FILE
+# ================================================================================
+weight: 21                  # Set to always be larger than the content in this path to be at the end of the navigation.
+title: "Next Steps"         # Always the same, html page title.
+layout: "learningpathall"   # All files under learning paths have this same wrapper for Hugo processing.
+---
+
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
new file mode 100644
index 0000000000..d034666172
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
@@ -0,0 +1,185 @@
+---
+# User change
+title: "Build the planes-enabled stack"
+
+weight: 3
+
+# Do not modify these elements
+layout: "learningpathall"
+---
+
+## Install host packages
+
+Use Ubuntu 24.04 LTS for the host system. Install the packages needed by the CCA development platform, Shrinkwrap, Docker, and the prototype builds:
+
+```console
+sudo apt update
+sudo apt upgrade
+sudo apt install build-essential cmake ninja-build python3-venv ccache git \
+    parted e2fsprogs docker.io netcat-openbsd telnet net-tools docker-buildx \
+    flex libssl-dev gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+```
+
+These commands require `sudo` access. If you are using a shared host where you do not have passwordless `sudo`, ask the administrator to install the packages or use a host where they are already present.
+
+Add your user to the `docker` group:
+
+```console
+sudo usermod -aG docker $USER
+newgrp docker
+```
+
+Check that Docker is available:
+
+```console
+docker ps
+```
+
+## Clone and initialize the CCA development platform
+
+Clone the CCA development platform repository:
+
+```console
+mkdir -p $HOME/cca-planes-workbook
+cd $HOME/cca-planes-workbook
+git clone <CCA-dev-platform-public-repository> CCA-dev-platform
+cd CCA-dev-platform
+```
+
+Set up the build environment:
+
+```console
+source setup.source_me
+```
+
+This command creates a Python virtual environment, installs the Python packages needed by Shrinkwrap, and sets the `SHRINKWRAP_*` environment variables. The package installation step needs network access to Python package indexes unless the host already has a populated virtual environment.
+
+## Add the planes Shrinkwrap overlay
+
+Before you build the stack, make sure that the planes overlay is available. The rest of this Learning Path depends on a published `planes.yaml` file:
+
+```console
+test -f config/planes.yaml
+```
+
+The planes overlay must configure the stack to:
+
+- Build RMM with CCA v1.1 experimental features enabled.
+- Build a Linux host with virtualization support needed by CCA.
+- Build a `kvmtool` version that can create a Realm with at least one auxiliary plane.
+- Enable Permission Indirection and Permission Overlay support in the FVP run parameters.
+
+{{% notice Note %}}
+This draft assumes that `planes.yaml` is published with the demo repository before the Learning Path is published. If `test -f config/planes.yaml` fails, stop here and see the publication readiness page.
+{{% /notice %}}
+
+If the overlay uses shell command substitution in a Shrinkwrap command, escape the dollar sign as `$$`. For example, use `$$(stat -c '%Y' ${param:sourcedir})` instead of `$(stat -c '%Y' ${param:sourcedir})`.
+
+Validate the merged Shrinkwrap configuration before starting the full build:
+
+```console
+shrinkwrap build cca-3world.yaml --overlay cca-lp.yaml --overlay planes.yaml \
+    --btvar GUEST_ROOTFS='${artifact:BUILDROOT}' --dry-run
+```
+
+The dry run prints the generated build script. If it reports a missing overlay, a malformed macro, or an unresolved repository setting, fix the overlay before you continue.
+
+Build the CCA stack with the base Learning Path overlay and the planes overlay:
+
+```console
+shrinkwrap build cca-3world.yaml --overlay cca-lp.yaml --overlay planes.yaml \
+    --btvar GUEST_ROOTFS='${artifact:BUILDROOT}'
+```
+
+## Build the plane 0 Linux kernel
+
+Clone the public OpenHCL Linux source and check out the branch used by the planes demo:
+
+```console
+cd $HOME/cca-planes-workbook
+git clone <OpenHCL-Linux-public-repository> openhcl-linux
+cd openhcl-linux
+git checkout <planes-demo-branch>
+```
+
+Configure the kernel for a Realm guest, 9P file sharing, and OpenHCL support:
+
+```console
+export ARCH=arm64
+export CROSS_COMPILE=aarch64-linux-gnu-
+make defconfig
+./scripts/config --file .config --enable CONFIG_VIRT_DRIVERS --enable CONFIG_ARM_CCA_GUEST
+./scripts/config --file .config --enable CONFIG_NET_9P --enable CONFIG_NET_9P_FD
+./scripts/config --file .config --enable CONFIG_NET_9P_VIRTIO --enable CONFIG_NET_9P_FS
+./scripts/config --file .config --enable CONFIG_HYPERV --enable CONFIG_HYPERV_MSHV
+./scripts/config --file .config --enable CONFIG_MSHV --enable CONFIG_MSHV_VTL
+./scripts/config --file .config --enable CONFIG_HYPERV_VTL_MODE
+make olddefconfig
+make Image -j$(nproc)
+```
+
+## Build the test microkernel and VMM
+
+Clone the public OpenVMM/OpenHCL source and check out the branch used by the planes demo:
+
+```console
+cd $HOME/cca-planes-workbook
+git clone <OpenVMM-public-repository> openvmm
+cd openvmm
+git checkout <planes-demo-branch>
+```
+
+Install the Rust targets used by the test microkernel and the VMM:
+
+```console
+rustup target add aarch64-unknown-linux-gnu
+rustup target add aarch64-unknown-none
+```
+
+Build the binaries:
+
+```console
+unset ARCH
+unset CROSS_COMPILE
+RUSTC_BOOTSTRAP=1 cargo build -p simple_tmk --config openhcl/minimal_rt/aarch64-config.toml
+RUSTC_BOOTSTRAP=1 cargo build -p tmk_vmm --target aarch64-unknown-linux-gnu
+```
+
+## Add the plane 0 kernel and test binaries to the root filesystem
+
+Resize the root filesystem to make room for the prototype binaries:
+
+```console
+export CCA_PLANES_WORKDIR=$HOME/cca-planes-workbook
+export PLANE0_IMAGE=$CCA_PLANES_WORKDIR/openhcl-linux/arch/arm64/boot/Image
+export SIMPLE_TMK=$CCA_PLANES_WORKDIR/openvmm/target/aarch64-minimal_rt-none/debug/simple_tmk
+export TMK_VMM=$CCA_PLANES_WORKDIR/openvmm/target/aarch64-unknown-linux-gnu/debug/tmk_vmm
+
+cd $CCA_PLANES_WORKDIR/CCA-dev-platform
+cd "$SHRINKWRAP_PACKAGE/cca-3world"
+TOOLS_PATH="$SHRINKWRAP_BUILD/build/cca-3world/buildroot/host/sbin"
+$TOOLS_PATH/e2fsck -fp rootfs.ext2
+$TOOLS_PATH/resize2fs rootfs.ext2 1G
+```
+
+Mount the root filesystem:
+
+```console
+sudo mkdir -p mnt
+sudo mount rootfs.ext2 mnt
+sudo mkdir -p mnt/cca
+```
+
+Copy the files needed by plane 0:
+
+```console
+sudo cp guest-disk.img KVMTOOL_EFI.fd Image lkvm mnt/cca/
+sudo cp "$PLANE0_IMAGE" mnt/cca/Image_ohcl
+sudo cp "$SIMPLE_TMK" mnt/cca/
+sudo cp "$TMK_VMM" mnt/cca/
+sudo umount mnt
+```
+
+## What you've accomplished
+
+You have built the planes-enabled CCA stack, the plane 0 Linux kernel, and the TMK test binaries. Next, boot the FVP and start the Realm.
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/overview.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/overview.md
new file mode 100644
index 0000000000..af5e0287c4
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/overview.md
@@ -0,0 +1,30 @@
+---
+# User change
+title: "Understand CCA planes"
+
+weight: 2
+
+# Do not modify these elements
+layout: "learningpathall"
+---
+
+## Understand CCA planes
+
+Arm Confidential Compute Architecture (CCA) protects confidential workloads by running them in Realms. Planes extend this model by dividing a Realm into multiple isolated execution environments.
+
+Plane 0 is the initial Realm execution environment. Plane N is an auxiliary plane that plane 0 software can enter by using the Realm Service Interface (RSI). In this Learning Path, plane 0 runs a Linux kernel with support for the OpenHCL prototype. Plane 0 then starts a small VMM process, `tmk_vmm`, which enters plane 1 and runs the `simple_tmk` test microkernel.
+
+The prototype stack has the following components:
+
+- An Arm FVP with Realm Management Extension (RME), Permission Indirection, and Permission Overlay support enabled.
+- Trusted Firmware-A (TF-A) and the Realm Management Monitor (RMM) built with CCA v1.1 experimental features enabled.
+- Host Linux and `kvmtool` with support for creating a Realm that has an auxiliary plane.
+- Plane 0 Linux with CCA guest support, 9P filesystem support, and OpenHCL driver support.
+- `tmk_vmm` and `simple_tmk`, built from OpenVMM/OpenHCL sources.
+
+Plane 0 prepares memory and processor state for the auxiliary plane. When `tmk_vmm` runs, it uses the CCA backend to call into the plane support exposed by plane 0 Linux. The RMM handles the transition from plane 0 to plane 1, and returns control to plane 0 on a plane exit.
+
+## What you've learned
+
+You have seen the role of each component in the prototype flow. Next, set up the host machine and build the software stack.
+
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
new file mode 100644
index 0000000000..272d789233
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -0,0 +1,45 @@
+---
+# User change
+title: "Prepare the Learning Path for publication"
+
+weight: 6
+
+# Do not modify these elements
+layout: "learningpathall"
+---
+
+## Publication readiness
+
+This Learning Path is a draft. Complete the following tasks before publication:
+
+- Publish a planes-enabled `CCA-dev-platform` workflow or replace the source-build steps with a public prebuilt Docker image.
+- Publish the `planes.yaml` Shrinkwrap overlay used by the demo.
+- Run `shrinkwrap build ... --dry-run` with the published overlay and fix any Shrinkwrap macro escaping issues.
+- Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel.
+- Publish or identify the public OpenVMM/OpenHCL branch used for `simple_tmk` and `tmk_vmm`.
+- Confirm that the OpenVMM/OpenHCL branch is reachable from a clean host. The public upstream OpenVMM repository does not currently expose an obvious CCA planes branch for this draft.
+- Replace placeholder repository URLs and branch names with public URLs.
+- Capture and add the exact successful `tmk_vmm` output.
+- Test the full flow on a clean Ubuntu 24.04 LTS host.
+- Remove `draft: true` from `_index.md` after the content is runnable from public inputs.
+
+## Optional Docker flow
+
+If the final demo is packaged as a Docker image, replace the build page with a shorter setup flow:
+
+```console
+docker pull armswdev/cca-learning-path:cca-planes-openhcl-<version>
+docker run --rm -it armswdev/cca-learning-path:cca-planes-openhcl-<version>
+```
+
+The image should contain:
+
+- A planes-enabled FVP launch script.
+- A planes-enabled CCA host root filesystem.
+- `Image_ohcl` for plane 0 Linux.
+- `simple_tmk` and `tmk_vmm`.
+- Any helper scripts needed to mount 9P and hugetlbfs in plane 0.
+
+## Source handling
+
+Use public sources in the final Learning Path. Do not copy private links, private branch names, or restricted diagrams into the public Learning Paths repository.
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md
new file mode 100644
index 0000000000..9ceed665f5
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md
@@ -0,0 +1,57 @@
+---
+# User change
+title: "Run the auxiliary plane test"
+
+weight: 5
+
+# Do not modify these elements
+layout: "learningpathall"
+---
+
+## Start the test microkernel
+
+Run `tmk_vmm` from plane 0:
+
+```console
+cd /root/mount
+export RUST_BACKTRACE=1
+./tmk_vmm --hv cca --tmk ./simple_tmk
+```
+
+The VMM prepares memory for the auxiliary plane, asks the plane 0 kernel to set the required permissions, and enters the test microkernel.
+
+{{% notice Note %}}
+The exact success output must be captured from the final public demo build. Replace this draft note with the final expected output before publication.
+{{% /notice %}}
+
+## Validate the result
+
+Confirm these conditions before treating the run as successful:
+
+- `tmk_vmm` starts without a Rust panic.
+- The OpenHCL CCA backend selects the `cca` hypervisor path.
+- The test microkernel reaches its success path.
+- Control returns to plane 0 after the auxiliary plane exits.
+
+If the command fails before entering the auxiliary plane, check that `/root/huge` is mounted with 32 MB pages and that the `hugepagesz=32M hugepages=1` kernel parameters were passed to plane 0 Linux.
+
+If the command reports that CCA support is unavailable, check that the stack was built with planes-enabled RMM, host kernel, and `kvmtool` components.
+
+## Shut down
+
+Shut down plane 0 Linux:
+
+```console
+poweroff
+```
+
+When you return to the CCA host prompt, shut down the host:
+
+```console
+poweroff
+```
+
+## What you've accomplished
+
+You have run the test VMM in plane 0 and used it to start a test microkernel in an auxiliary plane.
+
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
new file mode 100644
index 0000000000..de91fbebf0
--- /dev/null
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
@@ -0,0 +1,73 @@
+---
+# User change
+title: "Boot plane 0 Linux"
+
+weight: 4
+
+# Do not modify these elements
+layout: "learningpathall"
+---
+
+## Run the FVP
+
+Start the CCA stack on the FVP:
+
+```console
+shrinkwrap run cca-3world.yaml --rtvar ROOTFS=$(realpath "$SHRINKWRAP_PACKAGE/cca-3world/rootfs.ext2")
+```
+
+Log in to the CCA host as `root`. No password is required.
+
+## Start a Realm with plane 0 Linux
+
+Change to the directory that contains the CCA demo files:
+
+```console
+cd /cca
+```
+
+Start the Realm with the plane 0 kernel, 9P sharing, and a 32 MB huge page for the auxiliary plane payload:
+
+```console
+./lkvm run --realm --disable-sve --irqchip=gicv3-its \
+    -c 1 -m 512 --no-pvtime --force-pci --console virtio \
+    --kernel /cca/Image_ohcl --9p /cca/,cca_mount \
+    -p "console=hvc0 root=/dev/vda2 hugepagesz=32M hugepages=1" \
+    --measurement-algo=sha256 --restricted_mem
+```
+
+The plane 0 Linux kernel boots inside the Realm. Log in as `root` when the login prompt appears.
+
+## Prepare shared files and huge pages
+
+Create a mount point for the 9P share:
+
+```console
+mkdir -p /root/mount
+mount -t 9p -o trans=virtio cca_mount /root/mount
+```
+
+Create the hugetlbfs mount used by `tmk_vmm`:
+
+```console
+mkdir -p /root/huge
+mount -t hugetlbfs -o pagesize=32768kB,size=32768kB none /root/huge
+```
+
+Confirm that the test binaries are visible from plane 0:
+
+```console
+ls /root/mount/simple_tmk /root/mount/tmk_vmm
+```
+
+The output should show both files:
+
+```output
+/root/mount/simple_tmk
+/root/mount/tmk_vmm
+```
+
+## What you've accomplished
+
+You have booted plane 0 Linux inside a CCA Realm and prepared the shared filesystem and huge page needed by the auxiliary plane test.
+

