tests: enable KVM SEV-SNP confidential VM integration tests

Bring the confidential VM (CVM) integration tests up on the KVM SEV-SNP
backend in addition to MSHV. On KVM the IGVM is an Oak stage0 firmware
image and the guest kernel is supplied separately: stage0 reads the
kernel, cmdline and E820 over fw_cfg. The test harness selects this
model when a guest kernel is present at /igvm_files/bzImage, mirroring
how the stage0 IGVM is discovered; MSHV keeps using the monolithic IGVM
with the kernel baked in.

  - test_infra: stage0 + direct-kernel + fw_cfg boot wiring (both the
    command line and the HTTP/D-Bus API path) plus an on_kvm_sev_snp()
    helper for tests to branch on.
  - tests: the CVM tests that don't work on the KVM SEV-SNP path yet are
    gated with #[cfg(not(feature = "kvm"))] inside the common_cvm module.
    The MSHV build enables mshv,igvm,sev_snp (no kvm feature) while the
    KVM build enables kvm,igvm,sev_snp,fw_cfg, so the cfg compiles these
    tests into the MSHV binary only and drops them on KVM; both
    hypervisors run the single common_cvm nextest profile. They all still
    run on MSHV:
      * test_pci_multiple_segments - stage0 places all 64-bit BARs in a
        single global window, so a BAR allocated in a different
        per-segment window is relocated cross-window and wedges boot.
      * test_dmi_uuid / test_dmi_oem_strings /
        test_dmi_system_and_chassis - SMBIOS is not delivered to SEV-SNP
        guests on the KVM stage0 boot path, so the guest's DMI tables
        read empty. VMM follow-up.
      * test_vdpa_block - needs host vdpa_sim_blk setup, and vDPA DMA
        into SEV-SNP-encrypted memory is unsupported (the guest hangs).

Assisted-by: Claude:Opus-4.8
Signed-off-by: Ruben Hakobyan <hruben@meta.com>

cloud-hypervisor/tests/common/tests_wrappers.rs

@@ -2547,7 +2547,7 @@ pub(crate) fn _test_direct_kernel_boot_noacpi(guest: &Guest) {
         guest.wait_vm_boot().unwrap();
 
         assert_eq!(guest.get_cpu_count().unwrap_or_default(), 1);
-        assert!(guest.get_total_memory().unwrap_or_default() > 480_000);
+        guest.validate_memory(None);
     });
 
     kill_child(&mut child);
@@ -2650,10 +2650,16 @@ pub(crate) fn _test_memory_overhead(guest: &Guest, guest_memory_size_kb: u32) {
 
     guest.wait_vm_boot().unwrap();
 
+    let max_overhead = if on_kvm_sev_snp() {
+        MAXIMUM_VMM_OVERHEAD_KB_SEV_SNP
+    } else {
+        MAXIMUM_VMM_OVERHEAD_KB
+    };
+
     let r = std::panic::catch_unwind(|| {
         let overhead = get_vmm_overhead(child.id(), guest_memory_size_kb);
-        eprintln!("Guest memory overhead: {overhead} vs {MAXIMUM_VMM_OVERHEAD_KB}");
-        assert!(overhead <= MAXIMUM_VMM_OVERHEAD_KB);
+        eprintln!("Guest memory overhead: {overhead} vs {max_overhead}");
+        assert!(overhead <= max_overhead);
     });
 
     kill_child(&mut child);

cloud-hypervisor/tests/common/utils.rs

@@ -23,6 +23,8 @@ use wait_timeout::ChildExt;
 const QCOW2_INCOMPATIBLE_FEATURES_OFFSET: u64 = 72;
 // 10MB is our maximum accepted overhead.
 pub(crate) const MAXIMUM_VMM_OVERHEAD_KB: u32 = 10 * 1024;
+// The KVM SEV-SNP build (igvm+sev_snp+fw_cfg) has a larger size
+pub(crate) const MAXIMUM_VMM_OVERHEAD_KB_SEV_SNP: u32 = 12 * 1024;
 
 // This enum exists to make it more convenient to
 // implement test for both D-Bus and REST APIs.

cloud-hypervisor/tests/integration_cvm.rs

@@ -98,6 +98,7 @@ mod common_cvm {
     }
 
     #[test]
+    #[cfg(not(feature = "kvm"))]
     fn test_pci_multiple_segments() {
         // Use 8 segments to test the multiple segment support since it's more than the default 6
         //  supported by Linux
@@ -208,18 +209,21 @@ mod common_cvm {
     }
 
     #[test]
+    #[cfg(not(feature = "kvm"))]
     fn test_dmi_uuid() {
         let guest = basic_cvm_guest!(JAMMY_IMAGE_NAME);
         _test_dmi_uuid(&guest);
     }
 
     #[test]
+    #[cfg(not(feature = "kvm"))]
     fn test_dmi_oem_strings() {
         let guest = basic_cvm_guest!(JAMMY_IMAGE_NAME);
         _test_dmi_oem_strings(&guest);
     }
 
     #[test]
+    #[cfg(not(feature = "kvm"))]
     fn test_dmi_system_and_chassis() {
         let guest = basic_cvm_guest!(JAMMY_IMAGE_NAME);
         _test_dmi_system_and_chassis(&guest);
@@ -324,6 +328,7 @@ mod common_cvm {
     }
 
     #[test]
+    #[cfg(not(feature = "kvm"))]
     fn test_vdpa_block() {
         assert!(exec_host_command_status("lsmod | grep vdpa_sim_blk").success());