test(hypervisors): cover Qemu.BuildExecCmd

pkg/unikontainers/hypervisors/qemu_test.go

@@ -0,0 +1,331 @@
+// Copyright (c) 2023-2026, Nubificus LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package hypervisors
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/urunc-dev/urunc/pkg/unikontainers/types"
+)
+
+// fakeUnikernel is a minimal stub of types.Unikernel used only to drive
+// Qemu.BuildExecCmd. The three Monitor* methods are the ones the function
+// consults; everything else returns zero values and is never expected to be
+// called from BuildExecCmd.
+type fakeUnikernel struct {
+	netCli     string
+	blockCli   []types.MonitorBlockArgs
+	monitorCli types.MonitorCliArgs
+}
+
+func (f *fakeUnikernel) Init(types.UnikernelParams) error          { return nil }
+func (f *fakeUnikernel) CommandString() (string, error)            { return "", nil }
+func (f *fakeUnikernel) SupportsBlock() bool                       { return true }
+func (f *fakeUnikernel) SupportsFS(string) bool                    { return true }
+func (f *fakeUnikernel) MonitorNetCli(string, string) string       { return f.netCli }
+func (f *fakeUnikernel) MonitorBlockCli() []types.MonitorBlockArgs { return f.blockCli }
+func (f *fakeUnikernel) MonitorCli() types.MonitorCliArgs          { return f.monitorCli }
+
+const testQemuBinary = "/usr/bin/qemu-system-x86_64"
+
+func defaultArgs() types.ExecArgs {
+	return types.ExecArgs{
+		MemSizeB:      0,
+		VCPUs:         0,
+		Seccomp:       false,
+		UnikernelPath: "/rootfs/unikernel.bin",
+		Command:       "init=/bin/sh",
+	}
+}
+
+// withArgs returns defaultArgs() after applying the given modifier, so that
+// each table case can declare only the fields it cares about.
+func withArgs(modify func(*types.ExecArgs)) types.ExecArgs {
+	a := defaultArgs()
+	if modify != nil {
+		modify(&a)
+	}
+	return a
+}
+
+func TestQemuBuildExecCmd(t *testing.T) {
+	t.Parallel()
+
+	// Architecture-conditional expectations are decided up front so the table
+	// stays declarative.
+	archMustContain := []string{}
+	archMustNotContain := []string{"-M virt"}
+	if runtime.GOARCH == "arm64" {
+		archMustContain = []string{"-M virt"}
+		archMustNotContain = nil
+	}
+
+	tests := []struct {
+		name           string
+		vhost          bool
+		args           types.ExecArgs
+		unikernel      types.Unikernel
+		mustContain    []string
+		mustNotContain []string
+		// extra runs additional assertions on the raw output slice. Used for
+		// position-sensitive checks (binary first, kernel command last, etc).
+		extra func(t *testing.T, out []string)
+	}{
+		{
+			name:      "binary path is first element and architecture flag is correct",
+			args:      defaultArgs(),
+			unikernel: &fakeUnikernel{},
+			mustContain: append([]string{
+				"-L /usr/share/qemu",
+				"-cpu host",
+				"-enable-kvm",
+				"-display none",
+				"-vga none",
+				"-serial stdio",
+				"-monitor null",
+			}, archMustContain...),
+			mustNotContain: archMustNotContain,
+			extra: func(t *testing.T, out []string) {
+				assert.Equal(t, testQemuBinary, out[0], "binary path must be the first element of the slice")
+			},
+		},
+		{
+			name:        "MemSizeB=0 falls back to DefaultMemory (256M)",
+			args:        defaultArgs(),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-m 256M"},
+		},
+		{
+			name:        "MemSizeB=512MB renders -m 512M",
+			args:        withArgs(func(a *types.ExecArgs) { a.MemSizeB = 512 * 1000 * 1000 }),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-m 512M"},
+		},
+		{
+			name:           "VCPUs=0 omits -smp",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustNotContain: []string{"-smp"},
