Support nested virtualization

.github/workflows/basic-ci.yml

@@ -2,9 +2,9 @@ name: Basic CI
 
 on:
   push:
-    branches: [ mainline ]
+    branches: [ main ]
   pull_request:
-    branches: [ mainline ]
+    branches: [ main ]
 
 permissions:
   contents: read
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.11", "3.12"]
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/codeql.yml

@@ -2,9 +2,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ mainline ]
+    branches: [ main ]
   pull_request:
-    branches: [ mainline ]
+    branches: [ main ]
 
 jobs:
   analyze:

.github/workflows/coverage-check.yml

@@ -29,7 +29,7 @@ jobs:
 
     - name: Get base branch coverage
       run: |
-        git checkout origin/mainline
+        git checkout origin/main
         pip install -e ".[dev]"
         python -m pytest tests/ -m "not integration" --cov=src --cov-report=json:coverage-base.json --tb=no -q || true
         BASE_COVERAGE=$(python -c "import json; print(json.load(open('coverage-base.json'))['totals']['percent_covered'])")

.gitignore

@@ -59,3 +59,4 @@ analysis/data/
 
 # Distribution archives
 share/
+test-nested.json

examples/aws/alltests-config.json

@@ -205,7 +205,7 @@
     "vms": [
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -215,7 +215,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -225,7 +225,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -235,7 +235,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -245,7 +245,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -255,7 +255,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -265,7 +265,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -275,7 +275,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [

examples/aws/config.json

@@ -219,7 +219,7 @@
     "vms": [
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [
@@ -229,7 +229,7 @@
       },
       {
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "root_volume_size": 40,
         "max_runtime": 3600,
         "test": [

setup.py

@@ -25,6 +25,7 @@
     version="1.0.0",
     description="Kernel-ci-cloud-labs",
     long_description=long_description,
+    long_description_content_type="text/markdown",
     package_dir={"": "src"},
     packages=find_packages(where="src"),
     python_requires=">=3.11",
@@ -45,6 +46,9 @@
             "isort>=5.0",
             "pre-commit>=2.0",
             "pytest-cov>=2.0",
+            "pandas>=1.3.0",
+            "matplotlib>=3.4.0",
+            "seaborn>=0.11.0",
         ],
         "analysis": [
             "pandas>=1.3.0",

src/kernel_ci_cloud_labs/cli.py

@@ -292,8 +292,11 @@ def main():
     val_parser.add_argument("--bucket", help="S3 bucket to verify (and create with --fix)")
     val_parser.add_argument("--role", help="IAM role name used by VM instance profiles")
     val_parser.add_argument("--region", default="us-west-2", help="AWS region (default: us-west-2)")
-    val_parser.add_argument("--api-url", help=f"KernelCI API base URI (overrides $KERNELCI_API_BASE_URI)")
-    val_parser.add_argument("--fix", action="store_true", help="Create missing resources (S3 bucket) instead of just reporting them")
+    val_parser.add_argument("--api-url", help="KernelCI API base URI (overrides $KERNELCI_API_BASE_URI)")
+    val_parser.add_argument(
+        "--fix", action="store_true",
+        help="Create missing resources (S3 bucket) instead of just reporting them",
+    )
     val_parser.set_defaults(func=cmd_setup_validate)
 
     args = parser.parse_args()

src/kernel_ci_cloud_labs/core/artifacts.py

@@ -262,5 +262,3 @@ def collect_run_artifacts(
         manifest_path,
     )
     return manifest
-
-

src/kernel_ci_cloud_labs/launch_vm.py

@@ -175,6 +175,25 @@ def _resolve_ssm_parameter(self, parameter_name):
             log_error(f"Failed to resolve SSM parameter {parameter_name}: {e}")
             raise
 
+    def _supports_nested_virtualization(self):
+        """Check if the instance type supports nested virtualization.
+
+        AWS supports nested virtualization on C8i, M8i, R8i, C7i, M7i, R7i
+        and related instance families.
+        Returns True if the current instance_type belongs to a supported family.
+
+        See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-ec2-nested-virtualization.html
+        """
+        nested_families = (
+            "c8i", "m8i", "r8i", "c8id", "m8id", "r8id",
+            "c8i-flex", "m8i-flex", "r8i-flex", "x8i",
+            "c7i", "m7i", "r7i", "c7id", "m7id", "r7id",
+            "c7i-flex", "m7i-flex", "i7i",
+        )
+        # Extract family: e.g. "c8i.4xlarge" -> "c8i"
+        instance_family = self.instance_type.rsplit(".", 1)[0].lower()
+        return instance_family in nested_families
+
     def prepare_test_artifacts(self):
         """Verify test payload zip exists in S3."""
         log_info(f"\n=== Verifying test artifacts for {self.test} ===")
@@ -254,6 +273,12 @@ def spawn_vm(self):
 
         params["IamInstanceProfile"] = {"Name": self.role_name}
 
+        # Enable nested virtualization for instance families that support it.
+        # Required for KVM/Hyper-V workloads inside the EC2 instance.
+        if self._supports_nested_virtualization():
+            params["CpuOptions"] = {"NestedVirtualization": "enabled"}
+            log_info(f"Nested virtualization enabled for {self.instance_type}")
+
         log_not("Calling run_instances...")
         response = self.ec2.run_instances(**params)
 

src/kernel_ci_cloud_labs/pull_labs_poller.py

@@ -45,7 +45,6 @@
 
 from kernel_ci_cloud_labs.kcidb_submit import (
     build_test_row,
-    submit_tests,
     to_kcidb_status,
 )
 from kernel_ci_cloud_labs.pull_labs_translate import translate_job
@@ -314,7 +313,7 @@ def _validate_default_executor_deps() -> None:
 
     problems: List[str] = []
     try:
-        import boto3  # noqa: F401,PLC0415
+        import boto3  # noqa: F401,PLC0415  # pylint: disable=unused-import
     except ImportError as e:
         problems.append(
             f"boto3 import failed ({e}) — run: python3.11 -m pip install -e ."

