tests/functional/meson.build | 4 + tests/functional/test_aarch64_rme_sbsaref.py | 70 +++++++++++++ tests/functional/test_aarch64_rme_virt.py | 100 +++++++++++++++++++ 3 files changed, 174 insertions(+) create mode 100755 tests/functional/test_aarch64_rme_sbsaref.py create mode 100755 tests/functional/test_aarch64_rme_virt.py
This boot an OP-TEE environment, and launch a nested guest VM inside it
using the Realms feature. We do it for virt and sbsa-ref platforms.
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-----
v2:
- move test to its own file
- add sbsa test
- check output of `cca-workload-attestation report`
v3:
- build and run test with cca-v4 images
- factorize nested guest test between both tests
- remove accel tcg option as it is the default when running tests
Note: It's a long test and there is a work in progress to understand why
debug build is so slow (x12 vs optimized).
v4:
- use pauth-impdef=on to speed up build time execution (x2.5 faster)
- increase timeout value
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
tests/functional/meson.build | 4 +
tests/functional/test_aarch64_rme_sbsaref.py | 70 +++++++++++++
tests/functional/test_aarch64_rme_virt.py | 100 +++++++++++++++++++
3 files changed, 174 insertions(+)
create mode 100755 tests/functional/test_aarch64_rme_sbsaref.py
create mode 100755 tests/functional/test_aarch64_rme_virt.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 5c048cfac6d..60ae7bbd3d6 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -13,6 +13,8 @@ endif
test_timeouts = {
'aarch64_aspeed' : 600,
'aarch64_raspi4' : 480,
+ 'aarch64_rme_virt' : 1200,
+ 'aarch64_rme_sbsaref' : 1200,
'aarch64_sbsaref_alpine' : 720,
'aarch64_sbsaref_freebsd' : 720,
'aarch64_tuxrun' : 240,
@@ -52,6 +54,8 @@ tests_aarch64_system_thorough = [
'aarch64_aspeed',
'aarch64_raspi3',
'aarch64_raspi4',
+ 'aarch64_rme_virt',
+ 'aarch64_rme_sbsaref',
'aarch64_sbsaref',
'aarch64_sbsaref_alpine',
'aarch64_sbsaref_freebsd',
diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
new file mode 100755
index 00000000000..c136b5ce178
--- /dev/null
+++ b/tests/functional/test_aarch64_rme_sbsaref.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots a Realms environment on sbsa-ref machine and a
+# nested guest VM using it.
+#
+# Copyright (c) 2024 Linaro Ltd.
+#
+# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import time
+import os
+import logging
+
+from qemu_test import QemuSystemTest, Asset
+from qemu_test import exec_command, wait_for_console_pattern
+from qemu_test import exec_command_and_wait_for_pattern
+from qemu_test.utils import archive_extract
+from test_aarch64_rme_virt import test_realms_guest
+
+class Aarch64RMESbsaRefMachine(QemuSystemTest):
+
+ # Stack is built with OP-TEE build environment from those instructions:
+ # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
+ # https://github.com/pbo-linaro/qemu-rme-stack
+ ASSET_RME_STACK_SBSA = Asset(
+ ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
+ 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
+ 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
+
+ # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
+ # and launching a nested VM using it.
+ def test_aarch64_rme_sbsaref(self):
+ stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
+ archive_extract(stack_path_tar_gz, self.workdir)
+
+ self.set_machine('sbsa-ref')
+ self.vm.set_console()
+ self.require_accelerator('tcg')
+
+ rme_stack = os.path.join(self.workdir,
+ 'rme-stack-op-tee-4.2.0-cca-v4-sbsa')
+ pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
+ pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
+ virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
+ drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+
+ self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ self.vm.add_args('-m', '2G')
+ self.vm.add_args('-M', 'sbsa-ref')
+ self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
+ self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
+ self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
+ self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
+ self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
+ self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
+ self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
+ self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
+ self.vm.add_args('-netdev', 'user,id=net0')
+
+ self.vm.launch()
+ # Wait for host VM boot to complete.
