Release Testplan
Testplan for Monthly Development Releases
Here is the list of tests performed for each monthly development release.
Environment Setup
Set the following environment variables before running the tests:
export FW_FILE=/usr/share/edk2/ovmf/OVMF.amdsev.fd
export QEMU=/path/to/qemu-system-x86_64
export IMAGE=/path/to/guest.qcow2
Build all targets
Build all targets in the configs/ directory.
Development Build + SNP boot test
Build with debug flag enabled and boot VM under SEV-SNP to Linux prompt.
Development Build + Native boot test
Build with debug flag enabled and boot COCONUT-SVSM in a non-confidential VM.
Release Build + SNP boot test
Build with release flag enabled and boot VM under SEV-SNP to Linux prompt.
Release Build + Native boot test
Build with release flag enabled and boot COCONUT-SVSM in a non-confidential VM.
Fuzzers
Run all the fuzzers included in the project for an extended period of time. Given that failures in the past usually showed up in the first minute of fuzzing, for releases the fuzzer runs for a minimum of 10 minutes.
make test
Run the unit-tests included in the project. This test also runs in CI.
make test-in-svsm
Run the in-SVSM unit-tests on both AMD SEV-SNP and the native platform.
Commands:
Verus Formal Verifier
Run the formal verification included in the project.
Commands:
make clippy CARGO_HACK=1
Run clippy for a wider set of configurations.
cargo audit
Check the projects dependency tree for known vulnerabilities.
TPM Tests
Start a Linux guest OS
and run the following TPM2 tests:
Check TPM2 availability
Seal/Unseal
pushd $(mktemp -d)
SECRET="secret"
tpm2_createprimary -c primary.ctx
echo "sealing '$SECRET' without PCRs"
echo "$SECRET" | tpm2_create -C primary.ctx -i - -u seal.pub -r seal.priv
tpm2_load -C primary.ctx -u seal.pub -r seal.priv -c seal.ctx
unsealed=$(tpm2_unseal -c seal.ctx)
echo "unsealed: '$unsealed'"
[ "$unsealed" != "$SECRET" ] && echo "FAILED: unseal without PCRs: expected '$SECRET'" && false
echo "sealing '$SECRET' with PCRs"
tpm2_pcrread -Q -o pcr.bin sha256:0,1,2,3
tpm2_createpolicy --policy-pcr -l sha256:0,1,2,3 -f pcr.bin -L pcr.policy
echo "$SECRET" | tpm2_create -C primary.ctx -L pcr.policy -i - -u seal.pub -r seal.priv
tpm2_load -C primary.ctx -u seal.pub -r seal.priv -c seal.ctx
unsealed=$(tpm2_unseal -c seal.ctx -p pcr:sha256:0,1,2,3)
echo "unsealed: '$unsealed'"
[ "$unsealed" != "$SECRET" ] && echo "FAILED: unseal with PCRs: expected '$SECRET'" && false
popd
Self Test
Event Log
Check that OVMF recorded EFI events in the TPM event log.
tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | \
grep EV_EFI_BOOT_SERVICES_APPLICATION || { echo "FAILED: no EFI boot services events"; false; }
vTPM Attestation
Test SEV-SNP vTPM service attestation via Linux configfs-tsm.
# Fedora/RHEL: dnf install -y git cargo tpm2-tss-devel
# Debian/Ubuntu: apt install -y git cargo libtss2-dev
# openSUSE/SUSE: zypper install -y git cargo tpm2-0-tss-devel
git clone https://github.com/hpe-security-lab/svsm-vtpm-test.git
cd svsm-vtpm-test
cargo run
Attestation Tests
Test SVSM attestation via KBS using both transport methods. See ATTESTATION.md for full details.
If attestation fails, SVSM will panic and the VM will not boot.
On success, [SVSM] attestation successful appears in the boot logs.
Build SVSM and proxy
Start the kbs-test server
In a separate terminal:
SVSM=/path/to/svsm
git clone https://github.com/coconut-svsm/kbs-test.git
cd kbs-test
MEASUREMENT="$($SVSM/bin/igvmmeasure --check-kvm $SVSM/bin/coconut-qemu.igvm measure -b)"
cargo run -- --measurement $MEASUREMENT
vsock transport
Start the proxy in another terminal:
Launch the guest:
Serial transport
Start the proxy in another terminal:
Launch the guest: