|
| 1 | +# Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 2 | +# SPDX-License-Identifier: Apache-2.0 |
| 3 | +"""Test secret-freedom related functionality.""" |
| 4 | + |
| 5 | +import pytest |
| 6 | + |
| 7 | +from framework import defs |
| 8 | +from framework.microvm import Serial |
| 9 | +from framework.properties import global_props |
| 10 | +from integration_tests.performance.test_initrd import INITRD_FILESYSTEM |
| 11 | + |
| 12 | +pytestmark = [ |
| 13 | + pytest.mark.skipif( |
| 14 | + global_props.host_linux_version_metrics != "next", |
| 15 | + reason="Secret Freedom is only supported on the in-dev upstream kernels for now", |
| 16 | + ), |
| 17 | + pytest.mark.skipif( |
| 18 | + global_props.instance == "m6g.metal", |
| 19 | + reason="Secret Freedom currently only works on ARM hardware conforming to at least ARMv8.4 as absense of ARM64_HAS_STAGE2_FWB causes kernel panics because of dcache flushing during stage2 page table entry installation", |
| 20 | + ), |
| 21 | +] |
| 22 | + |
| 23 | + |
| 24 | +def test_secret_free_boot(microvm_factory, guest_kernel, rootfs): |
| 25 | + """Tests that a VM can boot, e.g. some basic I/O works through userspace bounce buffers""" |
| 26 | + vm = microvm_factory.build(guest_kernel, rootfs) |
| 27 | + vm.spawn() |
| 28 | + vm.memory_monitor = None |
| 29 | + vm.basic_config(secret_free=True) |
| 30 | + vm.add_net_iface() |
| 31 | + vm.start() |
| 32 | + |
| 33 | + |
| 34 | +def test_secret_free_initrd(microvm_factory, guest_kernel): |
| 35 | + """ |
| 36 | + Test that we can boot a secret hidden initrd (e.g. a VM with no I/O devices) |
| 37 | + """ |
| 38 | + fs = defs.ARTIFACT_DIR / "initramfs.cpio" |
| 39 | + uvm = microvm_factory.build(guest_kernel) |
| 40 | + uvm.initrd_file = fs |
| 41 | + uvm.help.enable_console() |
| 42 | + uvm.spawn() |
| 43 | + uvm.memory_monitor = None |
| 44 | + |
| 45 | + uvm.basic_config( |
| 46 | + add_root_device=False, |
| 47 | + vcpu_count=1, |
| 48 | + boot_args="console=ttyS0 reboot=k panic=1 pci=off", |
| 49 | + use_initrd=True, |
| 50 | + secret_free=True, |
| 51 | + ) |
| 52 | + |
| 53 | + uvm.start() |
| 54 | + serial = Serial(uvm) |
| 55 | + serial.open() |
| 56 | + serial.rx(token="# ") |
| 57 | + serial.tx("mount |grep rootfs") |
| 58 | + serial.rx(token=f"rootfs on / type {INITRD_FILESYSTEM}") |
| 59 | + |
| 60 | + |
| 61 | +def test_secret_free_snapshot_creation(microvm_factory, guest_kernel, rootfs): |
| 62 | + """Test that snapshot creation works for secret hidden VMs""" |
| 63 | + vm = microvm_factory.build(guest_kernel, rootfs) |
| 64 | + vm.spawn() |
| 65 | + vm.memory_monitor = None |
| 66 | + vm.basic_config(secret_free=True) |
| 67 | + vm.add_net_iface() |
| 68 | + vm.start() |
| 69 | + |
| 70 | + snapshot = vm.snapshot_full() |
| 71 | + |
| 72 | + # After restoration, the VM will not be secret hidden anymore, as that's not supported yet. |
| 73 | + # But we can at least test that in principle, the snapshot creation worked. |
| 74 | + vm = microvm_factory.build_from_snapshot(snapshot) |
| 75 | + vm.ssh.check_output("true") |
0 commit comments