Repository: firecracker-microvm/firecracker
File: tests/integration_tests/security/test_vulnerabilities.py (Python)

Code before:

import pytest
import requests

from framework.ab_test import (
    git_ab_test_guest_command,
    git_ab_test_guest_command_if_pr,
    git_ab_test_host_command_if_pr,
    is_pr,
    set_did_not_grow_comparator,
)
from framework.properties import global_props
from framework.utils import CommandReturn

CHECKER_URL = "https://meltdown.ovh"
CHECKER_FILENAME = "spectre-meltdown-checker.sh"
REMOTE_CHECKER_PATH = f"/tmp/{CHECKER_FILENAME}"
REMOTE_CHECKER_COMMAND = f"sh {REMOTE_CHECKER_PATH} --no-intel-db --batch json"

VULN_DIR = "/sys/devices/system/cpu/vulnerabilities"


skip_if_g3_on_linux_4_14 = pytest.mark.skipif(
    global_props.cpu_model == "ARM_NEOVERSE_V1"
    and global_props.host_linux_version == "4.14",
    reason="[cm]7g host 4.14 requires modifications to the 5.10 guest kernel to boot successfully.",
)


def configure_microvm(
    factory,
    kernel,
    rootfs,
    *,
    firecracker=None,
    jailer=None,
    cpu_template=None,
    custom_cpu_template=None,
):
    """Build a microvm for vulnerability tests"""
    assert not (cpu_template and custom_cpu_template)
    # Either both or neither are specified
    assert firecracker and jailer or not firecracker and not jailer

    if firecracker:
        microvm = factory.build(
            kernel, rootfs, fc_binary_path=firecracker, jailer_binary_path=jailer
        )
    else:
        microvm = factory.build(kernel, rootfs)


Review comment (suggestion):
See https://github.com/firecracker-microvm/firecracker/pull/4410#discussion_r1469495698
```suggestion
    reason="Graviton 3 host 4.14 requires modifications to the 5.10 guest kernel to boot successfully.",
```

Code after:

import pytest
import requests

from framework.ab_test import (
    git_ab_test_guest_command,
    git_ab_test_guest_command_if_pr,
    git_ab_test_host_command_if_pr,
    is_pr,
    set_did_not_grow_comparator,
)
from framework.properties import global_props
from framework.utils import CommandReturn

CHECKER_URL = "https://meltdown.ovh"
CHECKER_FILENAME = "spectre-meltdown-checker.sh"
REMOTE_CHECKER_PATH = f"/tmp/{CHECKER_FILENAME}"
REMOTE_CHECKER_COMMAND = f"sh {REMOTE_CHECKER_PATH} --no-intel-db --batch json"

VULN_DIR = "/sys/devices/system/cpu/vulnerabilities"


skip_if_g3_on_linux_4_14 = pytest.mark.skipif(
    global_props.cpu_model == "ARM_NEOVERSE_V1"
    and global_props.host_linux_version == "4.14",
    # Graviton3 instances in 4.14 require a non-SVE kernel to boot
    reason="[cm]7g 4.14 requires modifications to the 5.10 guest kernel to boot successfully.",
)


def configure_microvm(
    factory,
    kernel,
    rootfs,
    *,
    firecracker=None,
    jailer=None,
    cpu_template=None,
    custom_cpu_template=None,
):
    """Build a microvm for vulnerability tests"""
    assert not (cpu_template and custom_cpu_template)
    # Either both or neither are specified
    assert firecracker and jailer or not firecracker and not jailer

    if firecracker:
        microvm = factory.build(
            kernel, rootfs, fc_binary_path=firecracker, jailer_binary_path=jailer
        )
    else:
        microvm = factory.build(kernel, rootfs)