Skip to content

Commit 92a2b78

Browse files
committed
test: add functional tests for booting secret free VMs
Add a test that we can boot VMs and initrds with secret freedom enabled. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
1 parent b8c1f7b commit 92a2b78

File tree

1 file changed

+75
-0
lines changed

1 file changed

+75
-0
lines changed
Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
"""Test secret-freedom related functionality."""
4+
5+
import pytest
6+
7+
from framework import defs
8+
from framework.microvm import Serial
9+
from framework.properties import global_props
10+
from integration_tests.performance.test_initrd import INITRD_FILESYSTEM
11+
12+
pytestmark = [
13+
pytest.mark.skipif(
14+
global_props.host_linux_version_metrics != "next",
15+
reason="Secret Freedom is only supported on the in-dev upstream kernels for now",
16+
),
17+
pytest.mark.skipif(
18+
global_props.instance == "m6g.metal",
19+
reason="Secret Freedom currently only works on ARM hardware conforming to at least ARMv8.4 as absense of ARM64_HAS_STAGE2_FWB causes kernel panics because of dcache flushing during stage2 page table entry installation",
20+
),
21+
]
22+
23+
24+
def test_secret_free_boot(microvm_factory, guest_kernel, rootfs):
25+
"""Tests that a VM can boot, e.g. some basic I/O works through userspace bounce buffers"""
26+
vm = microvm_factory.build(guest_kernel, rootfs)
27+
vm.spawn()
28+
vm.memory_monitor = None
29+
vm.basic_config(secret_free=True)
30+
vm.add_net_iface()
31+
vm.start()
32+
33+
34+
def test_secret_free_initrd(microvm_factory, guest_kernel):
35+
"""
36+
Test that we can boot a secret hidden initrd (e.g. a VM with no I/O devices)
37+
"""
38+
fs = defs.ARTIFACT_DIR / "initramfs.cpio"
39+
uvm = microvm_factory.build(guest_kernel)
40+
uvm.initrd_file = fs
41+
uvm.help.enable_console()
42+
uvm.spawn()
43+
uvm.memory_monitor = None
44+
45+
uvm.basic_config(
46+
add_root_device=False,
47+
vcpu_count=1,
48+
boot_args="console=ttyS0 reboot=k panic=1 pci=off",
49+
use_initrd=True,
50+
secret_free=True,
51+
)
52+
53+
uvm.start()
54+
serial = Serial(uvm)
55+
serial.open()
56+
serial.rx(token="# ")
57+
serial.tx("mount |grep rootfs")
58+
serial.rx(token=f"rootfs on / type {INITRD_FILESYSTEM}")
59+
60+
61+
def test_secret_free_snapshot_creation(microvm_factory, guest_kernel, rootfs):
62+
"""Test that snapshot creation works for secret hidden VMs"""
63+
vm = microvm_factory.build(guest_kernel, rootfs)
64+
vm.spawn()
65+
vm.memory_monitor = None
66+
vm.basic_config(secret_free=True)
67+
vm.add_net_iface()
68+
vm.start()
69+
70+
snapshot = vm.snapshot_full()
71+
72+
# After restoration, the VM will not be secret hidden anymore, as that's not supported yet.
73+
# But we can at least test that in principle, the snapshot creation worked.
74+
vm = microvm_factory.build_from_snapshot(snapshot)
75+
vm.ssh.check_output("true")

0 commit comments

Comments
 (0)