test: split coco test per-platform

Grow TEST-94-COCO from a single inline check into the reusable structure that can be used by multiple future subtests: - lib.sh: code shared between subtests on the host side. - guest-test.sh: the testcase_coco_* checks. - guest-test-runner.sh: runs each testcase_coco_* check, ships guest side testcase results over vsock. Helpers live under test/units/TEST-94-COCO/. The vsock records are best-effort detail, the aggregate exit status stays the authoritative pass/fail. Split the test into subtests per platform/boot flow. Signed-off-by: Paul Meyer <katexochen0@gmail.com>
2026-09-25 08:15:24 +02:00
parent 5199e9618d
commit 671206e266
7 changed files with 293 additions and 83 deletions
@@ -160,12 +160,19 @@ as root. The host must have coco enabled in firmware and in the kernel (for SEV-
 e.g. `kvm_amd.sev_snp=1`, with `/dev/sev` accessible). On a host without the requested
 technology, or when running in `mkosi vm` mode, the tests are skipped.

+Inside each guest, `guest-test-runner.sh` runs the guest-side checks and reports
+their results back to the host over a vsock socket, while the guest's overall
+pass/fail is relayed separately through its exit status. The host side collects
+both to produce the subtest result.
+
 ```
 meson test
  └─ integration-test-wrapper.py
      └─ mkosi boot  ──►  systemd-nspawn container
          └─ TEST-94-COCO.sh
-              └─ systemd-vmspawn --coco=<type>  ──►  confidential VM
+              └─ TEST-94-COCO.*.sh
+                  └─ systemd-vmspawn --coco=<type>  ──►  confidential VM
+                          └─ guest-test-runner.sh
 ```

 ## Running the integration tests without building systemd from source
@@ -1,20 +1,23 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 #
-# Launch a confidential VM with systemd-vmspawn --coco= and verify the guest reports the expected
-# confidential-virtualization type. Runs only on coco-capable hardware: the harness --coco=any flag gates
-# the run (skipped otherwise), binds /dev/kvm + the coco device(s) into this boot-mode container, and
-# passes the resolved technology via $COCO_TYPE.
+# Confidential Computing test.
 #
-# The confidential guest boots the same mkosi test image. A one-shot unit injected into the guest checks
-# systemd-detect-virt --cvm and reports the verdict via systemd's exit-status notification over vsock
-# (SuccessAction=exit): the guest PID1 sends EXIT_STATUS to vmspawn's vmm notify socket and vmspawn exits
-# with it.
+# These only run on coco hardware and if the test environment isn't already virtualized, see
+# the harness --coco= flag and the documentation in test/integration-tests/README.md.
+#
+# Subtests are split per platform and launch path to reduce the number of required boots.
+# Test code runs on both sides:
+#   - host: test vmspawn by running confidential guests. TEST-94-COCO/lib.sh provides helpers.
+#   - guest: test guest side component coco behavior. Assertions via TEST-94-COCO/guest-test{,-runner}.sh.
+
 set -eux
 set -o pipefail

 # shellcheck source=test/units/util.sh
 . "$(dirname "$0")"/util.sh
+# shellcheck source=test/units/test-control.sh
+. "$(dirname "$0")"/test-control.sh

 if [[ -v ASAN_OPTIONS ]]; then
    echo "vmspawn launches QEMU which doesn't work under ASan, skipping" | tee --append /skipped
@@ -31,83 +34,19 @@ if ! find_qemu_binary; then
    exit 77
 fi

-# The integration-test-wrapper resolves the host's coco technology on the
-# bare-metal host (where /sys/module is readable) and passes it via $COCO_TYPE.
+# The harness binds the guest image artifacts read-only at /work/vm-images.
