Re: [RFC 3/5] selftests: KVM: SEV IOCTL test

On 7/10/24 17:05, Pratik R. Sampat wrote:

Introduce tests for sev and sev-es ioctl that exercises the boot path of launch, update and finish on an invalid policy.

Signed-off-by: Pratik R. Sampat pratikrajesh.sampat@amd.com

.../selftests/kvm/x86_64/sev_smoke_test.c | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+)

diff --git a/tools/testing/selftests/kvm/x86_64/sev_smoke_test.c b/tools/testing/selftests/kvm/x86_64/sev_smoke_test.c index 1a50a280173c..500c67b3793b 100644 --- a/tools/testing/selftests/kvm/x86_64/sev_smoke_test.c +++ b/tools/testing/selftests/kvm/x86_64/sev_smoke_test.c @@ -131,12 +131,69 @@ static void test_sync_vmsa(uint32_t type, uint32_t policy) kvm_vm_free(vm); } +static void sev_guest_status_assert(struct kvm_vm *vm, uint32_t type) +{

• struct kvm_sev_guest_status status;
• bool cond;
• int ret;
• ret = __vm_sev_ioctl(vm, KVM_SEV_GUEST_STATUS, &status);
• cond = type == KVM_X86_SEV_VM ? !ret : ret;
• TEST_ASSERT(cond,

•     "KVM_SEV_GUEST_STATUS should fail, invalid VM Type.");
  

+}

+static void test_sev_launch(void *guest_code, uint32_t type, uint64_t policy) +{

• struct kvm_vcpu *vcpu;
• struct kvm_vm *vm;
• struct ucall uc;
• bool cond;
• int ret;

Maybe a block comment here indicating what you're actually doing would be good, because I'm a bit confused.

A policy value of 0 is valid for SEV, so you expect each call to succeed, right? And, actually, for SEV-ES the launch start will succeed, too, but the launch update will fail because LAUNCH_UPDATE_VMSA is not valid for SEV, but then the launch measure should succeed. Is that right? What about the other calls?

Thanks, Tom

• vm = vm_sev_create_with_one_vcpu(type, guest_code, &vcpu);
• ret = sev_vm_launch_start(vm, 0);
• cond = type == KVM_X86_SEV_VM ? !ret : ret;
• TEST_ASSERT(cond,

•     "KVM_SEV_LAUNCH_START should fail, invalid policy.");
  

• ret = sev_vm_launch_update(vm, policy);
• cond = type == KVM_X86_SEV_VM ? !ret : ret;
• TEST_ASSERT(cond,

•     "KVM_SEV_LAUNCH_UPDATE should fail, invalid policy.");
  

• sev_guest_status_assert(vm, type);
• ret = sev_vm_launch_measure(vm, alloca(256));
• cond = type == KVM_X86_SEV_VM ? !ret : ret;
• TEST_ASSERT(cond,

•     "KVM_SEV_LAUNCH_MEASURE should fail, invalid policy.");
  

• sev_guest_status_assert(vm, type);
• ret = sev_vm_launch_finish(vm);
• cond = type == KVM_X86_SEV_VM ? !ret : ret;
• TEST_ASSERT(cond,

•     "KVM_SEV_LAUNCH_FINISH should fail, invalid policy.");
  

• sev_guest_status_assert(vm, type);
• vcpu_run(vcpu);
• get_ucall(vcpu, &uc);
• cond = type == KVM_X86_SEV_VM ?

• vcpu->run->exit_reason == KVM_EXIT_IO :
  

• vcpu->run->exit_reason == KVM_EXIT_FAIL_ENTRY;
  

• TEST_ASSERT(cond,

•     "vcpu_run should fail, invalid policy.");
  

• kvm_vm_free(vm);

+}

static void test_sev(void *guest_code, uint32_t type, uint64_t policy) { struct kvm_vcpu *vcpu; struct kvm_vm *vm; struct ucall uc;

• test_sev_launch(guest_code, type, policy);
• vm = vm_sev_create_with_one_vcpu(type, guest_code, &vcpu);

/* TODO: Validate the measurement is as expected. */