From 1cd7fc6823671ba00997c9c27fb5661c6681714b Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 10:25:38 +0200
Subject: [PATCH 2/9] Document planes kvmtool overlay requirement

Failure observed: testing on tp-desktop showed that using --overlay cca-lp.yaml --overlay planes.yaml with kvmtool revision cca/planes/rfc-v1 fails while applying config/lkvm.patch to net/uip/tcp.c. Adding a later kvmtool.prebuild list in planes.yaml does not remove the inherited patch because Shrinkwrap appends list values during overlay merge.

Fix: update the draft Learning Path to require a planes-specific cca-planes-lp.yaml overlay and change the documented dry-run and build commands to use it. The overlay carries the base Learning Path filesystem and tooling changes while excluding the kvmtool.yaml layer that applies the incompatible patch.

Additional context: a temporary cca-planes-lp.yaml on tp-desktop passed shrinkwrap build --dry-run and a real build progressed beyond the earlier kvmtool patch failure. The publication checklist now requires publishing that overlay or changing CCA-dev-platform so the lkvm.patch prebuild step is skipped for the planes branch.
---
 .../cca-planes-openhcl/build-stack.md         | 19 +++++++++++++------
 .../publication-readiness.md                  |  2 ++
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
index d034666172..add795e3a1 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
@@ -54,14 +54,17 @@ source setup.source_me
 
 This command creates a Python virtual environment, installs the Python packages needed by Shrinkwrap, and sets the `SHRINKWRAP_*` environment variables. The package installation step needs network access to Python package indexes unless the host already has a populated virtual environment.
 
-## Add the planes Shrinkwrap overlay
+## Add the planes Shrinkwrap overlays
 
-Before you build the stack, make sure that the planes overlay is available. The rest of this Learning Path depends on a published `planes.yaml` file:
+Before you build the stack, make sure that the planes overlays are available. The rest of this Learning Path depends on the published `cca-planes-lp.yaml` and `planes.yaml` files:
 
 ```console
+test -f config/cca-planes-lp.yaml
 test -f config/planes.yaml
 ```
 
+The `cca-planes-lp.yaml` overlay must contain the base CCA Learning Path filesystem and tooling changes from `cca-lp.yaml`, without the `kvmtool.yaml` layer. The `kvmtool.yaml` layer applies `config/lkvm.patch` before building `kvmtool`. That patch is incompatible with the planes-enabled `kvmtool` branch that this prototype uses.
+
 The planes overlay must configure the stack to:
 
 - Build RMM with CCA v1.1 experimental features enabled.
@@ -70,24 +73,28 @@ The planes overlay must configure the stack to:
 - Enable Permission Indirection and Permission Overlay support in the FVP run parameters.
 
 {{% notice Note %}}
-This draft assumes that `planes.yaml` is published with the demo repository before the Learning Path is published. If `test -f config/planes.yaml` fails, stop here and see the publication readiness page.
+This draft assumes that `cca-planes-lp.yaml` and `planes.yaml` are published with the demo repository before the Learning Path is published. If either `test` command fails, stop here and see the publication readiness page.
 {{% /notice %}}
 
 If the overlay uses shell command substitution in a Shrinkwrap command, escape the dollar sign as `$$`. For example, use `$$(stat -c '%Y' ${param:sourcedir})` instead of `$(stat -c '%Y' ${param:sourcedir})`.
 
+{{% notice Warning %}}
+Testing on Ubuntu 24.04 showed that `--overlay cca-lp.yaml --overlay planes.yaml` fails while applying `config/lkvm.patch` to `net/uip/tcp.c` in the planes-enabled `kvmtool` branch. Shrinkwrap appends list values from later overlays, so adding another `kvmtool.prebuild` list in `planes.yaml` does not remove the inherited patch command. Use a planes-specific Learning Path overlay that excludes the `kvmtool.yaml` layer, or update the CCA development platform so the patch is skipped for the planes branch.
+{{% /notice %}}
+
 Validate the merged Shrinkwrap configuration before starting the full build:
 
 ```console
-shrinkwrap build cca-3world.yaml --overlay cca-lp.yaml --overlay planes.yaml \
+shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.yaml \
     --btvar GUEST_ROOTFS='${artifact:BUILDROOT}' --dry-run
 ```
 
 The dry run prints the generated build script. If it reports a missing overlay, a malformed macro, or an unresolved repository setting, fix the overlay before you continue.
 
-Build the CCA stack with the base Learning Path overlay and the planes overlay:
+Build the CCA stack with the planes Learning Path overlay and the planes feature overlay:
 
 ```console
-shrinkwrap build cca-3world.yaml --overlay cca-lp.yaml --overlay planes.yaml \
+shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.yaml \
     --btvar GUEST_ROOTFS='${artifact:BUILDROOT}'
 ```
 
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index 272d789233..ecf3d7a11c 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -13,8 +13,10 @@ layout: "learningpathall"
 This Learning Path is a draft. Complete the following tasks before publication:
 
 - Publish a planes-enabled `CCA-dev-platform` workflow or replace the source-build steps with a public prebuilt Docker image.
+- Publish `cca-planes-lp.yaml` or update the CCA development platform so the `config/lkvm.patch` prebuild step from `kvmtool.yaml` is skipped for the planes-enabled `kvmtool` branch.
 - Publish the `planes.yaml` Shrinkwrap overlay used by the demo.
 - Run `shrinkwrap build ... --dry-run` with the published overlay and fix any Shrinkwrap macro escaping issues.
+- Run a real Shrinkwrap build through the `kvmtool` phase and confirm that `config/lkvm.patch` is not applied to the planes-enabled branch.
 - Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel.
 - Publish or identify the public OpenVMM/OpenHCL branch used for `simple_tmk` and `tmk_vmm`.
 - Confirm that the OpenVMM/OpenHCL branch is reachable from a clean host. The public upstream OpenVMM repository does not currently expose an obvious CCA planes branch for this draft.

From 2cc02d23c2b60bc285373f3626af6384b5259b60 Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 16:09:47 +0200
Subject: [PATCH 3/9] Fix CCA planes OpenHCL learning path

Use the CCA-dev-platform README and the Fenimore OpenHCL prototype notes to make the draft path runnable against the current planes prototype inputs.

The build page now creates cca-planes-lp.yaml locally so the base Learning Path filesystem and tooling changes are kept without inheriting kvmtool.yaml and config/lkvm.patch. It also creates planes.yaml with the prototype TF-RMM, linux-cca, kvmtool-cca, TF-A, and FVP Permission Indirection and Overlay settings.

Record tp-desktop validation on Ubuntu 24.04.4: HTTPS clone of the GitHub repo still prompts for credentials, SSH reached CCA-dev-platform planes commit a7c5ec548bbf148ace0bea889cba92ef33c33f76, the dry run selected cca/planes/rfc-v1 and omitted lkvm.patch, and the full Shrinkwrap build completed buildroot and guest-disk artifacts.

Also replace placeholder OpenHCL Linux and OpenVMM source commands with the internal prototype branches currently used by the Fenimore notes, while keeping publication blockers explicit until public branches are available.
---
 .../cca-planes-openhcl/build-stack.md         | 208 +++++++++++++++---
 .../publication-readiness.md                  |  52 ++++-
 2 files changed, 229 insertions(+), 31 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
index add795e3a1..afcef8708d 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
@@ -20,7 +20,8 @@ sudo apt install build-essential cmake ninja-build python3-venv ccache git \
     flex libssl-dev gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 ```
 
-These commands require `sudo` access. If you are using a shared host where you do not have passwordless `sudo`, ask the administrator to install the packages or use a host where they are already present.
+These commands require `sudo` access. If you are using a shared host where you do not have passwordless `sudo`, ask the administrator to install the packages or use a host where they are already
+present.
 
 Add your user to the `docker` group:
 
@@ -42,44 +43,196 @@ Clone the CCA development platform repository:
 ```console
 mkdir -p $HOME/cca-planes-workbook
 cd $HOME/cca-planes-workbook
-git clone <CCA-dev-platform-public-repository> CCA-dev-platform
+git clone --branch planes https://github.com/EllieRoe/CCA-dev-platform.git CCA-dev-platform
 cd CCA-dev-platform
 ```
 
+This command must complete without prompting for GitHub credentials before the Learning Path is ready for publication. If GitHub prompts for credentials, the repository is still unavailable through
+public HTTPS access.
+
 Set up the build environment:
 
 ```console
 source setup.source_me
 ```
 
-This command creates a Python virtual environment, installs the Python packages needed by Shrinkwrap, and sets the `SHRINKWRAP_*` environment variables. The package installation step needs network access to Python package indexes unless the host already has a populated virtual environment.
+This command creates a Python virtual environment, installs the Python packages needed by Shrinkwrap, and sets the `SHRINKWRAP_*` environment variables. The package installation step needs network
+access to Python package indexes unless the host already has a populated virtual environment.
 