+export IMAGE_DIR=/work/vm-images
+if [[ ! -f "$IMAGE_DIR/image.raw" || ! -f "$IMAGE_DIR/image.vmlinuz" || ! -f "$IMAGE_DIR/image.initrd" ]]; then
+    echo "image artifacts not found in $IMAGE_DIR, skipping" | tee --append /skipped
+    exit 77
+fi
+
+# The integration-test-wrapper resolves the host's coco technology (where /sys/module is readable) and
+# passes it via $COCO_TYPE.
 if [[ -z "${COCO_TYPE:-}" ]]; then
    echo "COCO_TYPE not set (run via the integration harness with --coco), skipping" | tee --append /skipped
    exit 77
 fi
 echo "Host coco type: $COCO_TYPE"

-# The harness binds the guest image read-only at /work/vm-images (the 'vm-images' test option).
-IMAGE_DIR=/work/vm-images
-if [[ ! -f "$IMAGE_DIR/image.raw" || ! -f "$IMAGE_DIR/image.vmlinuz" || ! -f "$IMAGE_DIR/image.initrd" ]]; then
-    echo "guest image not found in $IMAGE_DIR, skipping" | tee --append /skipped
-    exit 77
-fi
-echo "Guest image directory: $IMAGE_DIR"
-
-MACHINE="coco-guest-$$"
-WORKDIR="$(mktemp -d)"
-at_exit() {
-    set +e
-    machinectl terminate "$MACHINE" 2>/dev/null || :
-    rm -rf "$WORKDIR"
-}
-trap at_exit EXIT INT TERM
-
-# One-shot unit for the guest: verify systemd-detect-virt --cvm matches the type vmspawn launched.
-# Created via the systemd.extra-unit.* credential and pulled into the boot by a multi-user.target drop-in.
-GUEST_PASS=123
-GUEST_UNIT="$(cat <<'EOF'
-[Unit]
-Description=coco guest self-check
-After=basic.target
-SuccessAction=exit
-SuccessActionExitStatus=@GUEST_PASS@
-FailureAction=exit
-FailureActionExitStatus=1
-[Service]
-Type=oneshot
-ExecStart=bash -c 'test "$(systemd-detect-virt --cvm)" = "@COCO_TYPE@"'
-EOF
-)"
-GUEST_UNIT="${GUEST_UNIT//@COCO_TYPE@/$COCO_TYPE}"
-GUEST_UNIT="${GUEST_UNIT//@GUEST_PASS@/$GUEST_PASS}"
-
-GUEST_DROPIN="$(cat <<'EOF'
-[Unit]
-Wants=coco-guest.service
-After=coco-guest.service
-EOF
-)"
-
-# Launch the confidential guest and capture its console output.
-# Direct linux boot should work on all coco platforms (the only boot path supported by SNP).
-vmspawn_rc=0
-timeout -k 30 300 systemd-vmspawn \
-    --machine="$MACHINE" \
-    --coco="$COCO_TYPE" \
-    --ram=1G \
-    --ephemeral \
-    --image="$IMAGE_DIR/image.raw" \
-    --linux="$IMAGE_DIR/image.vmlinuz" \
-    --initrd="$IMAGE_DIR/image.initrd" \
-    --tpm=no \
-    --console=read-only \
-    --set-credential="systemd.extra-unit.coco-guest.service:$GUEST_UNIT" \
-    --set-credential="systemd.unit-dropin.multi-user.target:$GUEST_DROPIN" \
-    selinux=0 systemd.firstboot=no rw \
-    2>&1 | tee "$WORKDIR/console.log" || vmspawn_rc="${PIPESTATUS[0]}"
-if [[ "$vmspawn_rc" -eq 124 || "$vmspawn_rc" -eq 137 ]]; then
-    echo "systemd-vmspawn was killed by timeout (exit $vmspawn_rc)" >&2
-    cat "$WORKDIR/console.log" >&2
-    exit 1
-elif [[ "$vmspawn_rc" -ne "$GUEST_PASS" ]]; then
-    echo "guest coco self-check did not pass: vmspawn exit $vmspawn_rc (expected $GUEST_PASS)" >&2
-    cat "$WORKDIR/console.log" >&2
-    exit 1
-fi
-echo "Guest correctly reported confidential virtualization: $COCO_TYPE"
-
-touch /testok
+run_subtests_and_exit
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# SEV-SNP, direct kernel boot: launch a confidential guest with --linux=/--initrd=.
