# This tests the FEAT_RME cpu implementation, by booting a VM supporting
it,
# and launching a nested VM using it.
@@ -35,35 +37,41 @@ def test_aarch64_rme_sbsaref(self):
self.vm.set_console()
- stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
- self.archive_extract(stack_path_tar_gz, format="tar")
+ stack_path_tar = self.ASSET_RME_STACK_SBSA.fetch()
+ self.archive_extract(stack_path_tar, format="tar")
- rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-sbsa')
- pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
- pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
- virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
- drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+ rme_stack = self.scratch_file('.')
+ pflash0 = join(rme_stack, 'out', 'SBSA_FLASH0.fd')
+ pflash1 = join(rme_stack, 'out', 'SBSA_FLASH1.fd')
+ rootfs = join(rme_stack, 'out', 'host.ext4')
- self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ efi = join(rme_stack, 'out', 'EFI')
+ os.mkdir(efi)
+ shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
+ with open(join(efi, 'startup.nsh'), 'w') as startup:
+ startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
+ ' /host/out/lkvm run --realm'
+ ' -m 256m'
+ ' --restricted_mem'
+ ' --kernel /host/out/Image'
+ ' --disk /host/out/guest.ext4'
+ ' --params "root=/dev/vda rw init=/init"')
+
+ self.vm.add_args('-cpu', 'max,x-rme=on')
+ self.vm.add_args('-smp', '2')
self.vm.add_args('-m', '2G')
self.vm.add_args('-M', 'sbsa-ref')
self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
- self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
- self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
- self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
- self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
- self.vm.add_args('-fsdev',
f'local,security_model=none,path={rme_stack},id=shr0')
- self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
- self.vm.add_args('-netdev', 'user,id=net0')
-
+ self.vm.add_args('-drive', f'file=fat:rw:{efi},format=raw')
+ self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+ self.vm.add_args('-virtfs',
+ f'local,path={rme_stack}/,mount_tag=host,'
+ 'security_model=mapped,readonly=off')
self.vm.launch()
- # Wait for host VM boot to complete.
- wait_for_console_pattern(self, 'Welcome to Buildroot',
- failure_message='Synchronous Exception at')
- exec_command_and_wait_for_pattern(self, 'root', '#')
-
- test_realms_guest(self)
+ # Wait for host and guest VM boot to complete.
+ wait_for_console_pattern(self, 'root@guest',
+ failure_message='Kernel panic')
if __name__ == '__main__':
QemuSystemTest.main()
diff --git a/tests/functional/test_aarch64_rme_virt.py
b/tests/functional/test_aarch64_rme_virt.py
index 8452d27928f..bb603aaa26c 100755
--- a/tests/functional/test_aarch64_rme_virt.py
+++ b/tests/functional/test_aarch64_rme_virt.py
@@ -9,50 +9,22 @@
#
# SPDX-License-Identifier: GPL-2.0-or-later
-import os
+from os.path import join
from qemu_test import QemuSystemTest, Asset
from qemu_test import exec_command, wait_for_console_pattern
from qemu_test import exec_command_and_wait_for_pattern
-def test_realms_guest(test_rme_instance):
-
- # Boot the (nested) guest VM
- exec_command(test_rme_instance,
- 'qemu-system-aarch64 -M virt,gic-version=3 '
- '-cpu host -enable-kvm -m 512M '
- '-M confidential-guest-support=rme0 '
- '-object rme-guest,id=rme0 '
- '-device virtio-net-pci,netdev=net0,romfile= '
- '-netdev user,id=net0 '
- '-kernel /mnt/out/bin/Image '
- '-initrd /mnt/out-br/images/rootfs.cpio '
- '-serial stdio')
- # Detect Realm activation during (nested) guest boot.
- wait_for_console_pattern(test_rme_instance,
- 'SMC_RMI_REALM_ACTIVATE')
- # Wait for (nested) guest boot to complete.
- wait_for_console_pattern(test_rme_instance,
- 'Welcome to Buildroot')
- exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
- # query (nested) guest cca report
- exec_command(test_rme_instance, 'cca-workload-attestation report')
- wait_for_console_pattern(test_rme_instance,
- '"cca-platform-hash-algo-id": "sha-256"')
- wait_for_console_pattern(test_rme_instance,
- '"cca-realm-hash-algo-id": "sha-512"')
- wait_for_console_pattern(test_rme_instance,
- '"cca-realm-public-key-hash-algo-id": "sha-256"')
-
class Aarch64RMEVirtMachine(QemuSystemTest):
- # Stack is built with OP-TEE build environment from those instructions:
+ # Stack is inspired from:
# https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
- # https://github.com/pbo-linaro/qemu-rme-stack
+ # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_release
+ # ./build.sh && ./archive_artifacts.sh out.tar.xz
ASSET_RME_STACK_VIRT = Asset(
- ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
- 'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
- '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
+ ('https://github.com/pbo-linaro/qemu-linux-stack/'
+ 'releases/download/build/rme_release-86101e5.tar.xz'),
+ 'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
# This tests the FEAT_RME cpu implementation, by booting a VM supporting
it,
# and launching a nested VM using it.
@@ -63,15 +35,16 @@ def test_aarch64_rme_virt(self):
self.vm.set_console()
- stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
- self.archive_extract(stack_path_tar_gz, format="tar")
+ stack_path_tar = self.ASSET_RME_STACK_VIRT.fetch()
+ self.archive_extract(stack_path_tar, format="tar")
- rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
- kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
- bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
- drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+ rme_stack = self.scratch_file('.')
+ kernel = join(rme_stack, 'out', 'Image')
+ bios = join(rme_stack, 'out', 'flash.bin')
+ rootfs = join(rme_stack, 'out', 'host.ext4')
- self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+ self.vm.add_args('-cpu', 'max,x-rme=on')
+ self.vm.add_args('-smp', '2')
self.vm.add_args('-m', '2G')
self.vm.add_args('-M', 'virt,acpi=off,'
'virtualization=on,'
@@ -79,23 +52,25 @@ def test_aarch64_rme_virt(self):
'gic-version=3')
self.vm.add_args('-bios', bios)
self.vm.add_args('-kernel', kernel)
- self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
- self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
- self.vm.add_args('-device',
'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
- self.vm.add_args('-fsdev',
f'local,security_model=none,path={rme_stack},id=shr0')
- self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
- self.vm.add_args('-netdev', 'user,id=net0')
+ self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+ self.vm.add_args('-virtfs',
+ f'local,path={rme_stack}/,mount_tag=host,'
+ 'security_model=mapped,readonly=off')
# We need to add nokaslr to avoid triggering this sporadic bug:
# https://gitlab.com/qemu-project/qemu/-/issues/2823
- self.vm.add_args('-append', 'root=/dev/vda nokaslr')
+ self.vm.add_args('-append',
+ 'nokaslr root=/dev/vda rw init=/init --'
+ ' /host/out/lkvm run --realm'
+ ' -m 256m'
+ ' --restricted_mem'
+ ' --kernel /host/out/Image'
+ ' --disk /host/out/guest.ext4'
+ ' --params "root=/dev/vda rw init=/init"')
self.vm.launch()
- # Wait for host VM boot to complete.
- wait_for_console_pattern(self, 'Welcome to Buildroot',
- failure_message='Synchronous Exception at')
- exec_command_and_wait_for_pattern(self, 'root', '#')
-
- test_realms_guest(self)
+ # Wait for host and guest VM boot to complete.
+ wait_for_console_pattern(self, 'root@guest',
+ failure_message='Kernel panic')
if __name__ == '__main__':
QemuSystemTest.main()
--
2.47.2
