Skip to content

Update feature/secret-hiding with more recent iterations of patch series #5293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: feature/secret-hiding
Choose a base branch
from

Conversation

roypat
Copy link
Contributor

@roypat roypat commented Jul 7, 2025

Upgrade the base "mmap support for guest_memfd" series from Fuad's v4 to v12, and do all the Firecracker changes that come with it.

License Acceptance

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.

PR Checklist

  • I have read and understand CONTRIBUTING.md.
  • I have run tools/devtool checkstyle to verify that the PR passes the
    automated style checks.
  • I have described what is done in these changes, why they are needed, and
    how they are solving the problem in a clear and encompassing way.
  • I have updated any relevant documentation (both in code and in the docs)
    in the PR.
  • I have mentioned all user-facing changes in CHANGELOG.md.
  • If a specific issue led to this PR, this PR closes the issue.
  • When making API changes, I have followed the
    Runbook for Firecracker API changes.
  • I have tested all new and changed functionalities in unit tests and/or
    integration tests.
  • I have linked an issue to every new TODO.

  • This functionality cannot be added in rust-vmm.

@roypat roypat changed the base branch from main to feature/secret-hiding July 7, 2025 13:39
Copy link

codecov bot commented Jul 7, 2025

Codecov Report

Attention: Patch coverage is 40.90909% with 13 lines in your changes missing coverage. Please review.

Project coverage is 81.81%. Comparing base (26b2922) to head (c5b40a1).

Files with missing lines Patch % Lines
src/vmm/src/builder.rs 27.77% 13 Missing ⚠️
Additional details and impacted files
@@                    Coverage Diff                    @@
##           feature/secret-hiding    #5293      +/-   ##
=========================================================
- Coverage                  81.81%   81.81%   -0.01%     
=========================================================
  Files                        250      250              
  Lines                      27666    27635      -31     
=========================================================
- Hits                       22635    22609      -26     
+ Misses                      5031     5026       -5     
Flag Coverage Δ
5.10-c5n.metal 81.99% <40.90%> (+0.05%) ⬆️
5.10-m5n.metal 81.98% <40.90%> (+0.04%) ⬆️
5.10-m6a.metal 81.15% <40.90%> (+0.05%) ⬆️
5.10-m6g.metal 77.96% <40.90%> (+0.06%) ⬆️
5.10-m6i.metal 81.98% <40.90%> (+0.04%) ⬆️
5.10-m7a.metal-48xl 81.14% <40.90%> (+0.05%) ⬆️
5.10-m7g.metal 77.96% <40.90%> (+0.06%) ⬆️
5.10-m7i.metal-24xl 81.95% <40.90%> (+0.05%) ⬆️
5.10-m7i.metal-48xl 81.95% <40.90%> (+0.05%) ⬆️
5.10-m8g.metal-24xl 77.96% <40.90%> (+0.06%) ⬆️
5.10-m8g.metal-48xl 77.96% <40.90%> (+0.06%) ⬆️
6.1-c5n.metal 82.04% <40.90%> (+0.06%) ⬆️
6.1-m5n.metal 82.03% <40.90%> (+0.04%) ⬆️
6.1-m6a.metal 81.19% <40.90%> (+0.04%) ⬆️
6.1-m6g.metal 77.96% <40.90%> (+0.06%) ⬆️
6.1-m6i.metal 82.02% <40.90%> (+0.04%) ⬆️
6.1-m7a.metal-48xl 81.19% <40.90%> (+0.06%) ⬆️
6.1-m7g.metal 77.96% <40.90%> (+0.06%) ⬆️
6.1-m7i.metal-24xl 82.04% <40.90%> (+0.05%) ⬆️
6.1-m7i.metal-48xl 82.04% <40.90%> (+0.05%) ⬆️
6.1-m8g.metal-24xl 77.95% <40.90%> (+0.05%) ⬆️
6.1-m8g.metal-48xl 77.96% <40.90%> (+0.06%) ⬆️
6.14-c5n.metal ?
6.14-m5n.metal ?
6.14-m6a.metal ?
6.14-m6i.metal ?
6.14-m7a.metal-48xl ?
6.14-m7i.metal-24xl ?
6.14-m7i.metal-48xl ?
6.16-c5n.metal 82.06% <40.90%> (?)
6.16-m5n.metal 82.06% <40.90%> (?)
6.16-m6a.metal 81.22% <40.90%> (?)
6.16-m6g.metal 77.98% <40.90%> (+0.04%) ⬆️
6.16-m6i.metal 82.05% <40.90%> (?)
6.16-m7a.metal-48xl 81.21% <40.90%> (?)
6.16-m7g.metal 77.99% <40.90%> (+0.05%) ⬆️
6.16-m7i.metal-24xl 82.07% <40.90%> (?)
6.16-m7i.metal-48xl 82.07% <40.90%> (?)
6.16-m8g.metal-24xl 77.99% <40.90%> (+0.06%) ⬆️
6.16-m8g.metal-48xl 77.99% <40.90%> (+0.05%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@roypat roypat force-pushed the updated-patch-series branch 3 times, most recently from 6441b62 to a33921e Compare July 7, 2025 15:14
@@ -531,18 +526,12 @@ pub fn build_microvm_from_snapshot(
params: &LoadSnapshotParams,
vm_resources: &mut VmResources,
) -> Result<Arc<Mutex<Vmm>>, BuildMicrovmFromSnapshotError> {
// TODO: take it from kvm-bindings when userfault support is merged upstream
const KVM_CAP_USERFAULT: u32 = 241;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we not check for it anymore?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I think I originally forgot to update this and then noticed quite late into testing, so I just dropped the check instead of updating it with the correct number. But should readd this, thanks.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems like I broke this capability especially during the rebase. sign, well v13 just came out anyway, so guess new kernels it is

@roypat roypat force-pushed the updated-patch-series branch 3 times, most recently from b6a218f to 1e6c8eb Compare July 9, 2025 14:00
@roypat roypat changed the title Update feature/secret-hiding with more recent iterations of patch seires Update feature/secret-hiding with more recent iterations of patch series Jul 9, 2025
@roypat roypat mentioned this pull request Jul 9, 2025
10 tasks
@roypat roypat force-pushed the updated-patch-series branch 2 times, most recently from ff1c5d5 to 22ceb08 Compare July 10, 2025 06:27
roypat added 2 commits July 10, 2025 15:03
- Drop setting memory attributes to private (workaround was needed to
  get KVM to fault non-coco VMs through guest_memfd always)
- Drop no-kvmclock (we have a workaround patch now)
- Drop VM types (guest_memfd is now supported on all vm types).
- Update kvm capability numbers

Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
CONFIG_KVM_PRIVATE_MEM is dead, and CONFIG_KVM_GMEM which replaces it is
automatically selected.

Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
@roypat roypat force-pushed the updated-patch-series branch 6 times, most recently from 170ce9d to 11970a6 Compare July 11, 2025 11:46
roypat added 2 commits July 11, 2025 13:24
With the updated host kernel, the bug that made them fail seems to have
been fixed.

Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
Writing to the noturbo sysfs immediately locks up the entire instance,
so stop doing this for now.

Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
@roypat roypat force-pushed the updated-patch-series branch from 11970a6 to 8dd1215 Compare July 11, 2025 12:25
It's currently broken on the host kernel we're using.

Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants