Repository navigation
ci: run KVM selftests after x86 SH kernel builds - #6314
Merged
JackThomson2 merged 2 commits intoNov 4, 2026
Merged
JackThomson2 merged 2 commits into
JackThomson2 merged 2 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## feature/secret-hiding #6314 +/- ##
======================================================
Coverage 81.63% 81.63%
======================================================
Files 282 282
Lines 33619 33619
======================================================
Hits 27446 27446
Misses 6173 6173
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
JackThomson2
force-pushed
the
sh/kvm-selftests-nested-x86
branch
2 times, most recently
from
October 20, 2026 14:13
e78859b to
471fffb
Compare
zulinx86
force-pushed
the
feature/secret-hiding
branch
from
October 23, 2026 14:44
04f1748 to
01fc1a9
Compare
JackThomson2
force-pushed
the
sh/kvm-selftests-nested-x86
branch
from
October 28, 2026 12:46
471fffb to
2a51467
Compare
The secret hiding build job only checked that the patched kernels compile. On x86 it now also boots the freshly built bzImage under nested KVM with virtme-ng, reusing the dev container's root filesystem read-only, and runs every KVM selftest installed from the same patched tree. arm64 stays build-only. The x86 job runs on the m6i.metal agents tagged os=al2023 and kv=linux_6.1_nested, which have kvm_intel nested=1 set; the job only checks for it and never reboots or reconfigures the agent. The per-arch helper applies one platform to both architectures, so each variant gets an x86 build-and-test group on those agents and an arm64 build-only group on the default agents with the default timeout. run_kselftest.sh exits 0 even when tests fail, so the guest writes its TAP output to a writable 9p directory and the host checks it against the installed test list: any not-ok result, missing result, all-skipped run, bail-out or kernel panic fails the job, while hardware-dependent skips are allowed. The TAP goes to a file rather than the console because virtme relays guest stdout and stderr separately and the lines can interleave. The per-test timeout is raised to 600s with -o because the kselftest default of 120s is too tight for the slower tests under nested virtualization. Verified in the dev container against both variants: 6.18-amazon-linux passes with 70 tests passed and 22 skipped, and 6.18-secret-hiding is correctly reported as failing on guest_memfd_test. Signed-off-by: Jack Thomson <jackabt@amazon.com>
JackThomson2
force-pushed
the
sh/kvm-selftests-nested-x86
branch
from
October 28, 2026 12:55
2a51467 to
bce0ec8
Compare
JackThomson2
marked this pull request as ready for review
October 28, 2026 13:12
zulinx86
self-requested a review
October 30, 2026 14:55
zulinx86
approved these changes
Oct 30, 2026
zulinx86
left a comment
zulinx86
left a comment
Contributor
There was a problem hiding this comment.
LGTM. although I left small nits, they are not blockers.
| # | ||
| # Boot a freshly built kernel tree under nested KVM with virtme-ng and run every | ||
| # KVM selftest installed from that same tree. The host must already allow | ||
| # nested VMX (kvm_intel nested=1); the Buildkite agent is never rebooted. |
Contributor
There was a problem hiding this comment.
nit: "the Buildkite agent" is just a process.
Suggested change
| # nested VMX (kvm_intel nested=1); the Buildkite agent is never rebooted. | |
| # nested VMX (kvm_intel nested=1); this script only checks for it and never | |
| # reloads kvm_intel or reboots the host. |
Comment on lines
+79
to
+80
| `kvm_selftests.config`, boots the freshly built `bzImage` with | ||
| [virtme-ng](https://github.com/arighi/virtme-ng) under nested KVM, and runs |
Contributor
There was a problem hiding this comment.
nit: "under nested KVM" sounds a bit ambiguous to me. The nested guest is a VM launched for kernel selftests, but the VM booted with the built bzImage is L1 guest (non-nested).
Suggested change
| `kvm_selftests.config`, boots the freshly built `bzImage` with | |
| [virtme-ng](https://github.com/arighi/virtme-ng) under nested KVM, and runs | |
| [virtme-ng](https://github.com/arighi/virtme-ng) as a KVM guest, and runs |
| trap 'rm -rf "$STAGE"' EXIT | ||
|
|
||
| make -C "$KERNEL" headers >"$RESULTS/build.log" 2>&1 | ||
| make -C "$KERNEL/tools/testing/selftests" TARGETS=kvm SKIP_TARGETS= FORCE_TARGETS=1 \ |
Contributor
There was a problem hiding this comment.
why is SKIP_TARGETS= needed?
JamesC1305
self-requested a review
November 2, 2026 17:05
JamesC1305
reviewed
Nov 3, 2026
Comment on lines
151
to
156
| pipeline.build_group_per_arch( | ||
| f"🕵️ Build Secret Hiding Kernel [{variant}]", | ||
| pipeline.devtool_test( | ||
| pytest_opts=( | ||
| "-m secret_hiding " | ||
| f'-k "test_build_hiding_kernel[{variant}]" ' | ||
| "integration_tests/build/test_hiding_kernel.py" | ||
| ), | ||
| ), | ||
| hiding_kernel_test, | ||
| instances=["m7g.metal"], | ||
| depends_on_build=False, | ||
| ) |
Contributor
There was a problem hiding this comment.
Why do we not do run self-tests on ARM? Is there a reason preventing it?
Contributor
Author
There was a problem hiding this comment.
We don't have a NV ARM host at the moment
JamesC1305
approved these changes
Nov 4, 2026
Contributor
Author
|
Doing a bypass merge as the tests are expected to fail here. |
JackThomson2
merged commit Nov 4, 2026
abc6e00
into
firecracker-microvm:feature/secret-hiding
6 of 8 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Creating a script to build and install a modified kernel with patches
applied.
Signed-off-by: Jack Thomson jackabt@amazon.com## Changes
...
Reason
...
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.PR Checklist
tools/devtool checkbuild --allto verify that the PR passesbuild checks on all supported architectures.
tools/devtool checkstyle --no-clippyto verify that the PRpasses the automated style checks.
how they are solving the problem in a clear and encompassing way.
in the PR.
CHANGELOG.md.Runbook for Firecracker API changes.
integration tests.
TODO.rust-vmm.