The nightly compiler used by cargo fuzz no longer requires unsafe
for __cpuid intrinsics, but stable still does.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
The variant has been unused since commit 12e20effd which
replaced direct QcowFile creation with QcowDiskSync.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Since we run integration tests on Intel & AMD this should test the
behaviour of `--cpus nested={on|off}` correctly.
Signed-off-by: Rob Bradford <rbradford@meta.com>
The loop that is for programming the APIC ID and disabling nested
virtualization was prematurely breaking out on AMD platforms as the 0x1
leaf is also valid on AMD. This lead to the code attempting to disable
SVM in the 0x8000_0001 leaf never being reached.
Now only break out early if the CPU vendor is Intel.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Add test_api_http_shutdown and test_api_http_delete to the
common_cvm module using GuestFactory with 4 CPUs. Both tests
reuse existing _test_api_shutdown and _test_api_delete helpers
to extend API coverage to confidential VMs.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual Guest field assignments with
GuestFactory::new_confidential_guest_factory() in
test_focal_simple_launch for consistent CVM guest creation.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add test_api_http_create_boot to the common_cvm module using
GuestFactory::new_confidential_guest_factory() with 4 CPUs.
This extends API create/boot coverage to confidential VMs.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Refactor api_create_body() to read cpu_count, kernel_path,
and kernel_cmdline from Guest fields instead of taking them
as parameters. This makes Guest the single source of truth
for VM configuration.
Update all call sites in HTTP and DBus API tests to use the
new parameterless signature. Switch guest creation to use
GuestFactory for consistent 4-CPU configuration.
Replace manual CPU and memory assertions with
validate_cpu_count() and validate_memory() helpers.
Replace thread::sleep with wait_vm_boot() in
_test_api_create_boot for proper boot synchronization.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Refactor api_create_body() to branch based on GuestVmType.
For confidential VMs, the JSON body now includes:
- platform config with sev_snp enabled
- IGVM payload with host_data instead of kernel
- nested virtualization disabled in CPU config
Replace the monolithic format! macro with incremental
push_str calls for clearer JSON construction.
Also improve error handling in GuestCommand by replacing
an unwrap() with a descriptive expect() on the IGVM path.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Introduce GuestFactory struct that encapsulates GuestVmType,
boot timeout, and nested virtualization defaults. This avoids
repeatedly specifying VM type and associated defaults when
constructing Guest instances in integration tests.
Two factory constructors are provided:
- new_regular_guest_factory: default timeout, nested enabled
- new_confidential_guest_factory: CVM timeout, nested disabled
Multiple create_guest variants allow customizing CPU count,
memory size, and nested virtualization while inheriting the
factory's VM type and timeout settings.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Initialize kernel_path and kernel_cmdline with standard
direct boot defaults in the Guest constructor instead of
None. This removes boilerplate from individual tests that
use the common direct kernel boot configuration.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move test constants (MAX_NUM_PCI_SEGMENTS,
DIRECT_KERNEL_BOOT_CMDLINE, CONSOLE_TEST_STRING),
arch-specific image name modules (x86_64, aarch64),
and helper functions (direct_kernel_boot_path, edk2_path)
from integration.rs to test_infra/src/lib.rs.
This centralizes shared test definitions so they can be
reused across multiple test crates instead of being
confined to integration.rs.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Boot a VM with a 4k sector loop device passed with direct=on and
image_type=raw. Assert that the guest sees a 4096 byte logical
sector and that a DIO write/read roundtrip at 4096 byte alignment
succeeds.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Verify that DiskTopology::probe() returns the correct DIO alignment
for a regular file on a 4k sector filesystem. The test creates a
loop device with --sector-size 4096, formats ext4, places a raw disk
image on it, and boots a VM with direct=on. Asserts that the guest
sees a 4096 byte logical sector and that a DIO write/read roundtrip
succeeds.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Move LOOP_CTL_GET_FREE + open + LOOP_CONFIGURE into the retry loop
so each attempt requests a fresh free device number. Previously, a
parallel test could claim the same device between GET_FREE and
CONFIGURE, and retrying the same stale number would always fail with
EBUSY.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Test valid power of two alignment, layout compatibility,
direct helper coverage, and O_DIRECT write/read roundtrip.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
DiskTopology::probe() returned a hardcoded 512 for regular files,
causing O_DIRECT failures on volumes with larger block sizes
(e.g. 4K).
Use statx(STATX_DIOALIGN) (Linux >= 6.1) to query the real per file
DIO memory and offset alignment. Unlike fstatvfs().f_bsize, which
only returns the filesystem preferred I/O block size,
STATX_DIOALIGN reports the true DIO constraints accounting for the
filesystem, underlying block device, and any stacking (loop, dm,
etc.).
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Nightly rustfmt now prefers `self` re-exports inline rather
than a separate 'pub use {kvm_bindings, kvm_ioctls}' line.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Avoid a potential infinite loop where if the leader fails to create a
cookie due to an unexpected error (not one of the SMT/no kernel support
errors) then the other vcpu threads will continue around their
spinloops.
This change also clarifies the state machine for the leader election
with an explicit enum.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Drop an unused vm_memory::GuestAddress import from common_cvm
in integration tests to keep the module clean.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace hard-coded --memory size=512M args with default_memory()
across integration tests to centralize default memory settings.
This reduces duplicated CLI fragments and keeps behavior consistent.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace hard-coded --cpus boot=<n> arguments in integration tests
with GuestCommand::default_cpus() for shared, centralized defaults.
This removes duplicated CLI fragments and keeps CPU setup consistent.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace the hard-coded memory threshold check in the simple launch
integration test with Guest::validate_memory(None).
Add Guest::get_expected_memory() to derive thresholds from mem_size_str
and vm_type, and reuse this through validate_memory().
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace hard-coded --memory args in simple launch tests
with GuestCommand defaults driven by Guest state.
Add Guest.mem_size_str with a default of 512M and introduce
default_memory_string() and GuestCommand::default_memory().
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Instead of validating number of CPU in the test case itself,
moving the checking of the CPU count to Guest struct with a
new function as The Guest already has the Default CPU number.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace the hard-coded .args(["--cpus", "boot=1"]) in the simple
launch integration test with a shared helper (default_cpus) from test
infrastructure.
Extend Guest with explicit CPU-related defaults (num_cpu, nested)
and add default_cpus_string() so CPU configuration is derived from
guest state instead of being duplicated at call sites.
This refactor improves consistency and makes CPU defaults easier to
maintain across integration tests.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move MetaEvent from the integration test into shared test infrastructure
and expose it for reuse. Add a Guest helper that returns the expected
sequential events for simple launch, and update the integration test to
consume this helper instead of maintaining a local event list.
Adjust expected behavior for confidential VMs by omitting the disk reset
event, which is not guaranteed to be emitted in that mode. Preserve the
existing expected sequence for non-confidential VMs.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
The SYNTAX help string for --net was missing a comma between
pci_segment and offload_tso parameters, making the help output
show them as a single run-on token.
Signed-off-by: Victor Vieux <vieux@repl.it>
O_DIRECT requires buffer addresses to be aligned to the backend
device's logical block size. The existing bounce buffer logic in
execute_async() hardcodes SECTOR_SIZE (512) for the alignment check
and bounce buffer allocation. This is insufficient for devices with
a 4096-byte logical block size, where misaligned buffers cause
-EINVAL from the host kernel.
Add an alignment() method to the AsyncIo trait that returns the
backend's logical block size, defaulting to SECTOR_SIZE. The three
raw I/O backends (io_uring, AIO, synchronous) probe the device
topology via DiskTopology::probe() at creation time and return the
actual logical block size. All image format backends would simply
use the default value of 512 bytes since their underlying are
not block devices.
execute_async() now queries disk_image.alignment() instead of using
the hardcoded SECTOR_SIZE
Fixes: #7720
Signed-off-by: Saravanan D <saravanand@crusoe.ai>
Add a core_scheduling option to --cpus with three modes of operation.
