github/qemu: run dmesg #95
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: qemu | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # IGVM C wrapper might require a different Rust version than SVSM | |
| RUST_VERSION_IGVM: 1.84.1 | |
| QEMU_REPO: https://github.com/coconut-svsm/qemu.git | |
| QEMU_REF: svsm-igvm | |
| IGVM_REPO: https://github.com/microsoft/igvm.git | |
| IGVM_REF: igvm-v0.3.4 | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| name: QEMU NOCC test-in-svsm | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - name: Query coconut-svsm/qemu repo | |
| run: | | |
| QEMU_SHA=$(git ls-remote "$QEMU_REPO" --exit-code "$QEMU_REF" | cut -f 1) | |
| echo "QEMU_SHA=${QEMU_SHA}" >> "$GITHUB_ENV" | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| submodules: true | |
| fetch-depth: 1 | |
| - name: Calculate SHA for qemu.yml | |
| run: | | |
| QEMU_YML_SHA=$(shasum .github/workflows/qemu.yml | awk '{print $1}') | |
| echo "QEMU_YML_SHA=${QEMU_YML_SHA}" >> "$GITHUB_ENV" | |
| - name: Get QEMU from cache | |
| id: qemu_cache | |
| uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 | |
| with: | |
| path: citests/qemu | |
| key: qemu-${{ env.QEMU_SHA }}--config-${{ env.QEMU_YML_SHA }} | |
| - if: ${{ steps.qemu_cache.outputs.cache-hit != 'true' }} | |
| name: Enable Ubuntu source repositories | |
| run: | | |
| sudo sed -i 's/^Types: deb/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources | |
| sudo apt-get update | |
| - if: ${{ steps.qemu_cache.outputs.cache-hit != 'true' }} | |
| name: Build QEMU | |
| run: | | |
| # Update & install dependencies | |
| sudo apt-get install --yes git curl libcunit1-dev | |
| # TODO: Find a minimal set of dependencies to install | |
| sudo apt-get build-dep --yes qemu | |
| OUT="$PWD/citests/qemu" | |
| mkdir -p "$OUT" | |
| # Set up a build directory outside the coconut-svsm checkout | |
| mkdir -p ../scratch | |
| pushd ../scratch | |
| # Build IGVM | |
| git clone "${{ env.IGVM_REPO }}" \ | |
| --branch="${{ env.IGVM_REF }}" \ | |
| --depth=1 | |
| pushd igvm | |
| # Installing Rust toolchain and tools from within this workflow step in in the | |
| # igvm checkout directory to avoid interference of the coconut-svsm rust-toolchain.toml, | |
| # which might override versions and target settings. | |
| rustup toolchain install "${{ env.RUST_VERSION_IGVM }}" --target x86_64-unknown-linux-gnu --profile minimal | |
| # Currently needed for the C wrapper of IGVM | |
| cargo install cbindgen | |
| PREFIX="$OUT" make -C igvm_c | |
| PREFIX="$OUT" make -C igvm_c install | |
| popd | |
| # Build Qmeu | |
| git clone "${{ env.QEMU_REPO }}" \ | |
| --branch="${{ env.QEMU_REF }}" \ | |
| --depth=1 | |
| pushd qemu | |
| PKG_CONFIG_PATH="$OUT/lib64/pkgconfig" ./configure \ | |
| --target-list=x86_64-softmmu \ | |
| --enable-igvm --extra-ldflags=-L"$OUT/lib64" \ | |
| --extra-cflags=-I"$OUT/include" \ | |
| --enable-tcg \ | |
| --enable-kvm \ | |
| --enable-slirp \ | |
| --enable-strip \ | |
| --enable-vhost-kernel \ | |
| --static \ | |
| --disable-docs \ | |
| --disable-user \ | |
| --without-default-features \ | |
| --prefix="$OUT" | |
| make -j "$(nproc)" install | |
| popd | |
| popd | |
| ## TODO: We can replace the SVSM build step and download the IGVM file as an artifact | |
| # from the "Rust check" jobs instread to speed things up. | |
| - name: Install latest nightly | |
| run: rustup toolchain install nightly -t x86_64-unknown-none --profile minimal --force -c rustfmt | |
| - name: Install TPM 2.0 Reference Implementation build dependencies | |
| run: sudo apt install -y build-essential cmake pkg-config | |
| - name: Install netcat used by test-in-svsm for vsock tests | |
| run: sudo apt install -y ncat | |
| - name: Set up vhost-vsock permissions | |
| run: sudo chmod 666 /dev/vhost-vsock | |
| - name: Build test | |
| run: make bin/coconut-test-qemu.igvm | |
| ######################## | |
| - name: Enable KVM diagnostic logging | |
| run: | | |
| echo Y | sudo tee /sys/module/kvm_amd/parameters/dump_invalid_vmcb || true | |
| echo Y | sudo tee /sys/module/kvm_intel/parameters/dump_invalid_vmcs || true | |
| - name: Run test-in-svsm in QEMU | |
| run: | | |
| # Use the pull request number for the port and the cid to avoid conflicts if two (or more) | |
| # actions run in parallel. On push-to-main events the PR number is empty, default to 0. | |
| # 1024 is the first non reserved port, 10 is an arbitrary number that should be safe enough | |
| # to avoid conflicts. | |
| PR_NUM=${{ github.event.pull_request.number }} | |
| VSOCK_PORT=$(( ${PR_NUM:-0} + 1024 )) | |
| VSOCK_CID=$(( ${PR_NUM:-0} + 10 )) | |
| QEMU=./citests/qemu/bin/qemu-system-x86_64 scripts/test-in-svsm.sh \ | |
| --vsock-port $VSOCK_PORT --vsock-cid $VSOCK_CID \ | |
| --nocc --timeout 180 \ | |
| </dev/null 2>&1 | |
| - name: Dump host kernel messages on QEMU or test failure | |
| if: failure() | |
| run: sudo dmesg | |