src/kernel_ci_cloud_labs/pull_labs_translate.py

@@ -24,7 +24,7 @@
 # argument of translate_job() to customise per-deployment.
 DEFAULT_PLATFORM_MAP: Dict[str, Dict[str, str]] = {
     "x86_64": {
-        "instance_type": "c5a.4xlarge",
+        "instance_type": "c8i.4xlarge",
         "ami_id": "resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64",
     },
     "arm64": {

src/kernel_ci_cloud_labs/setup_validate.py

@@ -200,7 +200,7 @@ def _check_bucket_policy_statement(s3, bucket_name: str, fix: bool) -> bool:
             print(f"✗ Could not read bucket policy ({code}): {e}")
             return False
         existing = None
-    except (ValueError, json.JSONDecodeError) as e:
+    except ValueError as e:
         print(f"✗ Bucket policy is not valid JSON: {e}")
         return False
 
@@ -365,7 +365,7 @@ def check_kcidb_jwt() -> bool:
         # JWT payload is base64url; pad to a multiple of 4 before decoding.
         payload_b64 = parts[1] + "=" * (-len(parts[1]) % 4)
         payload = json.loads(base64.urlsafe_b64decode(payload_b64))
-    except (ValueError, json.JSONDecodeError) as e:
+    except ValueError as e:
         print(f"✗ JWT payload not decodable: {e}")
         return False
 

tests/test_kcidb_submit.py

@@ -187,8 +187,10 @@ def test_submit_revision_posts_with_bearer_auth(self):
         class FakeResp:
             def __enter__(self):
                 return self
+
             def __exit__(self, *a):
                 return False
+
             def read(self):
                 return b'{"status":"ok","id":"sub-1"}'
 
@@ -237,7 +239,7 @@ def __enter__(self): return self
             def __exit__(self, *a): return False
             def read(self): return b'{}'
 
-        def fake_urlopen(req, timeout=None):
+        def fake_urlopen(req, timeout=None):  # pylint: disable=unused-argument
             captured["body"] = json.loads(req.data.decode("utf-8"))
             return FakeResp()
 
@@ -264,7 +266,7 @@ def __enter__(self): return self
             def __exit__(self, *a): return False
             def read(self): return b'{}'
 
-        def fake_urlopen(req, timeout=None):
+        def fake_urlopen(req, timeout=None):  # pylint: disable=unused-argument
             captured["body"] = json.loads(req.data.decode("utf-8"))
             return FakeResp()
 

tests/test_nested_virtualization.py

@@ -0,0 +1,83 @@
+"""Unit tests for nested virtualization support in launch_vm."""
+# pylint: disable=protected-access
+
+__authors__ = ["Norbert Manthey <nmanthey@amazon.de>"]
+__copyright__ = "Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved."
+# SPDX-License-Identifier: Apache-2.0
+
+from unittest.mock import patch, MagicMock
+
+import pytest
+
+from kernel_ci_cloud_labs.launch_vm import VMLauncher
+
+
+@pytest.fixture
+def _mock_boto3():
+    """Patch boto3 so VMLauncher.__init__ doesn't need real AWS credentials."""
+    with patch("kernel_ci_cloud_labs.launch_vm.boto3") as mock_boto:
+        mock_boto.client.return_value = MagicMock()
+        yield mock_boto
+
+
+class TestNestedVirtualization:
+    """Tests for _supports_nested_virtualization and CpuOptions."""
+
+    def _make_launcher(self, instance_type, _mock_boto3):
+        """Create a VMLauncher with a given instance_type, mocking AWS."""
+        vm_config = {
+            "instance_type": instance_type,
+            "ami_id": "ami-test123",
+            "role_name": "test-role",
+            "s3_bucket": "test-bucket",
+            "run_prefix": "run_test",
+        }
+        return VMLauncher(vm_config)
+
+    def test_c8i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("c8i.4xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_c8i_flex_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("c8i-flex.2xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_m8i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("m8i.large", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_r8i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("r8i.xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_c7i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("c7i.2xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_m7i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("m7i.xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_x8i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("x8i.large", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_i7i_supports_nested(self, _mock_boto3):
+        launcher = self._make_launcher("i7i.xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is True
+
+    def test_c5a_does_not_support_nested(self, _mock_boto3):
+        launcher = self._make_launcher("c5a.4xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is False
+
+    def test_c6g_does_not_support_nested(self, _mock_boto3):
+        launcher = self._make_launcher("c6g.4xlarge", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is False
+
+    def test_t3_does_not_support_nested(self, _mock_boto3):
+        launcher = self._make_launcher("t3.micro", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is False
+
+    def test_m5_does_not_support_nested(self, _mock_boto3):
+        launcher = self._make_launcher("m5.large", _mock_boto3)
+        assert launcher._supports_nested_virtualization() is False