-## Add the planes Shrinkwrap overlays
+## Create the planes Shrinkwrap overlays
 
-Before you build the stack, make sure that the planes overlays are available. The rest of this Learning Path depends on the published `cca-planes-lp.yaml` and `planes.yaml` files:
+The CCA development platform README describes the base Learning Path build with `cca-lp.yaml`. The OpenHCL prototype also needs a planes overlay. Create a Learning Path overlay that keeps the base
+filesystem and tooling changes from `cca-lp.yaml`, while omitting the `kvmtool.yaml` layer that applies `config/lkvm.patch`:
 
 ```console
-test -f config/cca-planes-lp.yaml
-test -f config/planes.yaml
-```
+cat > config/cca-planes-lp.yaml <<'EOF'
+# Copyright (c) 2026, Arm Limited.
+# SPDX-License-Identifier: MIT
 
-The `cca-planes-lp.yaml` overlay must contain the base CCA Learning Path filesystem and tooling changes from `cca-lp.yaml`, without the `kvmtool.yaml` layer. The `kvmtool.yaml` layer applies `config/lkvm.patch` before building `kvmtool`. That patch is incompatible with the planes-enabled `kvmtool` branch that this prototype uses.
+%YAML 1.2
+---
+description: >-
+  Generates all blobs for the CCA planes Learning Path while avoiding the
+  kvmtool patch layer used by the base CCA Learning Path overlay.
+
+concrete: true
+
+layers:
+  - buildroot-cca.yaml
+  - bootsync.yaml
+  - cca-kata.yaml
+  - edk2.yaml
+
+build:
+
+  linux:
+    prebuild:
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_VIRT_DRIVERS
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_ARM_FFA_TRANSPORT
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_ARM_CCA_GUEST
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TSM_REPORTS
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TRACEPOINTS
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TRACING
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_FTRACE
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_FUNCTION_TRACER
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_FUNCTION_GRAPH_TRACER
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DYNAMIC_FTRACE
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TRACE_EVENTS
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLOCK
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLK_DEV_IO_TRACE
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_EVENT_TRACING
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLOCK_HOLDER_TRACKING
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLK_DEV_BOUNCE
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_PERF_EVENTS
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_PERF_USE_VMALLOC
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_PRINTK
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DEBUG_KERNEL
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DEBUG_FS
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DEBUG_INFO
+
+  buildroot:
+    repo:
+      revision: 2026.02
+
+    prebuild:
+      - ./utils/config --file ${param:builddir}/.config --set-str BR2_ROOTFS_POST_BUILD_SCRIPT ${param:configdir}/../realm-post-build-lp.sh
+      - ./utils/config --file ${param:builddir}/.config --set-str TARGET_GENERIC_HOSTNAME "realm"
+      - ./utils/config --file ${param:builddir}/.config --set-str TARGET_GENERIC_ISSUE "Welcome to the CCA realm"
+      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_OPTEE_EXAMPLES
+      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_OPTEE_TEST
+      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_OPTEE_CLIENT
+      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_TRACE_CMD
+      - ./utils/config --file ${param:builddir}/.config --enable BR2_PACKAGE_LIBOPENSSL_BIN
+      - ./utils/config --file ${param:builddir}/.config --enable BR2_PACKAGE_LIBOPENSSL_ENGINES
+
+  rmm:
+    params:
+      -DRMM_V1_1: 1
+      -DRMM_MEM_SCRUB_METHOD: 2
+
+  tfa:
+    params:
+      ENABLE_FEAT_MEC: 1
+
+run:
+
+  terminals:
+    bp.terminal_0:
+      type: telnet
+
+    bp.terminal_1:
+      type: telnet
+
+    bp.terminal_2:
+      type: telnet
+
+    bp.terminal_3:
+      type: telnet
+EOF
+```
 
-The planes overlay must configure the stack to:
+Create the planes feature overlay. This overlay selects the prototype RMM, host Linux, and `kvmtool` branches, and enables Permission Indirection and Permission Overlay in the FVP parameters:
 
-- Build RMM with CCA v1.1 experimental features enabled.
-- Build a Linux host with virtualization support needed by CCA.
-- Build a `kvmtool` version that can create a Realm with at least one auxiliary plane.
-- Enable Permission Indirection and Permission Overlay support in the FVP run parameters.
+```console
+cat > config/planes.yaml <<'EOF'
+# Copyright (c) 2026, Arm Limited.
+# SPDX-License-Identifier: MIT
 
-{{% notice Note %}}
-This draft assumes that `cca-planes-lp.yaml` and `planes.yaml` are published with the demo repository before the Learning Path is published. If either `test` command fails, stop here and see the publication readiness page.
-{{% /notice %}}
+%YAML 1.2
+---
+description: >-
+  Overlay for the CCA planes OpenHCL prototype.
+
+buildex:
+  btvars:
+    RMM_LOG_LEVEL:
+      type: string
+      value: '10'
+
+    RMM_CONFIG:
+      type: string
+      value: 'fvp_defcfg'
+
+    TFA_REVISION:
+      type: string
+      value: master
+
+build:
+
+  rmm:
+    repo:
+      remote: https://github.com/TF-RMM/tf-rmm.git
+      revision: 9a98e8fcb1645b9917b2abd79212e6e3062e09fd
+
+    params:
+      -DLOG_LEVEL: ${btvar:RMM_LOG_LEVEL}
+      -DRMM_CONFIG: ${btvar:RMM_CONFIG}
+      -DRMM_V1_1: 1
+      -DPLAT_CMN_CTX_MAX_XLAT_TABLES: 13
+
+  tfa:
+    repo:
+      revision: ${btvar:TFA_REVISION}
+
+    params:
+      GIC_ENABLE_V4_EXTN: 1
+
+  linux:
+    repo:
+      remote: https://gitlab.arm.com/linux-arm/linux-cca.git
+      revision: cca/planes/rfc-v1
+
+    prebuild:
+      - export KBUILD_BUILD_TIMESTAMP="@$$(stat -c '%Y' ${param:sourcedir})"
+      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_VIRT_DRIVERS
+      - ./scripts/config --file ${param:builddir}/.config --disable CONFIG_HZ_250 --enable CONFIG_HZ_100
+      - ./scripts/config --file ${param:builddir}/.config --disable CONFIG_RANDOMIZE_BASE
+
+  kvmtool:
+    repo:
+      kvmtool:
+        remote: https://gitlab.arm.com/linux-arm/kvmtool-cca.git
+        revision: cca/planes/rfc-v1
+
+run:
+  params:
+    -C cluster0.has_permission_indirection_s1: 2
+    -C cluster1.has_permission_indirection_s1: 2
+    -C cluster0.has_permission_indirection_s2: 2
+    -C cluster1.has_permission_indirection_s2: 2
+    -C cluster0.has_permission_overlay_s1: 2
+    -C cluster1.has_permission_overlay_s1: 2
+    -C cluster0.has_permission_overlay_s2: 2
+    -C cluster1.has_permission_overlay_s2: 2
+EOF
+```
 
-If the overlay uses shell command substitution in a Shrinkwrap command, escape the dollar sign as `$$`. For example, use `$$(stat -c '%Y' ${param:sourcedir})` instead of `$(stat -c '%Y' ${param:sourcedir})`.
+The `$$` in `$$(stat -c '%Y' ${param:sourcedir})` passes command substitution through Shrinkwrap so that the generated build script evaluates it.
 
 {{% notice Warning %}}
-Testing on Ubuntu 24.04 showed that `--overlay cca-lp.yaml --overlay planes.yaml` fails while applying `config/lkvm.patch` to `net/uip/tcp.c` in the planes-enabled `kvmtool` branch. Shrinkwrap appends list values from later overlays, so adding another `kvmtool.prebuild` list in `planes.yaml` does not remove the inherited patch command. Use a planes-specific Learning Path overlay that excludes the `kvmtool.yaml` layer, or update the CCA development platform so the patch is skipped for the planes branch.
+Testing on Ubuntu 24.04 showed that `--overlay cca-lp.yaml --overlay planes.yaml` fails while applying `config/lkvm.patch` to `net/uip/tcp.c` in the planes-enabled `kvmtool` branch. Shrinkwrap appends
+list values from later overlays, so adding another `kvmtool.prebuild` list in `planes.yaml` does not remove the inherited patch command. Use a planes-specific Learning Path overlay that excludes the
+`kvmtool.yaml` layer, or update the CCA development platform so the patch is skipped for the planes branch.
 {{% /notice %}}
 
 Validate the merged Shrinkwrap configuration before starting the full build:
@@ -100,15 +253,19 @@ shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.y
 
 ## Build the plane 0 Linux kernel
 
-Clone the public OpenHCL Linux source and check out the branch used by the planes demo:
+Clone the OpenHCL Linux source and check out the branch used by the planes demo:
 
 ```console
 cd $HOME/cca-planes-workbook
-git clone <OpenHCL-Linux-public-repository> openhcl-linux
+git clone --branch planes \
+    http://atg-devlab-chimera.cambridge.arm.com:8080/fenimore-prototyping/openhcl-linux.git \
+    openhcl-linux
 cd openhcl-linux
-git checkout <planes-demo-branch>
 ```
 
+The OpenHCL prototype notes recommend Arm GNU Toolchain 13.3.Rel1 for consistent results. The package installation step above installs Ubuntu's `aarch64-linux-gnu` GCC 13.3 cross compiler, which is
+the compiler used by the commands below.
+
 Configure the kernel for a Realm guest, 9P file sharing, and OpenHCL support:
 
 ```console
@@ -127,13 +284,14 @@ make Image -j$(nproc)
 
 ## Build the test microkernel and VMM
 
-Clone the public OpenVMM/OpenHCL source and check out the branch used by the planes demo:
+Clone the OpenVMM/OpenHCL source and check out the branch used by the planes demo:
 
 ```console
 cd $HOME/cca-planes-workbook
-git clone <OpenVMM-public-repository> openvmm
+git clone --branch cca-support \
+    http://atg-devlab-chimera.cambridge.arm.com:8080/fenimore-prototyping/openhcl.git \
+    openvmm
 cd openvmm
-git checkout <planes-demo-branch>
 ```
 
 Install the Rust targets used by the test microkernel and the VMM:
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index ecf3d7a11c..9152730987 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -12,19 +12,59 @@ layout: "learningpathall"
 
 This Learning Path is a draft. Complete the following tasks before publication:
 
-- Publish a planes-enabled `CCA-dev-platform` workflow or replace the source-build steps with a public prebuilt Docker image.
-- Publish `cca-planes-lp.yaml` or update the CCA development platform so the `config/lkvm.patch` prebuild step from `kvmtool.yaml` is skipped for the planes-enabled `kvmtool` branch.
-- Publish the `planes.yaml` Shrinkwrap overlay used by the demo.
+- Publish `https://github.com/EllieRoe/CCA-dev-platform.git` with unauthenticated HTTPS clone access, or replace the source-build steps with a public prebuilt Docker image.
+- Upstream `cca-planes-lp.yaml` and `planes.yaml` into the `planes` branch, or keep the Learning Path steps that generate those files locally.
 - Run `shrinkwrap build ... --dry-run` with the published overlay and fix any Shrinkwrap macro escaping issues.
 - Run a real Shrinkwrap build through the `kvmtool` phase and confirm that `config/lkvm.patch` is not applied to the planes-enabled branch.
-- Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel.
-- Publish or identify the public OpenVMM/OpenHCL branch used for `simple_tmk` and `tmk_vmm`.
+- Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel. The current prototype uses the internal `openhcl-linux` `planes` branch.
+- Publish or identify the public OpenVMM/OpenHCL branch used for `simple_tmk` and `tmk_vmm`. The current prototype uses the internal `openhcl` `cca-support` branch.
 - Confirm that the OpenVMM/OpenHCL branch is reachable from a clean host. The public upstream OpenVMM repository does not currently expose an obvious CCA planes branch for this draft.
-- Replace placeholder repository URLs and branch names with public URLs.
+- Replace internal prototype repository URLs and branch names with public URLs.
 - Capture and add the exact successful `tmk_vmm` output.
 - Test the full flow on a clean Ubuntu 24.04 LTS host.
 - Remove `draft: true` from `_index.md` after the content is runnable from public inputs.
 