+
+set -eux
+set -o pipefail
+
+# shellcheck source=test/units/TEST-94-COCO/lib.sh
+. "$(dirname "$0")"/TEST-94-COCO/lib.sh
+
+if [[ "${COCO_TYPE:?}" != "sev-snp" ]]; then
+    echo "host coco type is '$COCO_TYPE', not sev-snp, skipping"
+    exit 77
+fi
+
+MACHINE="coco-snp-direct-$$"
+WORKDIR="$(mktemp -d)"
+at_exit() {
+    set +e
+    jobs -p | xargs -r kill 2>/dev/null
+    machinectl terminate "$MACHINE" 2>/dev/null || :
+    rm -rf "$WORKDIR"
+}
+trap at_exit EXIT
+
+vmspawn_boot_coco "$MACHINE" "$COCO_TYPE" "$WORKDIR" "" \
+    --image="$IMAGE_DIR/image.raw" \
+    --linux="$IMAGE_DIR/image.vmlinuz" \
+    --initrd="$IMAGE_DIR/image.initrd" \
+    selinux=0 systemd.firstboot=no rw
+echo "SEV-SNP direct-boot guest correctly reported confidential virtualization"
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# TDX, direct kernel boot: launch a confidential guest with --linux=/--initrd=.
+
+set -eux
+set -o pipefail
+
+# shellcheck source=test/units/TEST-94-COCO/lib.sh
+. "$(dirname "$0")"/TEST-94-COCO/lib.sh
+
+if [[ "${COCO_TYPE:?}" != "tdx" ]]; then
+    echo "host coco type is '$COCO_TYPE', not tdx, skipping"
+    exit 77
+fi
+
+MACHINE="coco-tdx-direct-$$"
+WORKDIR="$(mktemp -d)"
+at_exit() {
+    set +e
+    jobs -p | xargs -r kill 2>/dev/null
+    machinectl terminate "$MACHINE" 2>/dev/null || :
+    rm -rf "$WORKDIR"
+}
+trap at_exit EXIT
+
+vmspawn_boot_coco "$MACHINE" "$COCO_TYPE" "$WORKDIR" "" \
+    --image="$IMAGE_DIR/image.raw" \
+    --linux="$IMAGE_DIR/image.vmlinuz" \
+    --initrd="$IMAGE_DIR/image.initrd" \
+    selinux=0 systemd.firstboot=no rw
+echo "TDX direct-boot guest correctly reported confidential virtualization"
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# Runs inside the confidential guest launched by TEST-94-COCO.sh. Runs the requested guest-side checks
+# (testcase_coco_* from guest-test.sh), ships a per-check result record to the host over the vsock
+# result socket, and lets the injected unit's SuccessAction/FailureAction relay the aggregate verdict
+# to the host via vmspawn's exit status.
+set -eux
+set -o pipefail
+
+_COCO_DIR="$(dirname "$(readlink -f "$0")")"
+# util.sh (assert_*) lives one level up in the shared units dir.
+# shellcheck source=test/units/util.sh
+. "$(dirname "$_COCO_DIR")/util.sh"
+# shellcheck source=test/units/TEST-94-COCO/guest-test.sh
+. "$_COCO_DIR/guest-test.sh"
+
+# Ship the accumulated result records to the host's vsock listener (CID 2 = host). Best-effort: the
+# aggregate verdict travels independently via the unit's exit status, so a vsock hiccup never masks a
+# pass/fail — it only drops the per-check breakdown.
