Skip to content

Commit a50af88

Browse files
bodzhanghaitaohuang
bodzhang
and
haitaohuang
committed
feat: Add Azure CVM Emulation (AzCVMEmu) support for development and testing
This commit introduces comprehensive Azure CVM emulation capabilities to enable MigTD development and testing as a standard Rust application inside an Azure TDX CVM, while exercising almost all MigTDCore code and flows, including RA-TLS with TDX Quote and migration policy enforcement. **Emulation Infrastructure:** - Relevant td-shim interfaces emulation under `deps/td-shim-AzCVMEmu/` - Relevant TDX TDCALL emulation - MigTD Quote emulation by Azure TDX CVM virtual FW Quote, or mock TD REPORT and Quote - Event logging emulation with CCEL (CC Event Log) interface - Interrupt handling emulation - File-based policy and root CA configuration loading - TCP transport layer for source/destination communication **MigTDCore Integration:** - Conditional compilation support via `AzCVMEmu` feature flag - Command-line interface with argument parsing and help - Standard library (std) support for development workflows **Development and Testing Support:** - `migtdemu.sh` runner script with automatic environment detection - CI/CD integration with GitHub Actions workflow - Documentation in `doc/AzCVMEmu.md` - `test_mock_report` support for mock attestation, enabling build and integration test on generic Linux machine **Development/Testing (Azure TDX CVM + TPM2-TSS):** ```bash cargo build --no-default-features --features "AzCVMEmu" --bin migtd ``` **Development/Testing (any Linux system):** ```bash cargo build --no-default-features --features "AzCVMEmu,test_mock_report" --bin migtd ``` This implementation enables comprehensive end-to-end testing of MigTD's RATLS, policy enforcement, and migration workflows in broadly available development environments. Special acknowledgments: - src/attestation/fixup-libservtd-attest-lib.sh: Investigation, design and implementation by Mike Brasher <[email protected]> Co-authored-by: Haitao Huang <[email protected]> Signed-off-by: Bo Zhang (ACC) <[email protected]>
1 parent 2ed64ff commit a50af88

