attest: add unit tests for attestation protocol

Add unit tests for the attestation protocol request handler
(kernel/src/protocols/attest.rs).

The SVSM attestation protocol exposes a fixed wire ABI defined by
Table 11 and Table 13 of "Secure VM Service Module for SEV-SNP Guests,
Rev 1.00". Any accidental field reordering or padding change would
silently break the guest interface, so the layout of AttestServicesOp
and AttestSingleServiceOp is now checked with compile-time
const assertions (following the pattern in greq/msg.rs).

Runtime tests cover:
- Reserved-field validation: every reserved region in both structs must
  be rejected when non-zero, guarding forward-compatibility with future
  spec revisions.
- Certificate region boundary: size==0 is valid (no extended report);
  size<=MAX_CERTIFICATE_SIZE is accepted; size>MAX_CERTIFICATE_SIZE is
  rejected.
- GUID serialization: single-entry and multi-entry GuidTable wire
  format, including offset arithmetic between header and payload.
- Protocol routing: unknown request codes must return
  UNSUPPORTED_PROTOCOL.

Signed-off-by: Nihal <nihalxkumar@protonmail.com>

Author: nihalxkumar

kernel/src/protocols/attest.rs

@@ -183,6 +183,24 @@ impl AttestServicesOp {
     }
 }
 
+// Compile-time ABI layout guard: any change to field order or padding that
+// breaks the wire format with the guest will be caught here.
+const _: () = assert!(
+    core::mem::offset_of!(AttestServicesOp, report_gpa) == 0x00
+        && core::mem::offset_of!(AttestServicesOp, report_size) == 0x08
+        && core::mem::offset_of!(AttestServicesOp, reserved_1) == 0x0c
+        && core::mem::offset_of!(AttestServicesOp, nonce_gpa) == 0x10
+        && core::mem::offset_of!(AttestServicesOp, nonce_size) == 0x18
+        && core::mem::offset_of!(AttestServicesOp, reserved_2) == 0x1a
+        && core::mem::offset_of!(AttestServicesOp, manifest_gpa) == 0x20
+        && core::mem::offset_of!(AttestServicesOp, manifest_size) == 0x28
+        && core::mem::offset_of!(AttestServicesOp, reserved_3) == 0x2c
+        && core::mem::offset_of!(AttestServicesOp, certificate_gpa) == 0x30
+        && core::mem::offset_of!(AttestServicesOp, certificate_size) == 0x38
+        && core::mem::offset_of!(AttestServicesOp, reserved_4) == 0x3c
+        && core::mem::size_of::<AttestServicesOp>() == 0x40
+);
+
 #[derive(Clone)]
 struct GuidTableEntry {
     guid: uuid::Uuid,
@@ -314,6 +332,16 @@ impl AttestSingleServiceOp {
     }
 }
 
+// Compile-time ABI layout guard for the extended single-service structure
+// that wraps AttestServicesOp.
+const _: () = assert!(
+    core::mem::offset_of!(AttestSingleServiceOp, op) == 0x00
+        && core::mem::offset_of!(AttestSingleServiceOp, guid) == 0x40
+        && core::mem::offset_of!(AttestSingleServiceOp, manifest_ver) == 0x50
+        && core::mem::offset_of!(AttestSingleServiceOp, reserved_5) == 0x54
+        && core::mem::size_of::<AttestSingleServiceOp>() == 0x58
+);
+
 fn get_attestation_report_standard(nonce: &[u8]) -> Result<Box<SnpReportResponse>, SvsmReqError> {
     let mut resp = SnpReportResponse::new_box_zeroed()
         .map_err(|_| SvsmReqError::FatalError(SvsmError::Mem))?;
@@ -584,3 +612,204 @@ pub fn attest_protocol_request(
         _ => Err(SvsmReqError::unsupported_protocol()),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::protocols::errors::SvsmResultCode;
+    use alloc::vec;
+    use core::mem::offset_of;
+    use zerocopy::FromZeros;
+
+    fn is_invalid_parameter(err: &SvsmReqError) -> bool {
+        matches!(
+            err,
+            SvsmReqError::RequestError(SvsmResultCode::INVALID_PARAMETER)
+        )
+    }
+
+    fn is_unsupported_protocol(err: &SvsmReqError) -> bool {
+        matches!(
+            err,
+            SvsmReqError::RequestError(SvsmResultCode::UNSUPPORTED_PROTOCOL)
+        )
+    }
+
+    mod attest_services {
+        use super::*;
+
+        fn base_op() -> AttestServicesOp {
+            AttestServicesOp::new_zeroed()
+        }
+
+        /// The struct has four separate reserved regions. Iterate over
+        /// all of them to ensure is_reserved_clear() inspects every one,
+        /// not just the first.
+        #[test]
+        fn reserved_clear_rejects_each_field() {
+            for offset in [
+                offset_of!(AttestServicesOp, reserved_1),
+                offset_of!(AttestServicesOp, reserved_2),
+                offset_of!(AttestServicesOp, reserved_3),
+                offset_of!(AttestServicesOp, reserved_4),
+            ] {
+                let mut bytes = base_op().as_bytes().to_vec();
+                bytes[offset] = 0xff;
+                let op = AttestServicesOp::ref_from_bytes(&bytes).unwrap();
+                assert!(
+                    !op.is_reserved_clear(),
+                    "reserved check should fail for byte at offset {offset:#x}"
+                );
+            }
+        }
+
+        /// Parsing must reject requests with non-zero reserved fields
+        /// to enforce forward-compatibility with future spec revisions.
+        #[test]
+        fn try_from_as_ref_rejects_nonzero_reserved() {
+            for offset in [
+                offset_of!(AttestServicesOp, reserved_1),
+                offset_of!(AttestServicesOp, reserved_2),
+                offset_of!(AttestServicesOp, reserved_3),
+                offset_of!(AttestServicesOp, reserved_4),
+            ] {
+                let mut bytes = base_op().as_bytes().to_vec();
+                bytes[offset] = 1;
+                let err = AttestServicesOp::try_from_as_ref(&bytes).unwrap_err();
+                assert!(
+                    is_invalid_parameter(&err),
+                    "should reject nonzero reserved at offset {offset:#x}"
+                );
+            }
+        }
+
+        /// The certificate region is optional (size == 0 means absent).
+        /// When present, it must enforce MAX_CERTIFICATE_SIZE as an upper
+        /// bound to prevent guests from requesting unbounded allocations.
+        #[test]
+        fn certificate_region_boundary() {
+            let mut op = base_op();
+            assert!(op.get_certificate_region().unwrap().is_none());
+
+            op.certificate_gpa = 0x4000;
+            op.certificate_size = MAX_CERTIFICATE_SIZE as u32;
+            assert!(op.get_certificate_region().unwrap().is_some());
+
+            op.certificate_size = (MAX_CERTIFICATE_SIZE + 1) as u32;
+            let err = op.get_certificate_region().unwrap_err();
+            assert!(is_invalid_parameter(&err));
+        }
+    }
+
+    mod attest_single_service {
+        use super::*;
+
+        fn base_op() -> AttestSingleServiceOp {
+            AttestSingleServiceOp::new_zeroed()
+        }
+
+        /// Only manifest version 0 is currently defined by the protocol.