+		},
+		{
+			name:        "VCPUs=1 emits -smp 1",
+			args:        withArgs(func(a *types.ExecArgs) { a.VCPUs = 1 }),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-smp 1"},
+		},
+		{
+			name:        "VCPUs=4 emits -smp 4",
+			args:        withArgs(func(a *types.ExecArgs) { a.VCPUs = 4 }),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-smp 4"},
+		},
+		{
+			name:        "VCPUs=16 emits -smp 16",
+			args:        withArgs(func(a *types.ExecArgs) { a.VCPUs = 16 }),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-smp 16"},
+		},
+		{
+			name:           "Seccomp=false omits --sandbox",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustNotContain: []string{"--sandbox"},
+		},
+		{
+			name:      "Seccomp=true emits the full sandbox flag set",
+			args:      withArgs(func(a *types.ExecArgs) { a.Seccomp = true }),
+			unikernel: &fakeUnikernel{},
+			mustContain: []string{
+				"--sandbox on",
+				"obsolete=deny",
+				"elevateprivileges=deny",
+				"spawn=deny",
+				"resourcecontrol=deny",
+			},
+		},
+		{
+			name:        "UnikernelPath is rendered with -kernel",
+			args:        withArgs(func(a *types.ExecArgs) { a.UnikernelPath = "/some/path/unikernel.elf" }),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-kernel /some/path/unikernel.elf"},
+		},
+		{
+			name:           "empty TapDev produces -nic none and no tap netdev",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustContain:    []string{"-nic none"},
+			mustNotContain: []string{"-netdev tap"},
+		},
+		{
+			name: "generic tap network with vhost off",
+			args: withArgs(func(a *types.ExecArgs) {
+				a.Net = types.NetDevParams{TapDev: "tap0", MAC: "52:54:00:12:34:56", MTU: 1500}
+			}),
+			unikernel: &fakeUnikernel{},
+			mustContain: []string{
+				"-netdev tap",
+				"id=net0",
+				"script=no",
+				"downscript=no",
+				"ifname=tap0",
+				"host_mtu=1500",
+				"mac=52:54:00:12:34:56",
+			},
+			mustNotContain: []string{"-nic none", "vhost=on"},
+		},
+		{
+			name:  "generic tap network with vhost on",
+			vhost: true,
+			args: withArgs(func(a *types.ExecArgs) {
+				a.Net = types.NetDevParams{TapDev: "tap0", MAC: "aa:bb:cc:dd:ee:ff", MTU: 1500}
+			}),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"vhost=on", "ifname=tap0"},
+		},
+		{
+			name:           "custom MonitorNetCli is used verbatim",
+			args:           withArgs(func(a *types.ExecArgs) { a.Net.TapDev = "tap0" }),
+			unikernel:      &fakeUnikernel{netCli: " -netdev user,id=net0 -device e1000,netdev=net0"},
+			mustContain:    []string{"-netdev user,id=net0", "-device e1000,netdev=net0"},
+			mustNotContain: []string{"-netdev tap"},
+		},
+		{
+			name:        "InitrdPath is rendered with -initrd",
+			args:        withArgs(func(a *types.ExecArgs) { a.InitrdPath = "/rootfs/initrd.img" }),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"-initrd /rootfs/initrd.img"},
+		},
+		{
+			name:           "empty InitrdPath omits -initrd",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustNotContain: []string{"-initrd"},
+		},
+		{
+			name: "Sharedfs 9pfs renders fsdev and virtio-9p-pci",
+			args: withArgs(func(a *types.ExecArgs) {
+				a.Sharedfs = types.SharedfsParams{Type: "9pfs", Path: "/srv/share"}
+			}),
+			unikernel: &fakeUnikernel{},
+			mustContain: []string{
+				"-fsdev local,id=rootfs9p,security_model=none,path=/srv/share",
+				"-device virtio-9p-pci,fsdev=rootfs9p,mount_tag=fs0",
+			},
+		},
+		{
+			name: "Sharedfs virtiofs renders memory-backend-file and vhost-user-fs-pci",
+			args: withArgs(func(a *types.ExecArgs) {
+				a.Sharedfs = types.SharedfsParams{Type: "virtiofs", Path: "/srv/share"}
