Add hypercall_filter.py test under host_sb for 9.0

Author: CocoElAbricot

tests/host_sb/__init__.py

@@ -0,0 +1,38 @@
+import logging
+import pathlib
+from unittest import result
+
+import pytest
+
+from lib.host import Host
+
+log = logging.getLogger(__name__)
+
+# Requirements:
+# - one XCP-ng host (--host) >= 9.0
+# - Host Secureboot enforcement must be enabled
+
+def test_hypercall_filter(host: Host):
+    """
+    Verify the Xen privcmd hypercall filter.
+
+    The helper binary performs a collection of safe hypercalls and verifies
+    that:
+      * allowed read-only hypercalls succeed
+      * invalid guest pointers are rejected with -EFAULT
+      * forbidden operations are rejected by the filter
+      * unknown operations return the expected error
+
+    The helper exits with status 0 iff every check passes.
+    """
+
+    local_binary = pathlib.Path(__file__).parent / "data" / "test_hypercall_filter"
+
+    remote_binary = "/tmp/test_hypercall_filter"
+
+    host.scp(str(local_binary), remote_binary)
+    host.ssh(f"chmod +x {remote_binary}")
+    host.ssh(remote_binary)
+
+    result = host.ssh_with_result(remote_binary)
+    assert result.returncode == 0, result.stdout