+        /// Parsing must reject any other version to prevent silent
+        /// misinterpretation of the manifest payload.
+        #[test]
+        fn try_from_as_ref_rejects_manifest_version() {
+            let mut bytes = base_op().as_bytes().to_vec();
+            bytes[offset_of!(AttestSingleServiceOp, manifest_ver)] = 1;
+            let err = AttestSingleServiceOp::try_from_as_ref(&bytes).unwrap_err();
+            assert!(is_invalid_parameter(&err));
+        }
+
+        /// AttestSingleServiceOp embeds an AttestServicesOp. Parsing must
+        /// validate the reserved fields of the inner struct too, not just
+        /// its own reserved_5.
+        #[test]
+        fn try_from_as_ref_rejects_inner_reserved() {
+            let mut bytes = base_op().as_bytes().to_vec();
+            bytes[offset_of!(AttestServicesOp, reserved_1)] = 1;
+            let err = AttestSingleServiceOp::try_from_as_ref(&bytes).unwrap_err();
+            assert!(is_invalid_parameter(&err));
+        }
+
+        /// GUID bytes are stored in little-endian in the wire format;
+        /// verify get_guid() reconstructs the original UUID correctly.
+        #[test]
+        fn get_guid_round_trip() {
+            let expected = uuid!("c476f1eb-0123-45a5-9641-b4e7dde5bfe3");
+            let mut op = base_op();
+            op.guid = expected.to_bytes_le();
+            assert_eq!(op.get_guid(), expected);
+        }
+    }
+
+    mod guid_table {
+        use super::*;
+
+        /// Verify the serialized wire format for a single-entry GuidTable:
+        /// header GUID, total length, entry count, per-entry GUID, offset,
+        /// size, and trailing payload must all appear at the correct byte
+        /// positions.
+        #[test]
+        fn single_entry_wire_format() {
+            let guid = uuid!("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
+            let payload = vec![0x01, 0x02, 0x03, 0x04];
+
+            let mut table = GuidTable::new();
+            table.push(guid, payload.clone());
+
+            let data = table.to_vec().unwrap();
+            assert_eq!(data.len(), 48 + payload.len());
+
+            let entry_count = u32::from_le_bytes(data[20..24].try_into().unwrap());
+            assert_eq!(entry_count, 1);
+
+            assert_eq!(&data[24..40], &guid.to_bytes_le());
+            let entry_offset = u32::from_le_bytes(data[40..44].try_into().unwrap());
+            assert_eq!(entry_offset, 48);
+            let entry_size = u32::from_le_bytes(data[44..48].try_into().unwrap());
+            assert_eq!(entry_size as usize, payload.len());
+
+            assert_eq!(&data[48..], &payload);
+        }
+
+        /// With two entries the payload offsets must account for the larger
+        /// header. This catches off-by-one errors in the offset arithmetic.
+        #[test]
+        fn multiple_entries_offset_arithmetic() {
+            let guid1 = uuid!("11111111-1111-1111-1111-111111111111");
+            let guid2 = uuid!("22222222-2222-2222-2222-222222222222");
+            let payload1 = vec![0xaa; 10];
+            let payload2 = vec![0xbb; 20];
+
+            let mut table = GuidTable::new();
+            table.push(guid1, payload1.clone());
+            table.push(guid2, payload2.clone());
+
+            let data = table.to_vec().unwrap();
+            assert_eq!(data.len(), 72 + 30);
+
+            let entry_count = u32::from_le_bytes(data[20..24].try_into().unwrap());
+            assert_eq!(entry_count, 2);
+
+            let offset1 = u32::from_le_bytes(data[40..44].try_into().unwrap());
+            assert_eq!(offset1, 72);
+            let offset2 = u32::from_le_bytes(data[64..68].try_into().unwrap());
+            assert_eq!(offset2, 82);
+
+            assert_eq!(&data[72..82], &payload1);
+            assert_eq!(&data[82..102], &payload2);
+        }
+    }
+
+    mod protocol_routing {
+        use super::*;
+
+        /// The protocol handler must reject unknown request codes with
+        /// UNSUPPORTED_PROTOCOL to prevent silent misrouting.
+        #[test]
+        fn rejects_unknown_request() {
+            let mut params = RequestParams::default();
+            let err = attest_protocol_request(99, &mut params).unwrap_err();
+            assert!(is_unsupported_protocol(&err));
+        }
+    }
+}