+## Tested state
+
+Testing on 29 June 2026 used Ubuntu 24.04.4 LTS and the `planes` branch of `CCA-dev-platform`.
+
+The HTTPS clone command prompted for GitHub credentials:
+
+```console
+git clone --branch planes https://github.com/EllieRoe/CCA-dev-platform.git CCA-dev-platform
+```
+
+SSH access to the same repository reached commit `a7c5ec548bbf148ace0bea889cba92ef33c33f76` on the `planes` branch.
+
+The required planes overlays were absent at that commit, so the Learning Path now creates them locally from the prototype configuration:
+
+```console
+test -f config/cca-planes-lp.yaml
+test -f config/planes.yaml
+```
+
+After creating those overlays, the documented Shrinkwrap dry run generated a build script:
+
+```console
+shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.yaml \
+    --btvar GUEST_ROOTFS='${artifact:BUILDROOT}' --dry-run
+```
+
+The generated script selected `linux-cca` branch `cca/planes/rfc-v1`, `kvmtool-cca` branch `cca/planes/rfc-v1`, TF-RMM commit `9a98e8fcb1645b9917b2abd79212e6e3062e09fd`, and TF-A
+parameter `GIC_ENABLE_V4_EXTN=1`. The generated script did not contain `config/lkvm.patch`.
+
+The full Shrinkwrap build completed successfully with the generated overlays:
+
+```console
+shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.yaml \
+    --btvar GUEST_ROOTFS='${artifact:BUILDROOT}'
+```
+
+The build completed the `buildroot` and `guest-disk` artifact stages.
+
+The internal OpenHCL Linux source resolved branch `planes` to commit `b407f1ab33b2092f054cf3d5087ee6933a80d5f4`. The internal OpenVMM/OpenHCL source resolved branch `cca-support` to
+commit `e09ae82bb0b9ea55ec52c490e000539088dad8ab`.
+
 ## Optional Docker flow
 
 If the final demo is packaged as a Docker image, replace the build page with a shorter setup flow:

From 9c7ef4e642a77651e177cf96883be926f5c21222 Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 16:20:28 +0200
Subject: [PATCH 4/9] Use CCA-dev-platform planes overlays

Update the CCA planes OpenHCL Learning Path now that CCA-dev-platform provides config/cca-planes-lp.yaml and config/planes.yaml on the planes branch.

The build page now verifies the overlay files in the checkout instead of asking learners to create large YAML files inline. It keeps the warning about using cca-planes-lp.yaml because the base cca-lp.yaml still inherits the kvmtool patch layer that breaks the planes kvmtool branch.

The publication readiness page now points at CCA-dev-platform commit 401dfd13882e994df38fa741266b14ccda2d407c as the commit that adds the overlays, while keeping the public clone and internal OpenHCL source blockers explicit.

Validation: confirmed the overlay files exist in /Users/tompil01/src/CCA-dev-platform, git diff --check passed, code fences are balanced, and the repo maintenance script remains blocked by the local missing PyYAML dependency.
---
 .../cca-planes-openhcl/build-stack.md         | 175 ++----------------
 .../publication-readiness.md                  |   8 +-
 2 files changed, 17 insertions(+), 166 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
index afcef8708d..a7ae809ac1 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
@@ -59,175 +59,26 @@ source setup.source_me
 This command creates a Python virtual environment, installs the Python packages needed by Shrinkwrap, and sets the `SHRINKWRAP_*` environment variables. The package installation step needs network
 access to Python package indexes unless the host already has a populated virtual environment.
 
-## Create the planes Shrinkwrap overlays
+## Verify the planes Shrinkwrap overlays
 
-The CCA development platform README describes the base Learning Path build with `cca-lp.yaml`. The OpenHCL prototype also needs a planes overlay. Create a Learning Path overlay that keeps the base
-filesystem and tooling changes from `cca-lp.yaml`, while omitting the `kvmtool.yaml` layer that applies `config/lkvm.patch`:
+The `planes` branch provides the two overlays used by this Learning Path:
 
-```console
-cat > config/cca-planes-lp.yaml <<'EOF'
-# Copyright (c) 2026, Arm Limited.
-# SPDX-License-Identifier: MIT
-
-%YAML 1.2
----
-description: >-
-  Generates all blobs for the CCA planes Learning Path while avoiding the
-  kvmtool patch layer used by the base CCA Learning Path overlay.
-
-concrete: true
-
-layers:
-  - buildroot-cca.yaml
-  - bootsync.yaml
-  - cca-kata.yaml
-  - edk2.yaml
-
-build:
-
-  linux:
-    prebuild:
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_VIRT_DRIVERS
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_ARM_FFA_TRANSPORT
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_ARM_CCA_GUEST
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TSM_REPORTS
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TRACEPOINTS
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TRACING
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_FTRACE
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_FUNCTION_TRACER
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_FUNCTION_GRAPH_TRACER
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DYNAMIC_FTRACE
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_TRACE_EVENTS
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLOCK
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLK_DEV_IO_TRACE
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_EVENT_TRACING
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLOCK_HOLDER_TRACKING
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_BLK_DEV_BOUNCE
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_PERF_EVENTS
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_PERF_USE_VMALLOC
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_PRINTK
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DEBUG_KERNEL
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DEBUG_FS
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_DEBUG_INFO
-
-  buildroot:
-    repo:
-      revision: 2026.02
-
-    prebuild:
-      - ./utils/config --file ${param:builddir}/.config --set-str BR2_ROOTFS_POST_BUILD_SCRIPT ${param:configdir}/../realm-post-build-lp.sh
-      - ./utils/config --file ${param:builddir}/.config --set-str TARGET_GENERIC_HOSTNAME "realm"
-      - ./utils/config --file ${param:builddir}/.config --set-str TARGET_GENERIC_ISSUE "Welcome to the CCA realm"
-      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_OPTEE_EXAMPLES
-      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_OPTEE_TEST
-      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_OPTEE_CLIENT
-      - ./utils/config --file ${param:builddir}/.config --disable BR2_PACKAGE_TRACE_CMD
-      - ./utils/config --file ${param:builddir}/.config --enable BR2_PACKAGE_LIBOPENSSL_BIN
-      - ./utils/config --file ${param:builddir}/.config --enable BR2_PACKAGE_LIBOPENSSL_ENGINES
-
-  rmm:
-    params:
-      -DRMM_V1_1: 1
-      -DRMM_MEM_SCRUB_METHOD: 2
-
-  tfa:
-    params:
-      ENABLE_FEAT_MEC: 1
-
-run:
-
-  terminals:
-    bp.terminal_0:
-      type: telnet
-
-    bp.terminal_1:
-      type: telnet
-
-    bp.terminal_2:
-      type: telnet
-
-    bp.terminal_3:
-      type: telnet
-EOF
-```
+- `config/cca-planes-lp.yaml` keeps the base CCA Learning Path filesystem and
+  tooling changes, while excluding the `kvmtool.yaml` layer that applies
+  `config/lkvm.patch`.
+- `config/planes.yaml` selects the prototype RMM, host Linux, and `kvmtool`
+  branches, and enables Permission Indirection and Permission Overlay in the FVP
+  parameters.
 
-Create the planes feature overlay. This overlay selects the prototype RMM, host Linux, and `kvmtool` branches, and enables Permission Indirection and Permission Overlay in the FVP parameters:
+Check that both overlays are present:
 
 ```console
-cat > config/planes.yaml <<'EOF'
-# Copyright (c) 2026, Arm Limited.
-# SPDX-License-Identifier: MIT
-
-%YAML 1.2
----
-description: >-
-  Overlay for the CCA planes OpenHCL prototype.
-
-buildex:
-  btvars:
-    RMM_LOG_LEVEL:
-      type: string
-      value: '10'
-
-    RMM_CONFIG:
-      type: string
-      value: 'fvp_defcfg'
-
-    TFA_REVISION:
-      type: string
-      value: master
-
-build:
-
-  rmm:
-    repo:
-      remote: https://github.com/TF-RMM/tf-rmm.git
-      revision: 9a98e8fcb1645b9917b2abd79212e6e3062e09fd
-
-    params:
-      -DLOG_LEVEL: ${btvar:RMM_LOG_LEVEL}
-      -DRMM_CONFIG: ${btvar:RMM_CONFIG}
-      -DRMM_V1_1: 1
-      -DPLAT_CMN_CTX_MAX_XLAT_TABLES: 13
-
-  tfa:
-    repo:
-      revision: ${btvar:TFA_REVISION}
-
-    params:
-      GIC_ENABLE_V4_EXTN: 1
-
-  linux:
-    repo:
-      remote: https://gitlab.arm.com/linux-arm/linux-cca.git
-      revision: cca/planes/rfc-v1
-
-    prebuild:
-      - export KBUILD_BUILD_TIMESTAMP="@$$(stat -c '%Y' ${param:sourcedir})"
-      - ./scripts/config --file ${param:builddir}/.config --enable CONFIG_VIRT_DRIVERS
-      - ./scripts/config --file ${param:builddir}/.config --disable CONFIG_HZ_250 --enable CONFIG_HZ_100
-      - ./scripts/config --file ${param:builddir}/.config --disable CONFIG_RANDOMIZE_BASE
-
-  kvmtool:
-    repo:
-      kvmtool:
-        remote: https://gitlab.arm.com/linux-arm/kvmtool-cca.git
-        revision: cca/planes/rfc-v1
-
-run:
-  params:
-    -C cluster0.has_permission_indirection_s1: 2
-    -C cluster1.has_permission_indirection_s1: 2
-    -C cluster0.has_permission_indirection_s2: 2
-    -C cluster1.has_permission_indirection_s2: 2
-    -C cluster0.has_permission_overlay_s1: 2
-    -C cluster1.has_permission_overlay_s1: 2
-    -C cluster0.has_permission_overlay_s2: 2
-    -C cluster1.has_permission_overlay_s2: 2
-EOF
+test -f config/cca-planes-lp.yaml
+test -f config/planes.yaml
 ```
 
