[kvm-unit-tests PATCH v1] s390x: run PV guests with confidential guest enabled

[kvm-unit-tests PATCH v1] s390x: run PV guests with confidential guest enabled

[Nico Boehr]

PV can only handle one page of SCLP read info, hence it can only support
a maximum of 247 CPUs.

To make sure we respect these limitations under PV, add a confidential
guest device to QEMU when launching a PV guest.

This fixes the topology-2 test failing under PV.

Also refactor the run script a bit to reduce code duplication by moving
the check whether we're running a PV guest to a function.

Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
---
 s390x/run | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/s390x/run b/s390x/run
index dcbf3f036415..e58fa4af9f23 100755
--- a/s390x/run
+++ b/s390x/run
@@ -14,19 +14,34 @@ set_qemu_accelerator || exit $?
 qemu=$(search_qemu_binary) ||
 	exit $?
 
-if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ] && [ "$ACCEL" = "tcg" ]; then
+is_pv() {
+	if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ]; then
+		return 0
+	fi
+	return 1
+}
+
+if is_pv && [ "$ACCEL" = "tcg" ]; then
 	echo "Protected Virtualization isn't supported under TCG"
 	exit 2
 fi
 
-if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ] && [ "$MIGRATION" = "yes" ]; then
+if is_pv && [ "$MIGRATION" = "yes" ]; then
 	echo "Migration isn't supported under Protected Virtualization"
 	exit 2
 fi
 
 M='-machine s390-ccw-virtio'
 M+=",accel=$ACCEL$ACCEL_PROPS"
+
+if is_pv; then
+	M+=",confidential-guest-support=pv0"
+fi
+
 command="$qemu -nodefaults -nographic $M"
+if is_pv; then
+	command+=" -object s390-pv-guest,id=pv0"
+fi
 command+=" -chardev stdio,id=con0 -device sclpconsole,chardev=con0"
 command+=" -kernel"
 command="$(panic_cmd) $(migration_cmd) $(timeout_cmd) $command"
-- 
2.41.0

Re: [kvm-unit-tests PATCH v1] s390x: run PV guests with confidential guest enabled

[Claudio Imbrenda]

On Mon, 25 Sep 2023 15:52:45 +0200
Nico Boehr <nrb@linux.ibm.com> wrote:

> PV can only handle one page of SCLP read info, hence it can only support
> a maximum of 247 CPUs.
> 
> To make sure we respect these limitations under PV, add a confidential
> guest device to QEMU when launching a PV guest.
> 
> This fixes the topology-2 test failing under PV.
> 
> Also refactor the run script a bit to reduce code duplication by moving
> the check whether we're running a PV guest to a function.
> 
> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
> Signed-off-by: Nico Boehr <nrb@linux.ibm.com>

Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>

> ---
>  s390x/run | 19 +++++++++++++++++--
>  1 file changed, 17 insertions(+), 2 deletions(-)
> 
> diff --git a/s390x/run b/s390x/run
> index dcbf3f036415..e58fa4af9f23 100755
> --- a/s390x/run
> +++ b/s390x/run
> @@ -14,19 +14,34 @@ set_qemu_accelerator || exit $?
>  qemu=$(search_qemu_binary) ||
>  	exit $?
>  
> -if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ] && [ "$ACCEL" = "tcg" ]; then
> +is_pv() {
> +	if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ]; then
> +		return 0
> +	fi
> +	return 1
> +}
> +
> +if is_pv && [ "$ACCEL" = "tcg" ]; then
>  	echo "Protected Virtualization isn't supported under TCG"
>  	exit 2
>  fi
>  
> -if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ] && [ "$MIGRATION" = "yes" ]; then
> +if is_pv && [ "$MIGRATION" = "yes" ]; then
>  	echo "Migration isn't supported under Protected Virtualization"
>  	exit 2
>  fi
>  
>  M='-machine s390-ccw-virtio'
>  M+=",accel=$ACCEL$ACCEL_PROPS"
> +
> +if is_pv; then
> +	M+=",confidential-guest-support=pv0"
> +fi
> +
>  command="$qemu -nodefaults -nographic $M"
> +if is_pv; then
> +	command+=" -object s390-pv-guest,id=pv0"
> +fi
>  command+=" -chardev stdio,id=con0 -device sclpconsole,chardev=con0"
>  command+=" -kernel"
>  command="$(panic_cmd) $(migration_cmd) $(timeout_cmd) $command"

Re: [kvm-unit-tests PATCH v1] s390x: run PV guests with confidential guest enabled

[Nina Schoetterl-Glausch]

On Mon, 2023-09-25 at 15:52 +0200, Nico Boehr wrote:
> PV can only handle one page of SCLP read info, hence it can only support
> a maximum of 247 CPUs.
> 
> To make sure we respect these limitations under PV, add a confidential
> guest device to QEMU when launching a PV guest.
> 
> This fixes the topology-2 test failing under PV.
> 
> Also refactor the run script a bit to reduce code duplication by moving
> the check whether we're running a PV guest to a function.
> 
> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
> Signed-off-by: Nico Boehr <nrb@linux.ibm.com>

Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>

> ---
>  s390x/run | 19 +++++++++++++++++--
>  1 file changed, 17 insertions(+), 2 deletions(-)
> 
> diff --git a/s390x/run b/s390x/run
> index dcbf3f036415..e58fa4af9f23 100755
> --- a/s390x/run
> +++ b/s390x/run
> @@ -14,19 +14,34 @@ set_qemu_accelerator || exit $?
>  qemu=$(search_qemu_binary) ||
>  	exit $?
>  
> -if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ] && [ "$ACCEL" = "tcg" ]; then
> +is_pv() {
> +	if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ]; then
> +		return 0
> +	fi
> +	return 1
> +}

Could also just do

is_pv() {
        [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ]
}

but it might actually be more readable with the if
> +
> +if is_pv && [ "$ACCEL" = "tcg" ]; then
>  	echo "Protected Virtualization isn't supported under TCG"
>  	exit 2
>  fi
>  
> -if [ "${1: -7}" = ".pv.bin" ] || [ "${TESTNAME: -3}" = "_PV" ] && [ "$MIGRATION" = "yes" ]; then
> +if is_pv && [ "$MIGRATION" = "yes" ]; then
>  	echo "Migration isn't supported under Protected Virtualization"
>  	exit 2
>  fi
>  
>  M='-machine s390-ccw-virtio'
>  M+=",accel=$ACCEL$ACCEL_PROPS"
> +
> +if is_pv; then
> +	M+=",confidential-guest-support=pv0"
> +fi
> +
>  command="$qemu -nodefaults -nographic $M"
> +if is_pv; then
> +	command+=" -object s390-pv-guest,id=pv0"
> +fi
>  command+=" -chardev stdio,id=con0 -device sclpconsole,chardev=con0"
>  command+=" -kernel"
>  command="$(panic_cmd) $(migration_cmd) $(timeout_cmd) $command"