This feature takes advantage of a kernel feature that restricts
scheduling of processes on the SMT threads on the same core. This is
useful for mitigating certain classes of side-channel attacks and has
better performance that disabling SMT on the CPU.
- vm (default): All vCPU threads share one core scheduling cookie.
They may be co-scheduled on SMT siblings while host threads are
excluded - this has minimal performance impact and can even
potentially improve performance from co-location.
- vcpu: Each vCPU gets a unique cookie preventing any two vCPUs from
sharing SMT siblings. This has the strongest isolation but at some
compromise of performance.
- off: No core scheduling applied (old behaviour).
This isolation is done by the kernel maintaining a "cookie" - threads
with the same cookie can share the same core.
In vCPU mode each vCPU thread the cookie is created when the thread
starts and each gets a unique cookie. For VM mode the first vCPU thread
(the leader) will create the cookie. All other vCPU threads started (via
hotplug or during boot) will have that cookie shared to it.
EINVAL/ENODEV from prctl is silently ignored so this works transparently
on kernels older than 5.14 that lack PR_SCHED_CORE or when SMT disabled.
Full details of this kernel feature can be found at:
https://docs.kernel.org/admin-guide/hw-vuln/core-scheduling.html
This implementation was inspired by crosvm's implementation - in
particular the enable_core_scheduling() function.
This is challenging to test via integration testing but the logging of
the received cookie shows it working:
VM case:
cloud-hypervisor: 0.243102s: <vcpu1> INFO:vmm/src/cpu.rs:1247 -- vCPU 1: core scheduling cookie = 0x33e4c167
cloud-hypervisor: 0.243102s: <vcpu0> INFO:vmm/src/cpu.rs:1247 -- vCPU 0: core scheduling cookie = 0x33e4c167
vCPU case:
cloud-hypervisor: 0.089356s: <vcpu0> INFO:vmm/src/cpu.rs:1247 -- vCPU 0: core scheduling cookie = 0x13993ad6
cloud-hypervisor: 0.089380s: <vcpu1> INFO:vmm/src/cpu.rs:1247 -- vCPU 1: core scheduling cookie = 0xd48e86e
Signed-off-by: Rob Bradford <rbradford@meta.com>
The current implementation performs multiple operations on allocators in
a row, with the single goal of updating the allocator. For each of these
operations, the `Mutex` guarding the respective allocator is locked anew
which introduces room for race conditions.
Instead of locking the mutex multiple times, we should lock it once to
perform the whole move.
Signed-off-by: Pascal Scholz <pascal.scholz@cyberus-technology.de>
On-behalf-of: SAP pascal.scholz@sap.com
Vm::create_device_manager accepted both config and _vm_config, but
both represented the same VM configuration source. Remove _vm_config
from the function signature and from its call site, and use config
for the TDX dynamic check.
This is a cleanup-only refactor with no intended functional change.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
There is no non destructive readonly ioctl to query block device
discard or write zeroes capabilities. BLKZEROOUT is guaranteed to
succeed via kernel software fallback. BLKDISCARD may fail at runtime
with EOPNOTSUPP on devices that lack trim support, but the error
propagates to the guest as VIRTIO_BLK_S_IOERR and well behaved
guests handle it gracefully.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
The Windows tests use a DM snapshot device for the OS disk.
DM snapshot targets do not support BLKDISCARD, so the VMM returns
IOERR for every TRIM attempt. viostor.sys may BSOD when the host
returns an error for negotiated discard/write-zeroes operations.
Add a default_disks_sparse_off() helper to GuestCommand and use it
in all Windows tests.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Verify that the guest remains stable when BLKDISCARD fails on the
host backend. DM snapshot targets do not support discard, so the
VMM returns VIRTIO_BLK_S_IOERR. The test retries blkdiscard several
times, checking guest responsiveness after each attempt, then
confirms normal I/O still works.
The DM topology follows the same pattern used by WindowsDiskConfig.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Verify that a loopback block device advertises
VIRTIO_BLK_F_DISCARD to the guest and that blkdiscard succeeds.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