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+10005
-44
lines changed

‎.github/workflows/integration-emu.yml‎

Lines changed: 336 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,336 @@
1+
name: Integration (Emulation Mode)
2+
3+
# Trigger on push and pull request events
4+
on:
5+
push:
6+
paths-ignore:
7+
- "**.md"
8+
- "doc/**"
9+
pull_request:
10+
paths-ignore:
11+
- "**.md"
12+
- "doc/**"
13+
workflow_dispatch:
14+
15+
env:
16+
AS: nasm
17+
RUST_TOOLCHAIN: 1.83.0
18+
TOOLCHAIN_PROFILE: minimal
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
build-and-test:
25+
name: Build and Test MigTD in Emulation Mode
26+
runs-on: ubuntu-22.04
27+
timeout-minutes: 60
28+
29+
steps:
30+
# Install first since it's needed to build NASM
31+
- name: Install LLVM and Clang
32+
uses: KyleMayes/install-llvm-action@a7a1a882e2d06ebe05d5bb97c3e1f8c984ae96fc # v2.0.7
33+
with:
34+
version: "10.0"
35+
directory: ${{ runner.temp }}/llvm
36+
37+
- name: Install libtinfo5
38+
run: sudo apt-get update -y && sudo apt-get install libtinfo5 -y
39+
40+
- name: Install NASM
41+
uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2
42+
43+
- name: Install build dependencies
44+
run: sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python-is-python3 libssl-dev git cmake perl libtss2-dev pkg-config
45+
46+
- name: Checkout sources
47+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
48+
with:
49+
submodules: recursive
50+
51+
- name: Install Rust toolchain
52+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
53+
with:
54+
profile: ${{ env.TOOLCHAIN_PROFILE }}
55+
toolchain: ${{ env.RUST_TOOLCHAIN }}
56+
override: true
57+
components: rust-src
58+
59+
- name: Add x86_64-unknown-none target
60+
run: rustup target add x86_64-unknown-none
61+
62+
- name: Run preparation script
63+
run: bash sh_script/preparation.sh
64+
65+
- name: Build MigTD with test features for emulation
66+
run: |
67+
echo "Building MigTD with AzCVMEmu and test features for emulation testing..."
68+
cargo build --release --features "AzCVMEmu,test_disable_ra_and_accept_all" --no-default-features
69+
70+
- name: Verify emulation script and binary
71+
run: |
72+
if [[ ! -f "./migtdemu.sh" ]]; then
73+
echo "Error: migtdemu.sh not found"
74+
exit 1
75+
fi
76+
chmod +x ./migtdemu.sh
77+
78+
if [[ ! -f "./target/release/migtd" ]]; then
79+
echo "Error: migtd binary not found after build"
80+
exit 1
81+
fi
82+
83+
echo "Emulation script and binary are ready"
84+
85+
- name: Run MigTD emulation tests
86+
id: emulation_test
87+
run: |
88+
echo "Running MigTD emulation tests with both source and destination..."
89+
echo "This will start destination, then source, and test the migration flow"
90+
echo "Command: ./migtdemu.sh --skip-ra --both --no-sudo --log-level info"
91+
92+
# Run the test with timeout and capture exit code
93+
set +e
94+
timeout 300 ./migtdemu.sh --skip-ra --both --no-sudo --log-level info
95+
EXIT_CODE=$?
96+
set -e
97+
98+
echo "Test completed with exit code: $EXIT_CODE"
99+
100+
if [[ $EXIT_CODE -eq 0 ]]; then
101+
echo "✅ Emulation test completed successfully"
102+
echo "test_status=success" >> $GITHUB_OUTPUT
103+
elif [[ $EXIT_CODE -eq 124 ]]; then
104+
echo "❌ Emulation test timed out after 300 seconds"
105+
echo "test_status=timeout" >> $GITHUB_OUTPUT
106+
exit 1
107+
else
108+
echo "❌ Emulation test failed with exit code $EXIT_CODE"
109+
echo "test_status=failed" >> $GITHUB_OUTPUT
110+
exit $EXIT_CODE
111+
fi
112+
113+
- name: Check test outputs and logs
114+
if: always()
115+
run: |
116+
echo "=== Test Execution Summary ==="
117+
echo "Test status: ${{ steps.emulation_test.outputs.test_status || 'unknown' }}"
118+
119+
if [[ -f "dest.out.log" ]]; then
120+
DEST_LOG_SIZE=$(wc -l < dest.out.log)
121+
echo "Destination log found: $DEST_LOG_SIZE lines"
122+
123+
echo ""
124+
echo "=== Last 50 lines of destination log ==="
125+
tail -n 50 dest.out.log
126+
127+
echo ""
128+
echo "=== First 20 lines of destination log ==="
129+
head -n 20 dest.out.log
130+
else
131+
echo "No destination log file found"
132+
fi
133+
134+
# Check for any process dumps or error files
135+
if ls core* 1> /dev/null 2>&1; then
136+
echo ""
137+
echo "=== Core dumps found ==="
138+
ls -la core*
139+
fi
140+
141+
# Show summary of what was tested
142+
echo ""
143+
echo "=== Test Summary ==="
144+
echo "- Built MigTD with AzCVMEmu and test_disable_ra_and_accept_all features"
145+
echo "- Ran emulation test with both source and destination instances"
146+
echo "- Skip RA mode enabled (mock attestation, no TPM/Azure CVM required)"
147+
148+
- name: Upload test artifacts on failure
149+
if: failure()
150+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
151+
with:
152+
name: migtd-test-logs-${{ github.run_id }}
153+
path: |
154+
dest.out.log
155+
*.log
156+
core*
157+
target/release/migtd
158+
retention-days: 7
159+
if-no-files-found: ignore
160+
161+
- name: Report final status
162+
if: always()
163+
run: |
164+
case "${{ steps.emulation_test.outputs.test_status }}" in
165+
"success")
166+
echo "🎉 MigTD PR tests passed successfully!"
167+
echo "✅ Build completed"
168+
echo "✅ Emulation tests passed"
169+
echo "The PR is ready for code review."
170+
;;
171+
"timeout")
172+
echo "⏰ MigTD tests timed out"
173+
echo "✅ Build completed"
174+
echo "❌ Tests timed out after 5 minutes"
175+
echo "Check logs for hanging processes or infinite loops."
176+
;;