+ wait_for_console_pattern(self, 'Welcome to Buildroot')
+ exec_command_and_wait_for_pattern(self, 'root', '#')
+
+ test_realms_guest(self)
+
+if __name__ == '__main__':
+ QemuSystemTest.main()
diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
new file mode 100755
index 00000000000..39e4e4adb5f
--- /dev/null
+++ b/tests/functional/test_aarch64_rme_virt.py
@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots a Realms environment on virt machine and a nested
+# guest VM using it.
+#
+# Copyright (c) 2024 Linaro Ltd.
+#
+# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import time
+import os
+import logging
+
+from qemu_test import QemuSystemTest, Asset
+from qemu_test import exec_command, wait_for_console_pattern
+from qemu_test import exec_command_and_wait_for_pattern
+from qemu_test.utils import archive_extract
+
+def test_realms_guest(test_rme_instance):
+
+ # Boot the (nested) guest VM
+ exec_command(test_rme_instance,
+ 'qemu-system-aarch64 -M virt,gic-version=3 '
+ '-cpu host -enable-kvm -m 512M '
+ '-M confidential-guest-support=rme0 '
+ '-object rme-guest,id=rme0 '
+ '-device virtio-net-pci,netdev=net0,romfile= '
+ '-netdev user,id=net0 '
+ '-kernel /mnt/out/bin/Image '
+ '-initrd /mnt/out-br/images/rootfs.cpio '
+ '-serial stdio')
+ # Detect Realm activation during (nested) guest boot.
+ wait_for_console_pattern(test_rme_instance,
+ 'SMC_RMI_REALM_ACTIVATE')
+ # Wait for (nested) guest boot to complete.
+ wait_for_console_pattern(test_rme_instance,
+ 'Welcome to Buildroot')
+ exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
+ # query (nested) guest cca report
+ exec_command(test_rme_instance, 'cca-workload-attestation report')
+ wait_for_console_pattern(test_rme_instance,
+ '"cca-platform-hash-algo-id": "sha-256"')
+ wait_for_console_pattern(test_rme_instance,
+ '"cca-realm-hash-algo-id": "sha-512"')
+ wait_for_console_pattern(test_rme_instance,
+ '"cca-realm-public-key-hash-algo-id": "sha-256"')
+
+class Aarch64RMEVirtMachine(QemuSystemTest):
+
+ # Stack is built with OP-TEE build environment from those instructions:
+ # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
+ # https://github.com/pbo-linaro/qemu-rme-stack
+ ASSET_RME_STACK_VIRT = Asset(
+ ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
+ 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
+ '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
+
+ # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
+ # and launching a nested VM using it.
+ def test_aarch64_rme_virt(self):
+ stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
+ archive_extract(stack_path_tar_gz, self.workdir)
+
+ self.set_machine('virt')
+ self.vm.set_console()
+ self.require_accelerator('tcg')
+
+ rme_stack = os.path.join(self.workdir,
+ 'rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
+ kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
+ bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
+ drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+
+ self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ self.vm.add_args('-m', '2G')
+ self.vm.add_args('-M', 'virt,acpi=off,'
+ 'virtualization=on,'
+ 'secure=on,'
+ 'gic-version=3')
+ self.vm.add_args('-bios', bios)
+ self.vm.add_args('-kernel', kernel)
+ self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
+ self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
+ self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
+ self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
+ self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
+ self.vm.add_args('-netdev', 'user,id=net0')
+ self.vm.add_args('-append', 'root=/dev/vda')
+
+ self.vm.launch()
+ # Wait for host VM boot to complete.