-The `$$` in `$$(stat -c '%Y' ${param:sourcedir})` passes command substitution through Shrinkwrap so that the generated build script evaluates it.
+If either command fails, update the CCA development platform checkout to a
+`planes` branch commit that includes both overlay files.
 
 {{% notice Warning %}}
 Testing on Ubuntu 24.04 showed that `--overlay cca-lp.yaml --overlay planes.yaml` fails while applying `config/lkvm.patch` to `net/uip/tcp.c` in the planes-enabled `kvmtool` branch. Shrinkwrap appends
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index 9152730987..c5e39f71a5 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -13,7 +13,7 @@ layout: "learningpathall"
 This Learning Path is a draft. Complete the following tasks before publication:
 
 - Publish `https://github.com/EllieRoe/CCA-dev-platform.git` with unauthenticated HTTPS clone access, or replace the source-build steps with a public prebuilt Docker image.
-- Upstream `cca-planes-lp.yaml` and `planes.yaml` into the `planes` branch, or keep the Learning Path steps that generate those files locally.
+- Push CCA-dev-platform commit `401dfd13882e994df38fa741266b14ccda2d407c` or an equivalent commit that provides `config/cca-planes-lp.yaml` and `config/planes.yaml` on the `planes` branch.
 - Run `shrinkwrap build ... --dry-run` with the published overlay and fix any Shrinkwrap macro escaping issues.
 - Run a real Shrinkwrap build through the `kvmtool` phase and confirm that `config/lkvm.patch` is not applied to the planes-enabled branch.
 - Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel. The current prototype uses the internal `openhcl-linux` `planes` branch.
@@ -34,16 +34,16 @@ The HTTPS clone command prompted for GitHub credentials:
 git clone --branch planes https://github.com/EllieRoe/CCA-dev-platform.git CCA-dev-platform
 ```
 
-SSH access to the same repository reached commit `a7c5ec548bbf148ace0bea889cba92ef33c33f76` on the `planes` branch.
+SSH access to the same repository initially reached commit `a7c5ec548bbf148ace0bea889cba92ef33c33f76` on the `planes` branch.
 
-The required planes overlays were absent at that commit, so the Learning Path now creates them locally from the prototype configuration:
+The required planes overlays were absent at that commit. CCA-dev-platform commit `401dfd13882e994df38fa741266b14ccda2d407c` adds the overlays:
 
 ```console
 test -f config/cca-planes-lp.yaml
 test -f config/planes.yaml
 ```
 
-After creating those overlays, the documented Shrinkwrap dry run generated a build script:
+With those overlays available, the documented Shrinkwrap dry run generated a build script:
 
 ```console
 shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.yaml \

From fc2862027f88cf414be4c5f985d89d906a88b9be Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 16:36:14 +0200
Subject: [PATCH 5/9] Validate OpenHCL build and rootfs steps

Test the CCA planes OpenHCL kernel, OpenVMM, and root filesystem update steps on tp-desktop against the existing Shrinkwrap package output.

The plane 0 OpenHCL Linux branch built successfully with the documented AArch64 GCC flow and produced arch/arm64/boot/Image. The OpenVMM branch required Rust 1.85.0, rust-src, and the two AArch64 targets; current stable Rust 1.96.0 failed on the JSON target spec.

Replace the sudo mount copy flow with debugfs writes using the Buildroot host e2fsprogs. This matches the tested host, where passwordless sudo was unavailable, and the modified rootfs.ext2 passed e2fsck after copying guest-disk.img, KVMTOOL_EFI.fd, Image, lkvm, Image_ohcl, simple_tmk, and tmk_vmm into /cca.

Validation: git diff --check passed, code fences are balanced, and tools/maintenance.py remains blocked by the local missing PyYAML dependency.
---
 .../cca-planes-openhcl/build-stack.md         | 50 +++++++++++++------
 .../publication-readiness.md                  | 10 +++-
 2 files changed, 43 insertions(+), 17 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
index a7ae809ac1..a123ba00b5 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/build-stack.md
@@ -17,7 +17,7 @@ sudo apt update
 sudo apt upgrade
 sudo apt install build-essential cmake ninja-build python3-venv ccache git \
     parted e2fsprogs docker.io netcat-openbsd telnet net-tools docker-buildx \
-    flex libssl-dev gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+    curl flex libssl-dev gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 ```
 
 These commands require `sudo` access. If you are using a shared host where you do not have passwordless `sudo`, ask the administrator to install the packages or use a host where they are already
@@ -145,11 +145,22 @@ git clone --branch cca-support \
 cd openvmm
 ```
 
-Install the Rust targets used by the test microkernel and the VMM:
+Install Rust 1.85.0 with `rustup`. The OpenVMM prototype branch is validated
+with this Rust toolchain:
 
 ```console
-rustup target add aarch64-unknown-linux-gnu
-rustup target add aarch64-unknown-none
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+    sh -s -- --default-toolchain=1.85.0 -y
+source "$HOME/.cargo/env"
+```
+
+Install the Rust source component and the targets used by the test microkernel
+and the VMM:
+
+```console
+rustup component add rust-src --toolchain 1.85.0
+rustup target add aarch64-unknown-linux-gnu --toolchain 1.85.0
+rustup target add aarch64-unknown-none --toolchain 1.85.0
 ```
 
 Build the binaries:
@@ -157,8 +168,10 @@ Build the binaries:
 ```console
 unset ARCH
 unset CROSS_COMPILE
-RUSTC_BOOTSTRAP=1 cargo build -p simple_tmk --config openhcl/minimal_rt/aarch64-config.toml
-RUSTC_BOOTSTRAP=1 cargo build -p tmk_vmm --target aarch64-unknown-linux-gnu
+RUSTC_BOOTSTRAP=1 cargo +1.85.0 build -p simple_tmk \
+    --config openhcl/minimal_rt/aarch64-config.toml
+RUSTC_BOOTSTRAP=1 cargo +1.85.0 build -p tmk_vmm \
+    --target aarch64-unknown-linux-gnu
 ```
 
 ## Add the plane 0 kernel and test binaries to the root filesystem
@@ -178,22 +191,29 @@ $TOOLS_PATH/e2fsck -fp rootfs.ext2
 $TOOLS_PATH/resize2fs rootfs.ext2 1G
 ```
 
-Mount the root filesystem:
+Create `/cca` in the root filesystem image:
 
 ```console
-sudo mkdir -p mnt
-sudo mount rootfs.ext2 mnt
-sudo mkdir -p mnt/cca
+$TOOLS_PATH/debugfs -w -R "mkdir /cca" rootfs.ext2
 ```
 
 Copy the files needed by plane 0:
 
 ```console
-sudo cp guest-disk.img KVMTOOL_EFI.fd Image lkvm mnt/cca/
-sudo cp "$PLANE0_IMAGE" mnt/cca/Image_ohcl
-sudo cp "$SIMPLE_TMK" mnt/cca/
-sudo cp "$TMK_VMM" mnt/cca/
-sudo umount mnt
+$TOOLS_PATH/debugfs -w -R "write guest-disk.img /cca/guest-disk.img" rootfs.ext2
+$TOOLS_PATH/debugfs -w -R "write KVMTOOL_EFI.fd /cca/KVMTOOL_EFI.fd" rootfs.ext2
+$TOOLS_PATH/debugfs -w -R "write Image /cca/Image" rootfs.ext2
+$TOOLS_PATH/debugfs -w -R "write lkvm /cca/lkvm" rootfs.ext2
+$TOOLS_PATH/debugfs -w -R "write $PLANE0_IMAGE /cca/Image_ohcl" rootfs.ext2
+$TOOLS_PATH/debugfs -w -R "write $SIMPLE_TMK /cca/simple_tmk" rootfs.ext2
+$TOOLS_PATH/debugfs -w -R "write $TMK_VMM /cca/tmk_vmm" rootfs.ext2
+```
+
+Check that the files were copied and that the root filesystem is consistent:
+
+```console
+$TOOLS_PATH/debugfs -R "ls -l /cca" rootfs.ext2
+$TOOLS_PATH/e2fsck -fn rootfs.ext2
 ```
 
 ## What you've accomplished
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index c5e39f71a5..0456699b5a 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -62,8 +62,14 @@ shrinkwrap build cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.y
 
 The build completed the `buildroot` and `guest-disk` artifact stages.
 
