This small series fills in two pre-existing TODOs in the x86 SEV
selftests. Both are test-only changes; there is no functional change to
the kernel.
Patch 1 adds negative coverage to sev_init2_tests: when the platform
does not support a given SEV VM type (SEV-ES or SEV-SNP), it verifies
that KVM_CREATE_VM rejects that type with -EINVAL. Previously the test
only exercised the VM types that were supported, so a mismatch between
KVM_CAP_VM_TYPES and the actual KVM_CREATE_VM enforcement would have
gone unnoticed.
Patch 2 makes sev_smoke_test capture the launch measurement returned by
KVM_SEV_LAUNCH_MEASURE for SEV and SEV-ES guests and asserts that it is
not all zeros, instead of discarding it. A full attestation-style
validation is not possible from the selftest (userspace does not hold
the transport keys used to derive the measurement), but a non-zero
check catches a PSP/plumbing failure that silently leaves the buffer
untouched. SEV-SNP uses a different launch flow and is skipped.
Testing: built and run on an AMD EPYC 9755 (Turin) host running this
tree, across two boot configurations:
- SEV + SEV-ES enabled, SEV-SNP disabled
- SEV + SEV-SNP enabled (SEV-ES unusable)
Together these exercised both new rejection branches (SEV-ES and
SEV-SNP) and the launch-measurement check for SEV/SEV-ES, plus SEV-SNP
guest creation and launch. Both tests pass in every configuration, and
checkpatch is clean on both patches.
Hemanth Selam (2):
KVM: selftests: SEV: Verify unsupported VM types are rejected at
creation
KVM: selftests: SEV: Sanity check the launch measurement
.../selftests/kvm/x86/sev_init2_tests.c | 23 +++++++++++++--
.../selftests/kvm/x86/sev_smoke_test.c | 29 +++++++++++++++++--
2 files changed, 47 insertions(+), 5 deletions(-)
base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
--
2.43.7