+_coco_ship_results() {
+    local records="${1:?}"
+    [[ -n "${COCO_RESULT_PORT:-}" ]] || return 0
+    socat -u "OPEN:$records,rdonly" "VSOCK-CONNECT:2:$COCO_RESULT_PORT" ||
+        echo >&2 "WARNING: failed to ship coco results over vsock port $COCO_RESULT_PORT"
+}
+
+# Run the guest-side checks named by $COCO_TESTCASES (testcase_coco_* names without the prefix),
+# record pass/fail per check, and ship the records. Each named check is something its boot scenario
+# exists to prove, so an unknown name or an empty request fails the aggregate rather than letting the
+# boot pass without having verified anything.
+_coco_run_tests() {
+    local testcases testcase rc result failed=0 records
+    records="$(mktemp)"
+
+    read -ra testcases <<<"${COCO_TESTCASES:-}"
+    if [[ "${#testcases[@]}" -eq 0 ]]; then
+        echo >&2 "No coco testcases requested via \$COCO_TESTCASES"
+        return 1
+    fi
+    testcases=("${testcases[@]/#/testcase_coco_}")
+
+    for testcase in "${testcases[@]}"; do
+        if ! declare -F "$testcase" >/dev/null; then
+            echo >&2 "Requested coco testcase '$testcase' is not defined"
+            printf 'ID=%s RESULT=missing\n' "$testcase" >>"$records"
+            failed=1
+            continue
+        fi
+        # Subshell so a testcase's RETURN trap can't fire twice (see run_testcases in test-control.sh).
+        # Bash disables 'set -e' throughout a function called in a context that tests its exit status,
+        # so '("$testcase") || rc=$?' would let a testcase run past its first failed assertion and
+        # report only its last one. Reading $? from a standalone call avoids that context; the inner
+        # 'set -e' re-arms what the surrounding 'set +e' turned off.
+        set +e
+        (set -e; "$testcase")
+        rc=$?
+        set -e
+        if [[ "$rc" -eq 0 ]]; then
+            result=pass
+        else
+            result=fail
+            failed=1
+        fi
+        echo "coco check $testcase: $result (rc=$rc)"
+        printf 'ID=%s RESULT=%s\n' "$testcase" "$result" >>"$records"
+    done
+
+    _coco_ship_results "$records"
+    return "$failed"
+}
+
+_coco_run_tests
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck shell=bash
+#
+# Guest-side checks for the confidential computing integration test (TEST-94-COCO). Sourced by
+# guest-test-runner.sh inside the confidential guest; each testcase_coco_* function is one
+# sub-subtest. The upcoming credential-trust checks land here as further functions.
+
+if [[ "${BASH_SOURCE[0]}" -ef "$0" ]]; then
+    echo >&2 "This file should not be executed directly"
+    exit 1
+fi
+
+# Assert the guest observes the confidential-virtualization technology the host launched it with.
+# COCO_TYPE is provided by the injected guest unit (Environment=, see lib.sh).
+testcase_coco_detect_virt() {
+    assert_eq "$(systemd-detect-virt --cvm)" "${COCO_TYPE:?}"
+}
@@ -0,0 +1,110 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck shell=bash
+#
+# Host-side helpers for the confidential computing integration test (TEST-94-COCO).
+# Sourced by the TEST-94-COCO.sh driver.
+
+if [[ "${BASH_SOURCE[0]}" -ef "$0" ]]; then
+    echo >&2 "This file should not be executed directly"
+    exit 1
+fi
+
+# Exit status the guest test runner reports on success (its unit's SuccessActionExitStatus=). vmspawn
+# forwards the guest PID1's EXIT_STATUS over the vsock notify socket and exits with it.
+_COCO_GUEST_PASS=123
+# vsock port the host listens on for the guest's per-check result records, distinct from vmspawn's own
+# (kernel-assigned) notify port. The host binds CID_ANY:PORT; the guest connects to CID 2 (host):PORT.
+_COCO_RESULT_PORT=4321
+
+# _coco_guest_unit COCO_TYPE UNITS_DIR TESTCASES
+# Emit the one-shot unit that runs the guest test runner: passes the coco type, result port and
+# the requested checks via the environment, and relays the aggregate verdict via
+# SuccessAction/EXIT_STATUS.