+ wait_for_console_pattern(self, 'Welcome to Buildroot')
+ exec_command_and_wait_for_pattern(self, 'root', '#')
+
+ test_realms_guest(self)
+
+if __name__ == '__main__':
+ QemuSystemTest.main()
--
2.39.5On Tue, Dec 03, 2024 at 01:36:29PM -0800, Pierrick Bouvier wrote:
> This boot an OP-TEE environment, and launch a nested guest VM inside it
> using the Realms feature. We do it for virt and sbsa-ref platforms.
>
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>
> -----
>
> v2:
> - move test to its own file
> - add sbsa test
> - check output of `cca-workload-attestation report`
>
> v3:
> - build and run test with cca-v4 images
> - factorize nested guest test between both tests
> - remove accel tcg option as it is the default when running tests
> Note: It's a long test and there is a work in progress to understand why
> debug build is so slow (x12 vs optimized).
>
> v4:
> - use pauth-impdef=on to speed up build time execution (x2.5 faster)
> - increase timeout value
>
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> ---
> tests/functional/meson.build | 4 +
> tests/functional/test_aarch64_rme_sbsaref.py | 70 +++++++++++++
> tests/functional/test_aarch64_rme_virt.py | 100 +++++++++++++++++++
> 3 files changed, 174 insertions(+)
> create mode 100755 tests/functional/test_aarch64_rme_sbsaref.py
> create mode 100755 tests/functional/test_aarch64_rme_virt.py
>
> diff --git a/tests/functional/meson.build b/tests/functional/meson.build
> index 5c048cfac6d..60ae7bbd3d6 100644
> --- a/tests/functional/meson.build
> +++ b/tests/functional/meson.build
> @@ -13,6 +13,8 @@ endif
> test_timeouts = {
> 'aarch64_aspeed' : 600,
> 'aarch64_raspi4' : 480,
> + 'aarch64_rme_virt' : 1200,
> + 'aarch64_rme_sbsaref' : 1200,
These 20 minute timeouts seem rather excessive.
On my test machines _virt runs in 45 seconds, and _sbsaref
runs in 2m20. The latter is slow, but not dramatically
different from our other slow tests. It doesn't feel like
it justifies a 20 minute timeout ?
> 'aarch64_sbsaref_alpine' : 720,
> 'aarch64_sbsaref_freebsd' : 720,
> 'aarch64_tuxrun' : 240,
> @@ -52,6 +54,8 @@ tests_aarch64_system_thorough = [
> 'aarch64_aspeed',
> 'aarch64_raspi3',
> 'aarch64_raspi4',
> + 'aarch64_rme_virt',
> + 'aarch64_rme_sbsaref',
> 'aarch64_sbsaref',
> 'aarch64_sbsaref_alpine',
> 'aarch64_sbsaref_freebsd',
> diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
> new file mode 100755
> index 00000000000..c136b5ce178
> --- /dev/null
> +++ b/tests/functional/test_aarch64_rme_sbsaref.py
> @@ -0,0 +1,70 @@
> +#!/usr/bin/env python3
> +#
> +# Functional test that boots a Realms environment on sbsa-ref machine and a
> +# nested guest VM using it.
> +#
> +# Copyright (c) 2024 Linaro Ltd.
> +#
> +# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> +#
> +# SPDX-License-Identifier: GPL-2.0-or-later
> +
> +import time
> +import os
> +import logging
> +
> +from qemu_test import QemuSystemTest, Asset
> +from qemu_test import exec_command, wait_for_console_pattern
> +from qemu_test import exec_command_and_wait_for_pattern
> +from qemu_test.utils import archive_extract
> +from test_aarch64_rme_virt import test_realms_guest
> +
> +class Aarch64RMESbsaRefMachine(QemuSystemTest):
> +
> + # Stack is built with OP-TEE build environment from those instructions:
> + # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
> + # https://github.com/pbo-linaro/qemu-rme-stack
> + ASSET_RME_STACK_SBSA = Asset(
> + ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
> + 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
> + 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
> +
> + # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
> + # and launching a nested VM using it.
