[Do not merge] test kernel by tiala · Pull Request #3350 · microsoft/openvmm

tiala · 2026-04-21T21:26:56Z

No description provided.

Copilot

Pull request overview

This PR adds PKCS#7 authenticated-variable verification fixtures and unit tests for the UEFI NVRAM spec services codepath, and bumps the OpenHCL kernel version used by flowey pipelines.

Changes:

Added DER fixtures + documentation for regenerating PKCS#7 auth-var test inputs.
Added unit tests for authenticate_variable covering success, tampering, and empty trust store cases.
Updated flowey’s configured OpenHCL kernel dev/stable versions.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vm/devices/firmware/firmware_uefi/src/service/nvram/spec_services/test_data/auth_var_pkcs7.der	Adds PKCS#7 detached signature fixture for auth-var verification tests
vm/devices/firmware/firmware_uefi/src/service/nvram/spec_services/test_data/auth_var_cert.der	Adds X.509 certificate fixture used to build the trust store in tests
vm/devices/firmware/firmware_uefi/src/service/nvram/spec_services/test_data/README.md	Documents what the fixtures represent and how to regenerate them
vm/devices/firmware/firmware_uefi/src/service/nvram/spec_services/auth_var_crypto.rs	Adds unit tests exercising PKCS#7 verification behavior
flowey/flowey_lib_hvlite/src/_jobs/cfg_versions.rs	Bumps configured OpenHCL kernel versions for CI/pipelines

Copilot · 2026-04-21T21:30:15Z

+    use uefi_specs::uefi::time::EFI_TIME;
+
+    // Fixtures generated by the openssl CLI against a throwaway RSA key.
+    // See the module's test source for the generation recipe.


The comment says to "See the module's test source for the generation recipe", but the actual regeneration instructions live in test_data/README.md (added in this PR). Consider updating the comment to point at that README so future updates don’t miss the correct source of truth.

Suggested change

// See the module's test source for the generation recipe.

// See test_data/README.md for the generation recipe.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

github-actions · 2026-04-21T23:08:36Z

12 Petri tests failed (0 unstable)

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

github-actions · 2026-04-22T10:01:18Z

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

github-actions · 2026-04-22T15:18:42Z

12 Petri tests failed (0 unstable)

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

Copilot · 2026-04-24T03:45:40Z

            "image": {
                "openhcl": {
-                    "command_line": "",
+                    "command_line": "OPENHCL_CONFIDENTIAL_DEBUG=1",


This is the release CVM manifest, but it now sets OPENHCL_CONFIDENTIAL_DEBUG=1 on the OpenHCL command line. That debug mode is likely security-sensitive for confidential guests and can unintentionally ship in release IGVMs. Please keep the release manifest’s command line free of confidential-debug settings (or move this to the openhcl-x64-cvm-dev.json manifest / a dedicated test-only manifest).

Copilot · 2026-04-24T03:45:41Z

            "isolation_type": {
                "tdx": {
-                    "enable_debug": false,
+                    "enable_debug": true,


enable_debug is being turned on for the TDX configuration in a release manifest. Enabling debug for confidential VM isolation weakens the security posture and can change attestation/debug policy expectations. Please keep enable_debug: false in release and only enable it in dev/test manifests/recipes.

Suggested change

"enable_debug": true,

"enable_debug": false,

Copilot · 2026-04-24T03:45:41Z

            "image": {
                "openhcl": {
-                    "command_line": "",
+                    "command_line": "OPENHCL_CONFIDENTIAL_DEBUG=1",


This second OpenHCL image entry in the release CVM manifest also sets OPENHCL_CONFIDENTIAL_DEBUG=1. If this is only needed for debugging a test kernel, it should not live in the release recipe manifest; consider using the dev manifest or a local-only/custom manifest path instead.

Suggested change

"command_line": "OPENHCL_CONFIDENTIAL_DEBUG=1",

"command_line": "",

Copilot · 2026-04-24T03:45:41Z

-pub const OPENHCL_KERNEL_DEV_VERSION: &str = "6.12.52.12";
-pub const OPENHCL_KERNEL_STABLE_VERSION: &str = "6.12.52.11";
+pub const OPENHCL_KERNEL_DEV_VERSION: &str = "6.18.0.16";
+pub const OPENHCL_KERNEL_STABLE_VERSION: &str = "6.18.0.16";


Both OPENHCL_KERNEL_DEV_VERSION and OPENHCL_KERNEL_STABLE_VERSION are being updated to the same value. Since OPENHCL_KERNEL_STABLE_VERSION feeds the default Main/Cvm kernel downloads for release recipes, this changes the kernel used by stable pipelines as well. If this PR is only for validating a test kernel, please avoid updating the stable version here (or use the existing LocalKernel override / a dev-only version bump) to prevent impacting non-test builds.

Suggested change

pub const OPENHCL_KERNEL_STABLE_VERSION: &str = "6.18.0.16";

pub const OPENHCL_KERNEL_STABLE_VERSION: &str = "6.18.0.15";

github-actions · 2026-04-24T04:52:53Z

19 Petri tests failed (0 unstable)

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot · 2026-04-24T07:40:08Z

                "openhcl": {
-                    "command_line": "",
+                    "command_line": "OPENHCL_CONFIDENTIAL_DEBUG=1",
                    "memory_page_count": 163840,
                    "memory_page_base": 32768,
                    "uefi": true


This is the release CVM manifest, but it now forces OPENHCL_CONFIDENTIAL_DEBUG=1 on the OpenHCL command line. That disables confidential filtering and can cause sensitive diagnostic output to be emitted in environments that expect release-grade confidentiality defaults. If this is only for testing, it should not be in the *-release.json manifest (use the dev manifest or a dedicated test manifest instead).

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot · 2026-04-24T08:59:09Z

                    "policy": 196639,
                    "enable_debug": true,
                    "injection_type": "restricted",
-                    "secure_avic": "enabled"
+                    "secure_avic": "disabled"


In this manifest the SNP injection_type is restricted and max_vtl is 0 (no paravisor), which means secure_avic is not consulted when building the VMSA (it’s only applied for injection_type=normal at VTL0 in SnpHardwareContext). Flipping this from enabled to disabled therefore has no effect and can be misleading; consider removing the field (letting the default apply) or aligning the setting with a combination that actually affects generation.

github-actions · 2026-04-24T10:46:56Z

1 Petri tests failed (1 unstable)

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot · 2026-04-24T13:25:00Z

        // Fill in boilerplate fields of the vmsa
        vmsa.sev_features.set_snp(true);
        vmsa.sev_features.set_vtom(true);
+	vmsa.sev_features.set_secure_avic(true);


Line is indented with a tab, which is inconsistent with the surrounding spaces and will cause a formatting diff/CI fmt failure unless rustfmt is run. Replace the tab with the standard indentation used in this file (or rerun cargo xtask fmt --fix).

Suggested change

vmsa.sev_features.set_secure_avic(true);

vmsa.sev_features.set_secure_avic(true);

Copilot AI review requested due to automatic review settings April 21, 2026 21:26

Copilot started reviewing on behalf of tiala April 21, 2026 21:27 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

tiala force-pushed the test branch from e987c31 to cb3fa33 Compare April 21, 2026 21:32

tiala marked this pull request as ready for review April 21, 2026 21:33

tiala requested a review from a team as a code owner April 21, 2026 21:33

Copilot AI review requested due to automatic review settings April 21, 2026 21:33

Copilot started reviewing on behalf of tiala April 21, 2026 21:33 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

tiala force-pushed the test branch from cb3fa33 to 84336a4 Compare April 22, 2026 08:50

Copilot AI review requested due to automatic review settings April 22, 2026 10:00

tiala force-pushed the test branch from 84336a4 to 08d698b Compare April 22, 2026 10:00

tiala requested review from a team as code owners April 22, 2026 10:00

Copilot AI reviewed Apr 22, 2026

View reviewed changes

github-actions Bot added Guide unsafe Related to unsafe code labels Apr 22, 2026

tiala force-pushed the test branch from 08d698b to 51b76d1 Compare April 22, 2026 10:19

github-actions Bot removed the unsafe Related to unsafe code label Apr 22, 2026

Copilot AI review requested due to automatic review settings April 24, 2026 03:43

tiala force-pushed the test branch from 51b76d1 to 25aea7a Compare April 24, 2026 03:43

Copilot started reviewing on behalf of tiala April 24, 2026 03:43 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

tiala force-pushed the test branch 2 times, most recently from 4bbebb5 to 73de764 Compare April 24, 2026 07:05

Copilot AI review requested due to automatic review settings April 24, 2026 07:37

Copilot started reviewing on behalf of tiala April 24, 2026 07:37 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

tiala force-pushed the test branch from ef8d616 to 48d969b Compare April 24, 2026 07:47

Copilot AI review requested due to automatic review settings April 24, 2026 07:53

Copilot started reviewing on behalf of tiala April 24, 2026 07:53 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

tiala force-pushed the test branch from f22f089 to 7b027f9 Compare April 24, 2026 08:09

Copilot AI review requested due to automatic review settings April 24, 2026 08:56

tiala force-pushed the test branch from 7b027f9 to bbd1b84 Compare April 24, 2026 08:56

Copilot started reviewing on behalf of tiala April 24, 2026 08:56 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

tiala force-pushed the test branch from bbd1b84 to 2f487ae Compare April 24, 2026 09:36

tiala added 2 commits April 24, 2026 09:17

Enable Secure AVIC

97bf7db

savic test

443c01b

Copilot AI review requested due to automatic review settings April 24, 2026 13:20

tiala force-pushed the test branch from 2f487ae to 443c01b Compare April 24, 2026 13:20

Copilot started reviewing on behalf of tiala April 24, 2026 13:21 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

	// See the module's test source for the generation recipe.
	// See test_data/README.md for the generation recipe.

	"command_line": "OPENHCL_CONFIDENTIAL_DEBUG=1",
	"command_line": "",

	pub const OPENHCL_KERNEL_STABLE_VERSION: &str = "6.18.0.16";
	pub const OPENHCL_KERNEL_STABLE_VERSION: &str = "6.18.0.15";

	vmsa.sev_features.set_secure_avic(true);
	vmsa.sev_features.set_secure_avic(true);

Conversation

tiala commented Apr 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 22, 2026

Uh oh!

github-actions Bot commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants