Run functional tests in CI (#102)

* add a functional test that retrieves secret via local attestation
* optimize tests for the limited resources available in CI
* add a functional test that runs a confidential VM with multiple vCPUs

---------

Signed-off-by: Wojciech Ozga <[email protected]>
Co-authored-by: Lennard Gäher <[email protected]>

Author: wojciechozga

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-name: ACE Build
+name: Functional tests
 
 on:
   push:
@@ -10,7 +10,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: 'true'
     - name: install build dependencies
@@ -32,14 +32,18 @@ jobs:
     - name: install rust nightly
       run: rustup component add rustfmt
     - name: build riscv toolchain
-      run: ACE_DIR=$(pwd)/build/ MAKEFLAGS="--silent -j4" make devtools
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8 devtools
     - name: build emulator
-      run: ACE_DIR=$(pwd)/build/ MAKEFLAGS="--silent -j4" make emulator
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8 emulator
     - name: build tools
-      run: ACE_DIR=$(pwd)/build/ MAKEFLAGS="--silent -j4" make tools
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8 tools
     - name: build hypervisor
-      run: ACE_DIR=$(pwd)/build/ MAKEFLAGS="--silent -j4" make hypervisor
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8 hypervisor
     - name: build firmware
-      run: ACE_DIR=$(pwd)/build/ MAKEFLAGS="--silent -j4" make firmware
-    - name: build confidential_vms
-      run: ACE_DIR=$(pwd)/build/ MAKEFLAGS="--silent -j4" make confidential_vms
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8 firmware
+    - name: build confidential vms
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8 confidential_vms
+    - name: rebuild all to include changes to cvm disk
+      run: ACE_DIR=$(pwd)/build/ make --silent -j8
+    - name: run tests on confidential vms
+      run: ACE_DIR=$(pwd)/build/ PATH=$PATH:$(pwd)/build/tools ace test

confidential-vms/linux_vm/hypervisor_rootfs/run_linux_vm_qemu.sh

@@ -3,16 +3,11 @@
 # SPDX-FileContributor: Wojciech Ozga <[email protected]>, IBM Research - Zurich
 # SPDX-License-Identifier: Apache-2.0
 
-QEMU_CMD=qemu-system-riscv64
-KERNEL=/root/linux_vm/Image
-DRIVE=/root/linux_vm/rootfs.ext2
-INITRAMFS=/root/linux_vm/rootfs.cpio
-TAP=/root/linux_vm/cove_tap_qemu
-
 HOST_PORT="$((3000 + RANDOM % 3000))"
 INTERACTIVE="-nographic"
 SMP=2
 MEMORY=1G
+ID=""
 
 for i in "$@"; do
   case $i in
@@ -34,6 +29,10 @@ for i in "$@"; do
       MEMORY="${i#*=}"
       shift
       ;;
+    -i=*|--id=*)
+      ID="${i#*=}"
+      shift
+      ;;
     --daemonize*)
       INTERACTIVE="-daemonize"
       shift
@@ -47,8 +46,19 @@ for i in "$@"; do
   esac
 done
 
+if [ ! -f "/root/linux_vm${ID}" ]; then
+  cp -rf /root/linux_vm /root/linux_vm${ID}
+fi
+
+QEMU_CMD=qemu-system-riscv64
+KERNEL=/root/linux_vm${ID}/Image
+DRIVE=/root/linux_vm${ID}/rootfs.ext2
+INITRAMFS=/root/linux_vm${ID}/rootfs.cpio
+TAP=/root/linux_vm${ID}/cove_tap_qemu
+
 echo "SSH port: ${HOST_PORT}"
 echo "Number of cores assigned to the guest: ${SMP}"
+echo "${INTERACTIVE}"
 
 ${QEMU_CMD} ${DEBUG_OPTIONS} \
     ${INTERACTIVE} \
@@ -61,5 +71,4 @@ ${QEMU_CMD} ${DEBUG_OPTIONS} \
     -device virtio-blk-pci,drive=hd0,iommu_platform=on,disable-legacy=on,disable-modern=off \
     -drive if=none,format=raw,file=${DRIVE},id=hd0 \
     -device virtio-net-pci,netdev=net0,iommu_platform=on,disable-legacy=on,disable-modern=off \
-    -netdev user,id=net0,net=192.168.100.1/24,dhcpstart=192.168.100.128,hostfwd=tcp::${HOST_PORT}-:22 \
-    -nographic
+    -netdev user,id=net0,net=192.168.100.1/24,dhcpstart=192.168.100.128,hostfwd=tcp::${HOST_PORT}-:22

confidential-vms/linux_vm/hypervisor_rootfs/run_linux_vm_qemu2.sh

@@ -1 +1 @@
-hello from confidential VM's filesystem
+hello from confidential VM filesystem

confidential-vms/linux_vm/overlay/root/this_is_confidential_vm_filesystem

@@ -1 +1 @@
-hello from confidential VM's filesystem
+hello from confidential VM filesystem

confidential-vms/linux_vm/overlay/this_is_confidential_vm_filesystem

@@ -56,6 +56,8 @@ BR2_GLOBAL_PATCH_DIR=""
 
 # Packages
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_OPENSSH_CLIENT=y
+BR2_PACKAGE_SSHPASS=y
 
 # Qemu
 BR2_PACKAGE_QEMU=y

hypervisor/configurations/qemu_riscv64_virt_defconfig

@@ -2,28 +2,21 @@
 # SPDX-FileCopyrightText: 2023 IBM Corporation
 # SPDX-FileContributor: Wojciech Ozga <[email protected]>, IBM Research - Zurich
 # SPDX-License-Identifier: Apache-2.0
-
-function run_confidential_vm() {
-    fallocate -l 128M hdd.dsk
-
-    KERNEL_IMAGE=$1
-    NUMBER_OF_CORES=$2
-    MEMORY_SIZE=$3
-    DRIVE="hdd.dsk"
-
-    qemu-system-riscv64 -machine virt -cpu rv64 -smp $NUMBER_OF_CORES -m $MEMORY_SIZE \
-        --enable-kvm \
-        -global virtio-mmio.force-legacy=false \
-        -append "console=ttyS0 ro root=/dev/vda swiotlb=mmnn,force nosplash debug promote_to_tvm" \
-        -device virtio-blk-pci,drive=hd0,iommu_platform=on,disable-legacy=on,disable-modern=off \
-        -drive if=none,format=raw,file=${DRIVE},id=hd0 \
-        -nographic -bios none \
-        -kernel $KERNEL_IMAGE &
-}
+export TVM_TEST_PASSWD="passwd"
+export SSH_CMD="sshpass -p ${TVM_TEST_PASSWD} ssh -y -q"
 
 function kill_confidential_vm() {
     PID="$(pidof qemu-system-riscv64)"
     kill -9 $PID
     wait $PID 2>/dev/null
 }
 
+function wait_for_ssh () {
+    for i in $(seq 1 30); do
+        if [ "$( $SSH_CMD -p$3 $1@$2 'whoami' )" == "root" ]; then
+            break
+        fi
+        echo "Waiting for the TVM's SSH ..."
+        sleep 1
+    done
+}

hypervisor/rootfs/common.sh

@@ -5,15 +5,17 @@
 
 # This script runs all tests in harness
 
-declare -a TESTS=("test_esm")
+declare -a TESTS=("test_attestation" "test_smp")
 
 for i in "${TESTS[@]}"; do
-    ./$i.sh 2>&1 > $i.log 
+    ./$i.sh 2>&1 > $i.log
     RESULT=$?
     if [ $RESULT -eq 0 ]; then
         echo "$i: success"
     else
         echo "$i: failed"
-        cat $i.log  
+        echo ""
+        echo "======= Logs: ======="
+        cat $i.log
     fi
-done
+done

hypervisor/rootfs/selftest.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025 IBM Corporation
+# SPDX-FileContributor: Wojciech Ozga <[email protected]>, IBM Research - Zurich
+# SPDX-License-Identifier: Apache-2.0
+. common.sh
+
+/root/run_linux_vm_qemu.sh -s=1 -m=256M --daemonize 2>&1 > tmp_run_vm.log &
+sleep 5
+
+TVM_USER="root"
+TVM_HOST="localhost"
+TVM_PORT="$(grep 'SSH port' tmp_run_vm.log | awk -F': ' '{ print $2 }' )"
+echo "TVM's SSH is listening on port: $TVM_PORT"
+
+wait_for_ssh $TVM_USER $TVM_HOST $TVM_PORT
+
+$SSH_CMD -p${TVM_PORT} ${TVM_USER}@${TVM_HOST} 'insmod /root/ace_module/ace.ko'
+$SSH_CMD -p${TVM_PORT} ${TVM_USER}@${TVM_HOST} 'dmesg | grep Secret' > tmp_dmesg.log
+
+ATTESTATION_RESULT="$(grep 'Secret=0xc0ffee' tmp_dmesg.log | wc -l)"
+
+kill_confidential_vm
+sleep 5
+
+if [[ "x$ATTESTATION_RESULT" == "x1" ]]; then
+    echo "Attestation test succeeded"
+    exit 0
+else
+    echo "Attestation test failed"
+    exit 1
+fi

hypervisor/rootfs/test_attestation.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025 IBM Corporation
+# SPDX-FileContributor: Wojciech Ozga <[email protected]>, IBM Research - Zurich
+# SPDX-License-Identifier: Apache-2.0
+. common.sh
+
+/root/run_linux_vm_qemu.sh -s=2 -m=256M --daemonize 2>&1 > tmp_run_smp.log &
+sleep 5
+
+TVM_USER="root"
+TVM_HOST="localhost"
+TVM_PORT="$(grep 'SSH port' tmp_run_smp.log | awk -F': ' '{ print $2 }' )"
+echo "TVM's SSH is listening on port: $TVM_PORT"
+
+wait_for_ssh $TVM_USER $TVM_HOST $TVM_PORT
+
+$SSH_CMD -p${TVM_PORT} ${TVM_USER}@${TVM_HOST} 'cat /root/this_is_confidential_vm_filesystem' > tmp_smp_dmesg.log
+RESULT="$(grep 'hello from confidential VM filesystem' tmp_smp_dmesg.log | wc -l)"
+
+kill_confidential_vm
+sleep 5
+
+if [[ "x$RESULT" == "x1" ]]; then
+    echo "SMP test succeeded"
+    exit 0
+else
+    echo "SMP test failed"
+    exit 1
+fi