> + def test_aarch64_rme_sbsaref(self):
> + stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
> + archive_extract(stack_path_tar_gz, self.workdir)
> +
> + self.set_machine('sbsa-ref')
> + self.vm.set_console()
> + self.require_accelerator('tcg')
> +
> + rme_stack = os.path.join(self.workdir,
> + 'rme-stack-op-tee-4.2.0-cca-v4-sbsa')
> + pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
> + pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
> + virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
> + drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
> +
> + self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
> + self.vm.add_args('-m', '2G')
> + self.vm.add_args('-M', 'sbsa-ref')
> + self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
> + self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
> + self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
> + self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
> + self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
> + self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
> + self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
> + self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
> + self.vm.add_args('-netdev', 'user,id=net0')
> +
> + self.vm.launch()
> + # Wait for host VM boot to complete.
> + wait_for_console_pattern(self, 'Welcome to Buildroot')
> + exec_command_and_wait_for_pattern(self, 'root', '#')
> +
> + test_realms_guest(self)
> +
> +if __name__ == '__main__':
> + QemuSystemTest.main()
> diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
> new file mode 100755
> index 00000000000..39e4e4adb5f
> --- /dev/null
> +++ b/tests/functional/test_aarch64_rme_virt.py
> @@ -0,0 +1,100 @@
> +#!/usr/bin/env python3
> +#
> +# Functional test that boots a Realms environment on virt machine and a nested
> +# guest VM using it.
> +#
> +# Copyright (c) 2024 Linaro Ltd.
> +#
> +# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> +#
> +# SPDX-License-Identifier: GPL-2.0-or-later
> +
> +import time
> +import os
> +import logging
> +
> +from qemu_test import QemuSystemTest, Asset
> +from qemu_test import exec_command, wait_for_console_pattern
> +from qemu_test import exec_command_and_wait_for_pattern
> +from qemu_test.utils import archive_extract
> +
> +def test_realms_guest(test_rme_instance):
> +
> + # Boot the (nested) guest VM
> + exec_command(test_rme_instance,
> + 'qemu-system-aarch64 -M virt,gic-version=3 '
> + '-cpu host -enable-kvm -m 512M '
> + '-M confidential-guest-support=rme0 '
> + '-object rme-guest,id=rme0 '
> + '-device virtio-net-pci,netdev=net0,romfile= '
> + '-netdev user,id=net0 '
> + '-kernel /mnt/out/bin/Image '
> + '-initrd /mnt/out-br/images/rootfs.cpio '
> + '-serial stdio')
> + # Detect Realm activation during (nested) guest boot.
> + wait_for_console_pattern(test_rme_instance,
> + 'SMC_RMI_REALM_ACTIVATE')
> + # Wait for (nested) guest boot to complete.
> + wait_for_console_pattern(test_rme_instance,
> + 'Welcome to Buildroot')
> + exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
> + # query (nested) guest cca report
> + exec_command(test_rme_instance, 'cca-workload-attestation report')
> + wait_for_console_pattern(test_rme_instance,
> + '"cca-platform-hash-algo-id": "sha-256"')
> + wait_for_console_pattern(test_rme_instance,
> + '"cca-realm-hash-algo-id": "sha-512"')
> + wait_for_console_pattern(test_rme_instance,
> + '"cca-realm-public-key-hash-algo-id": "sha-256"')
> +
> +class Aarch64RMEVirtMachine(QemuSystemTest):
> +
> + # Stack is built with OP-TEE build environment from those instructions:
> + # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
> + # https://github.com/pbo-linaro/qemu-rme-stack
> + ASSET_RME_STACK_VIRT = Asset(
> + ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
> + 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
> + '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
> +
> + # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
> + # and launching a nested VM using it.
> + def test_aarch64_rme_virt(self):
> + stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
> + archive_extract(stack_path_tar_gz, self.workdir)
> +
> + self.set_machine('virt')
> + self.vm.set_console()
> + self.require_accelerator('tcg')
> +
> + rme_stack = os.path.join(self.workdir,
> + 'rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
> + kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
> + bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
> + drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
> +
> + self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
> + self.vm.add_args('-m', '2G')
> + self.vm.add_args('-M', 'virt,acpi=off,'
> + 'virtualization=on,'
> + 'secure=on,'
> + 'gic-version=3')
> + self.vm.add_args('-bios', bios)
> + self.vm.add_args('-kernel', kernel)
> + self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
> + self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
> + self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
> + self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
> + self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
> + self.vm.add_args('-netdev', 'user,id=net0')
> + self.vm.add_args('-append', 'root=/dev/vda')
> +
> + self.vm.launch()
> + # Wait for host VM boot to complete.
> + wait_for_console_pattern(self, 'Welcome to Buildroot')
> + exec_command_and_wait_for_pattern(self, 'root', '#')
> +
> + test_realms_guest(self)
> +
> +if __name__ == '__main__':
> + QemuSystemTest.main()
> --
> 2.39.5
>
>
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
On 12/5/24 02:28, Daniel P. Berrangé wrote:
> On Tue, Dec 03, 2024 at 01:36:29PM -0800, Pierrick Bouvier wrote:
>> This boot an OP-TEE environment, and launch a nested guest VM inside it
>> using the Realms feature. We do it for virt and sbsa-ref platforms.
>>
>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>>
>> -----
>>
>> v2:
>> - move test to its own file
>> - add sbsa test
>> - check output of `cca-workload-attestation report`
>>
>> v3:
>> - build and run test with cca-v4 images
>> - factorize nested guest test between both tests
>> - remove accel tcg option as it is the default when running tests
>> Note: It's a long test and there is a work in progress to understand why
>> debug build is so slow (x12 vs optimized).
>>
>> v4:
>> - use pauth-impdef=on to speed up build time execution (x2.5 faster)
>> - increase timeout value
>>
>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>> ---
>> tests/functional/meson.build | 4 +
>> tests/functional/test_aarch64_rme_sbsaref.py | 70 +++++++++++++
>> tests/functional/test_aarch64_rme_virt.py | 100 +++++++++++++++++++
>> 3 files changed, 174 insertions(+)
>> create mode 100755 tests/functional/test_aarch64_rme_sbsaref.py
>> create mode 100755 tests/functional/test_aarch64_rme_virt.py
>>
>> diff --git a/tests/functional/meson.build b/tests/functional/meson.build
>> index 5c048cfac6d..60ae7bbd3d6 100644
>> --- a/tests/functional/meson.build
>> +++ b/tests/functional/meson.build
>> @@ -13,6 +13,8 @@ endif
>> test_timeouts = {
>> 'aarch64_aspeed' : 600,
>> 'aarch64_raspi4' : 480,
>> + 'aarch64_rme_virt' : 1200,
>> + 'aarch64_rme_sbsaref' : 1200,
>
> These 20 minute timeouts seem rather excessive.
>
> On my test machines _virt runs in 45 seconds, and _sbsaref
> runs in 2m20. The latter is slow, but not dramatically
> different from our other slow tests. It doesn't feel like
> it justifies a 20 minute timeout ?
>
You can try again with a debug build, and you'll observe that 20 minutes
is not so conservative (I hit 8 to 10 min on my machine easily, so
taking the double considering the x2/x3 "CI slowness" factor is not so
crazy).
The v2 and v3 versions of the patch contain more details.
>> 'aarch64_sbsaref_alpine' : 720,
>> 'aarch64_sbsaref_freebsd' : 720,
>> 'aarch64_tuxrun' : 240,
>> @@ -52,6 +54,8 @@ tests_aarch64_system_thorough = [
>> 'aarch64_aspeed',
>> 'aarch64_raspi3',
>> 'aarch64_raspi4',
>> + 'aarch64_rme_virt',
>> + 'aarch64_rme_sbsaref',
>> 'aarch64_sbsaref',
>> 'aarch64_sbsaref_alpine',
>> 'aarch64_sbsaref_freebsd',
>> diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
>> new file mode 100755
>> index 00000000000..c136b5ce178
>> --- /dev/null
>> +++ b/tests/functional/test_aarch64_rme_sbsaref.py
>> @@ -0,0 +1,70 @@
>> +#!/usr/bin/env python3
>> +#
>> +# Functional test that boots a Realms environment on sbsa-ref machine and a
>> +# nested guest VM using it.