177+
"failed"|*)
178+
echo "❌ MigTD tests failed"
179+
echo "✅ Build completed"
180+
echo "❌ Emulation tests failed"
181+
echo "Check the test logs above and uploaded artifacts for debugging details."
182+
;;
183+
esac
184+
185+
policy-v2-mock-report-test:
186+
name: Policy v2 with Mock Report End-to-End Test
187+
runs-on: ubuntu-22.04
188+
timeout-minutes: 60
189+
190+
steps:
191+
# Install first since it's needed to build NASM
192+
- name: Install LLVM and Clang
193+
uses: KyleMayes/install-llvm-action@a7a1a882e2d06ebe05d5bb97c3e1f8c984ae96fc # v2.0.7
194+
with:
195+
version: "10.0"
196+
directory: ${{ runner.temp }}/llvm
197+
198+
- name: Install libtinfo5
199+
run: sudo apt-get update -y && sudo apt-get install libtinfo5 -y
200+
201+
- name: Install NASM
202+
uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2
203+
204+
- name: Install build dependencies
205+
run: sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python-is-python3 libssl-dev git cmake perl libtss2-dev pkg-config jq -y
206+
207+
- name: Checkout sources
208+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
209+
with:
210+
submodules: recursive
211+
212+
- name: Install Rust toolchain
213+
uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
214+
with:
215+
profile: ${{ env.TOOLCHAIN_PROFILE }}
216+
toolchain: ${{ env.RUST_TOOLCHAIN }}
217+
override: true
218+
components: rust-src
219+
220+
- name: Add x86_64-unknown-none target
221+
run: rustup target add x86_64-unknown-none
222+
223+
- name: Run preparation script
224+
run: bash sh_script/preparation.sh
225+
226+
- name: Run policy v2 generation and test script
227+
id: policy_v2_test
228+
run: |
229+
echo "=== Running Policy v2 Mock Report Test Script ==="
230+
echo "This script will:"
231+
echo " 1. Build all required tools (azcvm-extract-report, json-signer, etc.)"
232+
echo " 2. Generate mock report data"
233+
echo " 3. Update policy templates with mock measurements"
234+
echo " 4. Generate certificates and sign policy components"
235+
echo " 5. Create and sign final policy v2"
236+
echo " 6. Build MigTD with mock report feature"
237+
echo " 7. Run end-to-end test with both source and destination"
238+
echo ""
239+
240+
chmod +x ./sh_script/build_AzCVMEmu_policy_and_test.sh
241+
242+
# Run the script with timeout
243+
set +e
244+
timeout 600 ./sh_script/build_AzCVMEmu_policy_and_test.sh --mock-report
245+
EXIT_CODE=$?
246+
set -e
247+
248+
echo ""
249+
echo "Script completed with exit code: $EXIT_CODE"
250+
251+
if [[ $EXIT_CODE -eq 0 ]]; then
252+
echo "✅ Policy v2 with mock report test completed successfully"
253+
echo "test_status=success" >> $GITHUB_OUTPUT
254+
elif [[ $EXIT_CODE -eq 124 ]]; then
255+
echo "❌ Test timed out after 10 minutes"
256+
echo "test_status=timeout" >> $GITHUB_OUTPUT
257+
exit 1
258+
else
259+
echo "❌ Test failed with exit code $EXIT_CODE"
260+
echo "test_status=failed" >> $GITHUB_OUTPUT
261+
exit $EXIT_CODE
262+
fi
263+
264+
- name: Check test outputs
265+
if: always()
266+
run: |
267+
echo "=== Test Execution Summary ==="
268+
echo "Test status: ${{ steps.policy_v2_test.outputs.test_status || 'unknown' }}"
269+
270+
if [[ -f "dest.out.log" ]]; then
271+
DEST_LOG_SIZE=$(wc -l < dest.out.log)
272+
echo "Destination log found: $DEST_LOG_SIZE lines"
273+
274+
echo ""
275+
echo "=== Last 50 lines of destination log ==="
276+
tail -n 50 dest.out.log
277+
278+
echo ""
279+
echo "=== First 20 lines of destination log ==="
280+
head -n 20 dest.out.log
281+
else
282+
echo "No destination log file found"
283+
fi
284+
285+
# Check if policy files were generated
286+
if [[ -f "config/AzCVMEmu/policy_v2_signed.json" ]]; then
287+
POLICY_SIZE=$(wc -c < config/AzCVMEmu/policy_v2_signed.json)
288+
echo ""
289+
echo "Policy file generated: ${POLICY_SIZE} bytes"
290+
fi
291+
292+
if [[ -f "config/AzCVMEmu/policy_issuer_chain.pem" ]]; then
293+
echo "Certificate chain file generated"
294+
fi
295+
296+
- name: Upload test artifacts on failure
297+
if: failure()
298+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
299+
with:
300+
name: policy-v2-test-logs-${{ github.run_id }}
301+
path: |
302+
dest.out.log
303+
*.log
304+
config/AzCVMEmu/policy_v2_signed.json
305+
config/AzCVMEmu/policy_issuer_chain.pem
306+
target/release/migtd
307+
retention-days: 7
308+
if-no-files-found: ignore
309+
310+
- name: Report final status
311+
if: always()
312+
run: |
313+
case "${{ steps.policy_v2_test.outputs.test_status }}" in
314+
"success")
315+
echo "🎉 Policy v2 mock report test passed successfully!"
316+
echo "✅ All 13 steps of policy generation completed"
317+
echo "✅ Mock report data generated"
318+
echo "✅ Policy v2 signed and validated"
319+
echo "✅ End-to-end migration test passed"
320+
echo "The PR is ready for code review."
321+
;;
322+
"timeout")
323+
echo "⏰ Policy v2 test timed out"
324+
echo "❌ Tests timed out after 10 minutes"
325+
echo "Check logs for hanging processes or infinite loops."
326+
;;
327+
"failed"|*)
328+
echo "❌ Policy v2 test failed"
329+
echo "Check the test logs above and uploaded artifacts for debugging details."
330+
echo "The script performs all 13 steps:"
331+
echo " 1-4: Build tools and generate mock measurements"
332+
echo " 5-7: Generate certificates and sign components"
333+
echo " 8-10: Generate collateral and merge policy"
334+
echo " 11-13: Copy files and run integration test"
335+
;;
336+
esac

0 commit comments

Comments
 (0)