-The internal OpenHCL Linux source resolved branch `planes` to commit `b407f1ab33b2092f054cf3d5087ee6933a80d5f4`. The internal OpenVMM/OpenHCL source resolved branch `cca-support` to
-commit `e09ae82bb0b9ea55ec52c490e000539088dad8ab`.
+The internal OpenHCL Linux source resolved branch `planes` to commit `b407f1ab33b2092f054cf3d5087ee6933a80d5f4`. The plane 0 kernel build completed and produced
+`arch/arm64/boot/Image`.
+
+The internal OpenVMM/OpenHCL source resolved branch `cca-support` to commit `e09ae82bb0b9ea55ec52c490e000539088dad8ab`. The `simple_tmk` and `tmk_vmm` builds completed with Rust 1.85.0,
+`rust-src`, `aarch64-unknown-linux-gnu`, and `aarch64-unknown-none`.
+
+The root filesystem resize completed from 256 MiB to 1 GiB. The copy step completed with `debugfs`, and `e2fsck -fn rootfs.ext2` passed after copying the plane 0 files into `/cca`. The `tp-desktop`
+test host did not have passwordless `sudo`, so the Learning Path uses `debugfs` instead of mounting the root filesystem image.
 
 ## Optional Docker flow
 

From ccfd7d63ddc4cdedbce7849f7068b621b3063180 Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 16:50:27 +0200
Subject: [PATCH 6/9] Document tested FVP boot flow

Update the planes OpenHCL run page so shrinkwrap run uses the same cca-planes-lp.yaml and planes.yaml overlays as the build. This is required for the MEC FVP parameters and planes model parameters used by the tested stack.

Record the FVP boot validation on tp-desktop. The host did not have FVP_Base_RevC-2xAEMvA in PATH, so the test used FVP_Base_RevC_AEMvA_11.31_28 from the existing CCA simulation Docker image. The initial boot stopped in BL31 with 'feat_mec not supported by the PE'; CCA-dev-platform commit 70c5e946294e81da8fbe4d9a4bc079526e31925e adds the matching MEC FVP run parameters.

After regenerating the run script with both overlays, the FVP boot reached the Linux login prompt using the resized rootfs.ext2 containing the plane 0 files.

Validation: git diff --check passed, staged diff check passed, code fences are balanced, and tools/maintenance.py remains blocked by the local missing PyYAML dependency.
---
 .../cca-planes-openhcl/publication-readiness.md       | 11 +++++++++--
 .../cca-planes-openhcl/run-plane0.md                  |  6 ++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index 0456699b5a..1fb1d26986 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -13,7 +13,8 @@ layout: "learningpathall"
 This Learning Path is a draft. Complete the following tasks before publication:
 
 - Publish `https://github.com/EllieRoe/CCA-dev-platform.git` with unauthenticated HTTPS clone access, or replace the source-build steps with a public prebuilt Docker image.
-- Push CCA-dev-platform commit `401dfd13882e994df38fa741266b14ccda2d407c` or an equivalent commit that provides `config/cca-planes-lp.yaml` and `config/planes.yaml` on the `planes` branch.
+- Push CCA-dev-platform commit `70c5e946294e81da8fbe4d9a4bc079526e31925e` or an equivalent commit that provides `config/cca-planes-lp.yaml` and `config/planes.yaml` on the `planes` branch, including the MEC FVP run
+  parameters required by `ENABLE_FEAT_MEC=1`.
 - Run `shrinkwrap build ... --dry-run` with the published overlay and fix any Shrinkwrap macro escaping issues.
 - Run a real Shrinkwrap build through the `kvmtool` phase and confirm that `config/lkvm.patch` is not applied to the planes-enabled branch.
 - Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel. The current prototype uses the internal `openhcl-linux` `planes` branch.
@@ -36,7 +37,9 @@ git clone --branch planes https://github.com/EllieRoe/CCA-dev-platform.git CCA-d
 
 SSH access to the same repository initially reached commit `a7c5ec548bbf148ace0bea889cba92ef33c33f76` on the `planes` branch.
 
-The required planes overlays were absent at that commit. CCA-dev-platform commit `401dfd13882e994df38fa741266b14ccda2d407c` adds the overlays:
+The required planes overlays were absent at that commit. CCA-dev-platform commit `401dfd13882e994df38fa741266b14ccda2d407c` adds the overlays, and commit
+`70c5e946294e81da8fbe4d9a4bc079526e31925e` adds the MEC FVP run
+parameters required to boot the TF-A build:
 
 ```console
 test -f config/cca-planes-lp.yaml
@@ -71,6 +74,10 @@ The internal OpenVMM/OpenHCL source resolved branch `cca-support` to commit `e09
 The root filesystem resize completed from 256 MiB to 1 GiB. The copy step completed with `debugfs`, and `e2fsck -fn rootfs.ext2` passed after copying the plane 0 files into `/cca`. The `tp-desktop`
 test host did not have passwordless `sudo`, so the Learning Path uses `debugfs` instead of mounting the root filesystem image.
 
+The FVP boot test used FVP `FVP_Base_RevC_AEMvA_11.31_28` from the existing `armlimited/cca-learning-path:cca-simulation-kitten-1-x86_64` Docker image because the model was not installed in the
+`tp-desktop` host `PATH`. The first boot attempt failed in BL31 with `feat_mec not supported by the PE`. After adding the MEC FVP run parameters to `cca-planes-lp.yaml` and running
+`shrinkwrap run` with both overlays, the FVP reached the Linux login prompt.
+
 ## Optional Docker flow
 
 If the final demo is packaged as a Docker image, replace the build page with a shorter setup flow:
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
index de91fbebf0..b8ace5bd8f 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
@@ -10,10 +10,13 @@ layout: "learningpathall"
 
 ## Run the FVP
 
+Make sure that `FVP_Base_RevC-2xAEMvA` is available in your `PATH`.
+
 Start the CCA stack on the FVP:
 
 ```console
-shrinkwrap run cca-3world.yaml --rtvar ROOTFS=$(realpath "$SHRINKWRAP_PACKAGE/cca-3world/rootfs.ext2")
+shrinkwrap run cca-3world.yaml --overlay cca-planes-lp.yaml --overlay planes.yaml \
+    --rtvar ROOTFS=$(realpath "$SHRINKWRAP_PACKAGE/cca-3world/rootfs.ext2")
 ```
 
 Log in to the CCA host as `root`. No password is required.
@@ -70,4 +73,3 @@ The output should show both files:
 ## What you've accomplished
 
 You have booted plane 0 Linux inside a CCA Realm and prepared the shared filesystem and huge page needed by the auxiliary plane test.
-

From b8cca394bcc354461080489cb364c4aa01ac2525 Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 17:42:07 +0200
Subject: [PATCH 7/9] Fix CCA planes Realm start command

Testing on tp-desktop showed that the OpenHCL Realm launch must pass /cca/guest-disk.img to kvmtool. Without --disk, plane 0 Linux used the 9P share as root and panicked when /virt/init returned ENOEXEC.

Document the tested RMM_V1_COMPAT overlay fix and the successful Realm boot to the plane 0 login prompt.
---
 .../publication-readiness.md                  | 27 +++++++++++++++----
 .../cca-planes-openhcl/run-plane0.md          |  5 ++--
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index 1fb1d26986..bebc25f62b 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -13,8 +13,11 @@ layout: "learningpathall"
 This Learning Path is a draft. Complete the following tasks before publication:
 
 - Publish `https://github.com/EllieRoe/CCA-dev-platform.git` with unauthenticated HTTPS clone access, or replace the source-build steps with a public prebuilt Docker image.
-- Push CCA-dev-platform commit `70c5e946294e81da8fbe4d9a4bc079526e31925e` or an equivalent commit that provides `config/cca-planes-lp.yaml` and `config/planes.yaml` on the `planes` branch, including the MEC FVP run
-  parameters required by `ENABLE_FEAT_MEC=1`.
+- Push the CCA-dev-platform `planes` branch through commit
+  `edfca45414f8ea0a90f08ff9d9cee99b85c8e3e0`, or an equivalent commit that
+  provides `config/cca-planes-lp.yaml` and `config/planes.yaml`, including the
+  MEC FVP run parameters required by `ENABLE_FEAT_MEC=1` and
+  `RMM_V1_COMPAT=1` for the pinned TF-RMM revision.
 - Run `shrinkwrap build ... --dry-run` with the published overlay and fix any Shrinkwrap macro escaping issues.
 - Run a real Shrinkwrap build through the `kvmtool` phase and confirm that `config/lkvm.patch` is not applied to the planes-enabled branch.
 - Publish or identify the public OpenHCL Linux branch used for the plane 0 kernel. The current prototype uses the internal `openhcl-linux` `planes` branch.
@@ -37,9 +40,12 @@ git clone --branch planes https://github.com/EllieRoe/CCA-dev-platform.git CCA-d
 
 SSH access to the same repository initially reached commit `a7c5ec548bbf148ace0bea889cba92ef33c33f76` on the `planes` branch.
 
-The required planes overlays were absent at that commit. CCA-dev-platform commit `401dfd13882e994df38fa741266b14ccda2d407c` adds the overlays, and commit
-`70c5e946294e81da8fbe4d9a4bc079526e31925e` adds the MEC FVP run
-parameters required to boot the TF-A build:
+The required planes overlays were absent at that commit. CCA-dev-platform commit
+`401dfd13882e994df38fa741266b14ccda2d407c` adds the overlays, commit
+`70c5e946294e81da8fbe4d9a4bc079526e31925e` adds the MEC FVP run parameters
+required to boot the TF-A build, and commit
+`edfca45414f8ea0a90f08ff9d9cee99b85c8e3e0` enables `RMM_V1_COMPAT=1` for the
+pinned TF-RMM revision:
 
 ```console
 test -f config/cca-planes-lp.yaml
@@ -78,6 +84,17 @@ The FVP boot test used FVP `FVP_Base_RevC_AEMvA_11.31_28` from the existing `arm
 `tp-desktop` host `PATH`. The first boot attempt failed in BL31 with `feat_mec not supported by the PE`. After adding the MEC FVP run parameters to `cca-planes-lp.yaml` and running
 `shrinkwrap run` with both overlays, the FVP reached the Linux login prompt.
 
+The first Realm start attempt failed before the Realm launched because BL31
+logged `RMM init failed: -2`, and the host kernel did not report an RMI ABI.
+After enabling `RMM_V1_COMPAT=1`, the host kernel reported
+`RMI ABI version 1.1` and kvmtool started the Realm.
+
+The Realm command was tested with `--disk /cca/guest-disk.img`. Without the
+disk, plane 0 Linux mounted the 9P share as the root filesystem and panicked
+while running `/virt/init`. With the disk argument present, plane 0 Linux
+detected `vda1` and `vda2`, mounted `/dev/vda2` as ext4, ran `/sbin/init`, and
+reached the login prompt.
+
 ## Optional Docker flow
 
 If the final demo is packaged as a Docker image, replace the build page with a shorter setup flow:
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
index b8ace5bd8f..e2981606da 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-plane0.md
@@ -29,12 +29,13 @@ Change to the directory that contains the CCA demo files:
 cd /cca
 ```
 
-Start the Realm with the plane 0 kernel, 9P sharing, and a 32 MB huge page for the auxiliary plane payload:
+Start the Realm with the plane 0 kernel, guest root disk, 9P sharing, and a
+32 MB huge page for the auxiliary plane payload:
 
 ```console
 ./lkvm run --realm --disable-sve --irqchip=gicv3-its \
     -c 1 -m 512 --no-pvtime --force-pci --console virtio \
-    --kernel /cca/Image_ohcl --9p /cca/,cca_mount \
+    --kernel /cca/Image_ohcl --disk /cca/guest-disk.img --9p /cca/,cca_mount \
     -p "console=hvc0 root=/dev/vda2 hugepagesz=32M hugepages=1" \
     --measurement-algo=sha256 --restricted_mem
 ```

From 9e6a2289d70a6198d8d53a347b16314e9b7c3a9b Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 17:48:01 +0200
Subject: [PATCH 8/9] Document plane 0 mount validation

The tp-desktop FVP run logged in to plane 0 as root, mounted cca_mount over 9P at /root/mount, mounted hugetlbfs at /root/huge with 32 MB pages, and confirmed simple_tmk and tmk_vmm were visible through the share.
---
 .../cca-planes-openhcl/publication-readiness.md              | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index bebc25f62b..3822369c28 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -95,6 +95,11 @@ while running `/virt/init`. With the disk argument present, plane 0 Linux
 detected `vda1` and `vda2`, mounted `/dev/vda2` as ext4, ran `/sbin/init`, and
 reached the login prompt.
 
+Plane 0 login as `root` was tested. The documented 9P mount command mounted
+`cca_mount` on `/root/mount`, the hugetlbfs command mounted `none` on
+`/root/huge` with `pagesize=32M`, and `simple_tmk` and `tmk_vmm` were visible
+through the 9P mount.
+
 ## Optional Docker flow
 
 If the final demo is packaged as a Docker image, replace the build page with a shorter setup flow:

From 76da56a749a86fed30f8404f6106cb5b8695f903 Mon Sep 17 00:00:00 2001
From: Tom Pilar <tom.pilar@arm.com>
Date: Mon, 29 Jun 2026 17:56:39 +0200
Subject: [PATCH 9/9] Document auxiliary plane test result

The tp-desktop run executed tmk_vmm with the CCA backend from plane 0, reached the simple_tmk hello-world path, printed tmk_vmm::run: test complete, and returned exit code 0.

Record the remaining WIP branch caveat: an unnamed thread panics after completion because the CCA registers accessor still contains todo!().
---
 .../publication-readiness.md                  | 11 +++++++++-
 .../cca-planes-openhcl/run-auxiliary-plane.md | 22 ++++++++++++++-----
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
index 3822369c28..9658a26959 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/publication-readiness.md
@@ -24,7 +24,8 @@ This Learning Path is a draft. Complete the following tasks before publication:
 - Publish or identify the public OpenVMM/OpenHCL branch used for `simple_tmk` and `tmk_vmm`. The current prototype uses the internal `openhcl` `cca-support` branch.
 - Confirm that the OpenVMM/OpenHCL branch is reachable from a clean host. The public upstream OpenVMM repository does not currently expose an obvious CCA planes branch for this draft.
 - Replace internal prototype repository URLs and branch names with public URLs.
-- Capture and add the exact successful `tmk_vmm` output.
+- Replace the captured internal `tmk_vmm` output with the final public demo
+  output, or remove the post-test CCA register-read panic from the prototype.
 - Test the full flow on a clean Ubuntu 24.04 LTS host.
 - Remove `draft: true` from `_index.md` after the content is runnable from public inputs.
 
@@ -100,6 +101,14 @@ Plane 0 login as `root` was tested. The documented 9P mount command mounted
 `/root/huge` with `pagesize=32M`, and `simple_tmk` and `tmk_vmm` were visible
 through the 9P mount.
 
+The `tmk_vmm` command was tested from `/root/mount` with the CCA backend and
+`simple_tmk`. The log showed the plane 1 memory permission setup, multiple
+`rsi_plane_enter` calls, `tmk: hello world`, and `tmk_vmm::run: test complete`.
+The shell reported exit code 0. The internal `cca-support` branch also emitted
+a post-test Rust panic from `openhcl/virt_mshv_vtl/src/processor/cca/mod.rs`
+line 386, where the CCA `registers()` accessor is still implemented as
+`todo!()`.
+
 ## Optional Docker flow
 
 If the final demo is packaged as a Docker image, replace the build page with a shorter setup flow:
diff --git a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md
index 9ceed665f5..0cb02f2084 100644
--- a/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md
+++ b/content/learning-paths/servers-and-cloud-computing/cca-planes-openhcl/run-auxiliary-plane.md
@@ -20,19 +20,32 @@ export RUST_BACKTRACE=1
 
 The VMM prepares memory for the auxiliary plane, asks the plane 0 kernel to set the required permissions, and enters the test microkernel.
 
-{{% notice Note %}}
-The exact success output must be captured from the final public demo build. Replace this draft note with the final expected output before publication.
-{{% /notice %}}
+The output is similar to:
+
+```output
+mshv_rsi_set_mem_perm: plane=1, base_addr=0x9a000000, top_addr=0x9c000000
+rsi_plane_enter: plane=1
+INFO tmk: hello world
+rsi_plane_enter: plane=1
+INFO tmk_vmm::run: test complete
+```
 
 ## Validate the result
 
 Confirm these conditions before treating the run as successful:
 
-- `tmk_vmm` starts without a Rust panic.
 - The OpenHCL CCA backend selects the `cca` hypervisor path.
 - The test microkernel reaches its success path.
+- `tmk_vmm` prints `test complete`.
 - Control returns to plane 0 after the auxiliary plane exits.
 
+{{% notice Note %}}
+The internal WIP branch tested for this draft printed `test complete` and
+returned exit code 0, then an unnamed thread emitted a Rust panic from an
+unimplemented CCA register-read path. Replace this note with the final expected
+output before publication.
+{{% /notice %}}
+
 If the command fails before entering the auxiliary plane, check that `/root/huge` is mounted with 32 MB pages and that the `hugepagesz=32M hugepages=1` kernel parameters were passed to plane 0 Linux.
 
 If the command reports that CCA support is unavailable, check that the stack was built with planes-enabled RMM, host kernel, and `kvmtool` components.
@@ -54,4 +67,3 @@ poweroff
 ## What you've accomplished
 
 You have run the test VMM in plane 0 and used it to start a test microkernel in an auxiliary plane.
-