>> +#
>> +# Copyright (c) 2024 Linaro Ltd.
>> +#
>> +# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>> +#
>> +# SPDX-License-Identifier: GPL-2.0-or-later
>> +
>> +import time
>> +import os
>> +import logging
>> +
>> +from qemu_test import QemuSystemTest, Asset
>> +from qemu_test import exec_command, wait_for_console_pattern
>> +from qemu_test import exec_command_and_wait_for_pattern
>> +from qemu_test.utils import archive_extract
>> +from test_aarch64_rme_virt import test_realms_guest
>> +
>> +class Aarch64RMESbsaRefMachine(QemuSystemTest):
>> +
>> + # Stack is built with OP-TEE build environment from those instructions:
>> + # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
>> + # https://github.com/pbo-linaro/qemu-rme-stack
>> + ASSET_RME_STACK_SBSA = Asset(
>> + ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
>> + 'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
>> + 'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
>> +
>> + # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
>> + # and launching a nested VM using it.
>> + def test_aarch64_rme_sbsaref(self):
>> + stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
>> + archive_extract(stack_path_tar_gz, self.workdir)
>> +
>> + self.set_machine('sbsa-ref')
>> + self.vm.set_console()
>> + self.require_accelerator('tcg')
>> +
>> + rme_stack = os.path.join(self.workdir,
>> + 'rme-stack-op-tee-4.2.0-cca-v4-sbsa')
>> + pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
>> + pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
>> + virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
>> + drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
>> +
>> + self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
>> + self.vm.add_args('-m', '2G')
>> + self.vm.add_args('-M', 'sbsa-ref')
>> + self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
>> + self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
>> + self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
>> + self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
>> + self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
>> + self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
>> + self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
>> + self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
>> + self.vm.add_args('-netdev', 'user,id=net0')
>> +
>> + self.vm.launch()
>> + # Wait for host VM boot to complete.
>> + wait_for_console_pattern(self, 'Welcome to Buildroot')
>> + exec_command_and_wait_for_pattern(self, 'root', '#')
>> +
>> + test_realms_guest(self)
>> +
>> +if __name__ == '__main__':
>> + QemuSystemTest.main()
>> diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
>> new file mode 100755
>> index 00000000000..39e4e4adb5f
>> --- /dev/null
>> +++ b/tests/functional/test_aarch64_rme_virt.py
>> @@ -0,0 +1,100 @@
>> +#!/usr/bin/env python3
>> +#
>> +# Functional test that boots a Realms environment on virt machine and a nested
>> +# guest VM using it.
>> +#
>> +# Copyright (c) 2024 Linaro Ltd.
>> +#
>> +# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>> +#
>> +# SPDX-License-Identifier: GPL-2.0-or-later
>> +
>> +import time
>> +import os
>> +import logging
>> +
>> +from qemu_test import QemuSystemTest, Asset
>> +from qemu_test import exec_command, wait_for_console_pattern
>> +from qemu_test import exec_command_and_wait_for_pattern
>> +from qemu_test.utils import archive_extract
>> +
>> +def test_realms_guest(test_rme_instance):
>> +
>> + # Boot the (nested) guest VM
>> + exec_command(test_rme_instance,
>> + 'qemu-system-aarch64 -M virt,gic-version=3 '
>> + '-cpu host -enable-kvm -m 512M '
>> + '-M confidential-guest-support=rme0 '
>> + '-object rme-guest,id=rme0 '
>> + '-device virtio-net-pci,netdev=net0,romfile= '
>> + '-netdev user,id=net0 '
>> + '-kernel /mnt/out/bin/Image '
>> + '-initrd /mnt/out-br/images/rootfs.cpio '
>> + '-serial stdio')
>> + # Detect Realm activation during (nested) guest boot.