+			}),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"memory-backend-file", "-numa node,memdev=mem", "vhost-user-fs-pci"},
+		},
+		{
+			name:           "Sharedfs empty renders no shared-fs flags",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustNotContain: []string{"-fsdev", "memory-backend-file", "vhost-user-fs-pci"},
+		},
+		{
+			name:           "no block devices renders no virtio-blk flags",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustNotContain: []string{"virtio-blk-pci", "format=raw"},
+		},
+		{
+			name:      "generic block device (no ExactArgs) renders virtio-blk and drive flags",
+			args:      defaultArgs(),
+			unikernel: &fakeUnikernel{blockCli: []types.MonitorBlockArgs{{ID: "data0", Path: "/disks/data0.img"}}},
+			mustContain: []string{
+				"-device virtio-blk-pci,serial=data0,drive=data0,scsi=off",
+				"-drive format=raw,if=none,id=data0,file=/disks/data0.img",
+			},
+		},
+		{
+			name:           "block device with ExactArgs is preserved verbatim and bypasses generic flags",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{blockCli: []types.MonitorBlockArgs{{ExactArgs: " -hda /custom/disk.img"}}},
+			mustContain:    []string{"-hda /custom/disk.img"},
+			mustNotContain: []string{"virtio-blk-pci"},
+		},
+		{
+			name:        "MonitorCli ExtraInitrd is appended as -initrd",
+			args:        defaultArgs(),
+			unikernel:   &fakeUnikernel{monitorCli: types.MonitorCliArgs{ExtraInitrd: "/extra/initrd.cpio"}},
+			mustContain: []string{"-initrd /extra/initrd.cpio"},
+		},
+		{
+			name:        "MonitorCli OtherArgs are appended verbatim",
+			args:        defaultArgs(),
+			unikernel:   &fakeUnikernel{monitorCli: types.MonitorCliArgs{OtherArgs: " -nographic -no-reboot"}},
+			mustContain: []string{"-nographic", "-no-reboot"},
+		},
+		{
+			name: "VAccelType=vsock emits vhost-vsock-pci with the configured guest CID",
+			args: withArgs(func(a *types.ExecArgs) {
+				a.VAccelType = "vsock"
+				a.VSockDevID = 42
+			}),
+			unikernel:   &fakeUnikernel{},
+			mustContain: []string{"vhost-vsock-pci", "guest-cid=42"},
+		},
+		{
+			name:           "no VAccel set omits vhost-vsock-pci",
+			args:           defaultArgs(),
+			unikernel:      &fakeUnikernel{},
+			mustNotContain: []string{"vhost-vsock-pci"},
+		},
+		{
+			// The kernel command line is appended as two separate slice entries
+			// (-append and the command). This matters because args.Command may
+			// itself contain spaces, and QEMU expects the entire command line as
+			// a single argument value rather than split across entries.
+			name:      "kernel command is appended as a single trailing element after -append",
+			args:      withArgs(func(a *types.ExecArgs) { a.Command = "init=/bin/sh root=/dev/vda console=ttyS0" }),
+			unikernel: &fakeUnikernel{},
+			extra: func(t *testing.T, out []string) {
+				assert.GreaterOrEqual(t, len(out), 2)
+				assert.Equal(t, "-append", out[len(out)-2])
+				assert.Equal(t, "init=/bin/sh root=/dev/vda console=ttyS0", out[len(out)-1])
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			q := &Qemu{binary: QemuBinary, binaryPath: testQemuBinary, vhost: tt.vhost}
+			out, err := q.BuildExecCmd(tt.args, tt.unikernel)
+			assert.NoError(t, err)
+			assert.NotEmpty(t, out)
+
+			joined := strings.Join(out, " ")
+			for _, want := range tt.mustContain {
+				assert.Contains(t, joined, want, "expected %q to be present", want)
+			}
+			for _, notWant := range tt.mustNotContain {
+				assert.NotContains(t, joined, notWant, "expected %q to be absent", notWant)
+			}
+
+			if tt.extra != nil {
+				tt.extra(t, out)
+			}
+		})
+	}
+}