+_coco_guest_unit() {
+    local coco_type="${1:?}" units_dir="${2:?}" testcases="${3:?}"
+    cat <<EOF
+[Unit]
+Description=coco guest self-check
+After=basic.target
+SuccessAction=exit
+SuccessActionExitStatus=$_COCO_GUEST_PASS
+FailureAction=exit
+FailureActionExitStatus=1
+[Service]
+Type=oneshot
+Environment=COCO_TYPE=$coco_type
+Environment=COCO_RESULT_PORT=$_COCO_RESULT_PORT
+Environment="COCO_TESTCASES=$testcases"
+ExecStart=$units_dir/guest-test-runner.sh
+EOF
+}
+
+# _coco_guest_dropin
+# Emit the multi-user.target drop-in that pulls the guest self-check unit into the boot.
+_coco_guest_dropin() {
+    cat <<EOF
+[Unit]
+Wants=coco-guest.service
+After=coco-guest.service
+EOF
+}
+
+# vmspawn_boot_coco MACHINE COCO_TYPE WORKDIR TESTCASES [systemd-vmspawn args...]
+# Boot a confidential guest with systemd-vmspawn, running the coco guest test runner. TESTCASES is the
+# space-separated list of guest checks (testcase_coco_* names without the prefix).
+# The caller supplies the boot-path-specific launch args — --image/--linux/--initrd and the guest
+# kernel command line — plus any extra flags via "$@", so each per-boot-path scenario
+# stays configurable. Per-check records shipped by the guest are collected over a vsock
+# socket into WORKDIR/results and echoed; returns 0 iff the guest reported the success
+# aggregate, otherwise dumps the console.
+vmspawn_boot_coco() {
+    local machine="${1:?}" coco_type="${2:?}" workdir="${3:?}" testcases="${4:?}"
+    shift 4
+
+    local units_dir results console guest_unit guest_dropin rc=0 listener_pid=""
+    units_dir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+    results="$workdir/results"
+    console="$workdir/console.log"
+    : >"$results"
+
+    guest_unit="$(_coco_guest_unit "$coco_type" "$units_dir" "$testcases")"
+    guest_dropin="$(_coco_guest_dropin)"
+
+    # Collect the per-check records the guest ships over vsock (single connection, guest closes when
+    # done). Best-effort: the aggregate exit status below is the authoritative pass/fail, so a vsock
+    # hiccup only costs the per-check breakdown, never the verdict.
+    socat -u "VSOCK-LISTEN:$_COCO_RESULT_PORT" "OPEN:$results,creat" &
+    listener_pid=$!
+
+    timeout -k 30 300 systemd-vmspawn \
+        --machine="$machine" \
+        --coco="$coco_type" \
+        --ram=1G \
+        --ephemeral \
+        --tpm=no \
+        --console=read-only \
+        --set-credential="systemd.extra-unit.coco-guest.service:$guest_unit" \
+        --set-credential="systemd.unit-dropin.multi-user.target:$guest_dropin" \
+        "$@" \
+        2>&1 | tee "$console" || rc="${PIPESTATUS[0]}"
+
+    kill "$listener_pid" 2>/dev/null || :
+    wait "$listener_pid" 2>/dev/null || :
+
+    if [[ -s "$results" ]]; then
+        echo "coco guest per-check results:"
+        cat "$results"
+    fi
+
+    if [[ "$rc" -eq 124 || "$rc" -eq 137 ]]; then
+        echo "systemd-vmspawn was killed by timeout (exit $rc)" >&2
+        cat "$console" >&2
+        return 1
+    fi
+    if [[ "$rc" -ne "$_COCO_GUEST_PASS" ]]; then
+        echo "coco guest test runner failed: vmspawn exit $rc (expected $_COCO_GUEST_PASS)" >&2
+        cat "$console" >&2
+        return 1
+    fi
+    return 0
+}