>> + wait_for_console_pattern(test_rme_instance,
>> + 'SMC_RMI_REALM_ACTIVATE')
>> + # Wait for (nested) guest boot to complete.
>> + wait_for_console_pattern(test_rme_instance,
>> + 'Welcome to Buildroot')
>> + exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
>> + # query (nested) guest cca report
>> + exec_command(test_rme_instance, 'cca-workload-attestation report')
>> + wait_for_console_pattern(test_rme_instance,
>> + '"cca-platform-hash-algo-id": "sha-256"')
>> + wait_for_console_pattern(test_rme_instance,
>> + '"cca-realm-hash-algo-id": "sha-512"')
>> + wait_for_console_pattern(test_rme_instance,
>> + '"cca-realm-public-key-hash-algo-id": "sha-256"')
>> +
>> +class Aarch64RMEVirtMachine(QemuSystemTest):
>> +
>> + # Stack is built with OP-TEE build environment from those instructions:
>> + # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
>> + # https://github.com/pbo-linaro/qemu-rme-stack
>> + ASSET_RME_STACK_VIRT = Asset(
>> + ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
>> + 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
>> + '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
>> +
>> + # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
>> + # and launching a nested VM using it.
>> + def test_aarch64_rme_virt(self):
>> + stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
>> + archive_extract(stack_path_tar_gz, self.workdir)
>> +
>> + self.set_machine('virt')
>> + self.vm.set_console()
>> + self.require_accelerator('tcg')
>> +
>> + rme_stack = os.path.join(self.workdir,
>> + 'rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
>> + kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
>> + bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
>> + drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
>> +
>> + self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
>> + self.vm.add_args('-m', '2G')
>> + self.vm.add_args('-M', 'virt,acpi=off,'
>> + 'virtualization=on,'
>> + 'secure=on,'
>> + 'gic-version=3')
>> + self.vm.add_args('-bios', bios)
>> + self.vm.add_args('-kernel', kernel)
>> + self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
>> + self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
>> + self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
>> + self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
>> + self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
>> + self.vm.add_args('-netdev', 'user,id=net0')
>> + self.vm.add_args('-append', 'root=/dev/vda')
>> +
>> + self.vm.launch()
>> + # Wait for host VM boot to complete.
>> + wait_for_console_pattern(self, 'Welcome to Buildroot')
>> + exec_command_and_wait_for_pattern(self, 'root', '#')
>> +
>> + test_realms_guest(self)
>> +
>> +if __name__ == '__main__':
>> + QemuSystemTest.main()
>> --
>> 2.39.5
>>
>>
>
> With regards,
> Daniel
Pierrick Bouvier <pierrick.bouvier@linaro.org> writes: > This boot an OP-TEE environment, and launch a nested guest VM inside it > using the Realms feature. We do it for virt and sbsa-ref platforms. > > Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Queued to testing/next, thanks. -- Alex Bennée Virtualisation Tech Lead @ Linaro
On 12/4/24 01:38, Alex Bennée wrote: > Pierrick Bouvier <pierrick.bouvier@linaro.org> writes: > >> This boot an OP-TEE environment, and launch a nested guest VM inside it >> using the Realms feature. We do it for virt and sbsa-ref platforms. >> >> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> > > Queued to testing/next, thanks. > Thanks Alex. FYI, this test triggers a ubsan issue, that I fixed in [1]. As Peter did good efforts to cleanup ubsan issues we had (none left from what I tried), it would be unfortunate to reintroduce one at the same time we merge the current patch. [1] https://lore.kernel.org/qemu-devel/20241204195111.2921141-1-pierrick.bouvier@linaro.org/T/#u
© 2016 - 2024 Red Hat, Inc.