Skip to content

Commit 8594401

Browse files
LakshmiSaiHarikaLakshmiSaiHarika
committed
Added new SEV CI PR test for SNP host and guest on self-hosted runner
Performs SEV cargo tests on the SNP host and SNP guest Signed-off-by: Harika Nittala <[email protected]>
1 parent d4ff5fa commit 8594401

File tree

1 file changed

+149
-0
lines changed

1 file changed

+149
-0
lines changed

‎.github/workflows/sev_ci_pr_testing.yaml

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: SEV CI PR test
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- reopened
7+
- opened
8+
- edited
9+
workflow_dispatch:
10+
11+
jobs:
12+
snp_host_tests:
13+
runs-on: self-hosted
14+
steps:
15+
- name: Checkout Repository
16+
uses: actions/checkout@v2
17+
18+
- name: Verify if SNP is enabled on the host
19+
run: |
20+
verify_snp_host() {
21+
if ! sudo dmesg | grep -i "SEV-SNP enabled" 2>&1 >/dev/null; then
22+
echo -e "SEV-SNP not enabled on the host. Please follow these steps to enable:\n\
23+
$(echo "${AMDSEV_URL}" | sed 's|\.git$||g')/tree/${AMDSEV_DEFAULT_BRANCH}#prepare-host"
24+
return 1
25+
fi
26+
}
27+
verify_snp_host
28+
29+
- name: SEV CI PR test on the host
30+
run: |
31+
echo "Event name = ${{ github.event_name }}"
32+
# Give user access to /dev/sev to run cargo tests w/o permission issues
33+
sudo usermod -a -G kvm $USER
34+
sudo setfacl -m g:kvm:rw /dev/sev
35+
36+
# Fetch and checkout SEV PR on the host
37+
rm -rf ~/sev
38+
git clone https://github.com/virtee/sev.git
39+
cd sev
40+
41+
# Checkout PR branch
42+
if [ ${{ github.event_name }} == "pull_request_target" ]; then
43+
git fetch origin pull/${{ github.event.pull_request.number }}/head:${{ github.head_ref }}
44+
git switch ${{ github.head_ref }}
45+
fi
46+
47+
# Install Rust on the host
48+
source "${HOME}/.cargo/env" 2>/dev/null || true
49+
if ! command -v rustc &> /dev/null; then
50+
echo "Installing Rust..."
51+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -sSf | sh -s -- -y
52+
source "${HOME}/.cargo/env" 2>/dev/null
53+
fi
54+
55+
# Cargo SEV PR test on the host
56+
cargo test
57+
58+
snp_guest_tests:
59+
runs-on: self-hosted
60+
steps:
61+
- name: Checkout Repository
62+
uses: actions/checkout@v2
63+
64+
- name: Launch SNP enabled guest
65+
run: |
66+
rm -rf ~/snp.sh
67+
wget https://raw.githubusercontent.com/LakshmiSaiHarika/sev-utils/Fedora-Latest-SNP-kernel-Upstream/tools/snp.sh
68+
chmod +x snp.sh
69+
70+
# rm -rf ~/snp/launch
71+
./snp.sh launch-guest
72+
73+
- name: Verify SNP on the guest via MSR
74+
run: |
75+
ssh_guest_command() {
76+
GUEST_SSH_KEY_PATH="${HOME}/snp/launch/snp-guest-key"
77+
if [ ! -f "${GUEST_SSH_KEY_PATH}" ]; then
78+
echo "SSH key not present, cannot verify guest SNP enabled."
79+
exit 1
80+
fi
81+
command="$1"
82+
ssh -p 10022 -i "${GUEST_SSH_KEY_PATH}" -o "StrictHostKeyChecking no" -o "PasswordAuthentication=no" -o ConnectTimeout=1 amd@localhost "${command}"
83+
}
84+
85+
verify_snp_guest_msr(){
86+
# Install guest rdmsr package dependencies to insert guest msr module
87+
ssh_guest_command "sudo dnf install -y msr-tools > /dev/null 2>&1" > /dev/null 2>&1
88+
ssh_guest_command "sudo modprobe msr" > /dev/null 2>&1
89+
local guest_msr_read=$(ssh_guest_command "sudo rdmsr -p 0 0xc0010131")
90+
guest_msr_read=$(echo "${guest_msr_read}" | tr -d '\r' | bc)
91+
92+
# Map all the sev features in a single associative array for all guest SEV features
93+
declare -A actual_sev_snp_bit_status=(
94+
[SEV]=$(( ( guest_msr_read >> 0) & 1))
95+
[SEV-ES]=$(( (guest_msr_read >> 1) & 1))
96+
[SNP]=$(( (guest_msr_read >> 2) & 1))
97+
)
98+
99+
local sev_snp_error=""
100+
for sev_snp_key in "${!actual_sev_snp_bit_status[@]}";
101+
do
102+
if [[ ${actual_sev_snp_bit_status[$sev_snp_key]} != 1 ]]; then
103+
# Capture the guest SEV/SNP bit value mismatch
104+
sev_snp_error+=$(echo "$sev_snp_key feature is not active on the guest.\n");
105+
fi
106+
done
107+
108+
if [[ ! -z "${sev_snp_error}" ]]; then
109+
>&2 echo -e "ERROR: ${sev_snp_error}"
110+
return 1
111+
fi
112+
}
113+
114+
verify_snp_guest_msr
115+
116+
- name: SEV CI PR test on the guest
117+
run: |
118+
ssh_guest_command() {
119+
# SSH guest commands
120+
GUEST_SSH_KEY_PATH="${HOME}/snp/launch/snp-guest-key"
121+
if [ ! -f "${GUEST_SSH_KEY_PATH}" ]; then
122+
echo "SSH key not present, cannot verify guest SNP enabled."
123+
exit 1
124+
fi
125+
command="$1"
126+
ssh -p 10022 -i "${GUEST_SSH_KEY_PATH}" -o "StrictHostKeyChecking no" -o "PasswordAuthentication=no" -o ConnectTimeout=1 amd@localhost "${command}"
127+
}
128+
129+
# Install sev dependencies as a root user
130+
ssh_guest_command "sudo su - <<EOF
131+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -sSf | sh -s -- -y
132+
source "${HOME}/.cargo/env" 2>/dev/null
133+
sudo dnf install -y git gcc
134+
EOF"
135+
136+
# Clean up and perform PR test on sev library as root user to fix OS permission denied issues
137+
ssh_guest_command "sudo su - <<EOF
138+
rm -rf ~/sev
139+
git clone https://github.com/virtee/sev.git
140+
cd ~/sev
141+
142+
# Checkout PR branch
143+
if [ ${{ github.event_name }} == "pull_request_target" ]; then
144+
git fetch origin pull/${{ github.event.pull_request.number }}/head:${{ github.head_ref }}
145+
git switch ${{ github.head_ref }}
146+
fi
147+
148+
cargo test
149+
EOF"

0 commit comments

Comments
 (0)