When booting an SEV-SNP guest VM using IGVM with -pvalidate_opt 1 (lazy
page acceptance), the guest kernel's #VC exception handler may issue
VMGEXIT with SVM_EXIT_CPUID (0x72) or SVM_EXIT_MSR (0x7c) exit codes
via the GHCB page protocol. The hypervisor had no handlers for these
exit codes, causing the guest's #VC handler to fail and trigger
sev_es_terminate(), which sends GHCB_MSR_TERM_REQ (0x100). The
hypervisor then panicked on the unhandled 0x100 operation.
Add the following handlers to the GHCB VMGEXIT processing:
- SVM_EXIT_CPUID (0x72): Read function/index/xcr0/xss from the GHCB
page and return CPUID results via get_cpuid_values().
- SVM_EXIT_MSR (0x7c): Handle MSR read (RDMSR) and write (WRMSR)
requests from the guest via the GHCB page protocol.
- GHCB_MSR_TERM_REQ (0x100): Decode reason_set and reason_val from the
GHCB MSR and return an error instead of panicking, allowing graceful
error propagation.
Testing:
Reproducer (on Azure DC16as_cc_v5, /dev/mshv):
cloud-hypervisor --cpus boot=1,nested=off --memory size=512M \
--disk path=osdisk.img path=cloudinit \
--net "tap=,mac=12:34:56:78:90:06,ip=192.168.6.1,mask=255.255.255.128" \
--serial null --console pty \
--api-socket /tmp/ch.sock \
--igvm /igvm_files/linux-ttyS0.bin \
--host-data <hash> --platform sev_snp=on -v
Before fix:
thread 'vcpu0' panicked at hypervisor/src/mshv/mod.rs:1207:30:
Unsupported VMGEXIT operation: 100
After fix: VM boots successfully to login prompt with no panics.
All virtio devices (console, rng, disks) activate normally.
No regression risk for non-SEV-SNP: all new code is within the
HVMSG_X64_SEV_VMGEXIT_INTERCEPT handler which is only reached for
SEV-SNP guests.
Signed-off-by: Souradeep Chakrabarti <schakrabarti@microsoft.com>
Reorder resume() to: set_clock, device_manager.resume,
cpu_manager.resume. This matches the inverse of pause()
which correctly saves the clock before pausing vCPUs.
Signed-off-by: CMGS <ilskdw@gmail.com>
This gives the community more time to react to possible security chain
compromises.
We have high confidence that rust-vmm crates are trusted, and the
community is fully capable of spotting any issues. There is no need to
delay that group.
Signed-off-by: Wei Liu <liuwe@microsoft.com>
Delegate try_clone() to FixedVhd::clone() and new_async_io() to
FixedVhdSync, preserving DiskFileError::NewAsyncIo.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Delegate to FixedVhd::physical_size() which calls file.metadata().
Preserve the crate::Error::GetFileMetadata variant as the BlockError
source for diagnostic chain traversal.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Delegate to FixedVhd::logical_size() which returns the guest
visible capacity parsed from the VHD footer at construction.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Classify the io::Error as BlockErrorKind::Io with ErrorOp::Open.
Update vmm CreateFixedVhdDiskSync to take BlockError.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
try_clone() shares the Arc<Mutex<Vhdx>>. new_async_io() creates
VhdxSync with a cloned Arc (no error path, infallible).
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Delegate try_clone() to FixedVhd::clone() and new_async_io() to
FixedVhdAsync, preserving DiskFileError::NewAsyncIo.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Remove the legacy async_io::DiskFile implementation from
RawFileDiskSync now that the new disk_file trait impls are
in place.
Remove unused imports: Seek, SeekFrom, DiskFile, and
DiskFileResult.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Update device_manager.rs to construct DiskBackend::Next
instead of DiskBackend::Legacy for the synchronous raw
backend.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Update fuzz/block.rs to construct DiskBackend::Next instead
of DiskBackend::Legacy for the synchronous raw backend.
Remove the unused async_io::DiskFile import.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::AsyncDiskFile trait implementation for
RawFileDiskSync with try_clone() and new_async_io() methods.
try_clone() duplicates the underlying file descriptor and
wraps it in a new RawFileDiskSync. new_async_io() creates a
RawFileSync (synchronous fallback) backend, wrapping errors
in BlockError instead of DiskFileError.
Add DiskFileError::Clone variant in async_io.rs for the
try_clone() error path.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add empty disk_file::DiskFile impl for RawFileDiskSync.
This marker supertrait requires DiskSize + Geometry + Sync,
all of which are now satisfied.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::Resizable trait implementation for
RawFileDiskSync. Calls file.set_len(size) and wraps the
I/O error in BlockError on failure.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::SparseCapable trait implementation for
RawFileDiskSync. Delegates to probe_sparse_support() to
detect whether the underlying file supports hole-punching.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::Geometry trait implementation for
RawFileDiskSync. Probes disk topology from the file,
falling back to defaults on failure. Takes &self instead
of &mut self and uses unwrap_or_else for cleaner error
handling.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::DiskFd trait implementation for
RawFileDiskSync. Delegates to file.as_raw_fd() via
BorrowedDiskFd, taking &self instead of &mut self.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::PhysicalSize trait implementation for
RawFileDiskSync. Returns metadata().len() wrapped in
BlockError on failure, consistent with the DiskSize impl.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add disk_file::DiskSize trait implementation for
RawFileDiskSync using BlockError and BlockResult. Uses
metadata().len() instead of seek(SeekFrom::End(0)), taking
&self instead of &mut self.
Add BlockError, BlockErrorKind, BlockResult, and disk_file
imports needed by this and subsequent trait impls.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add #[derive(Debug)] to RawFileDiskSync. This is required
by the new disk_file traits which have Send + Debug bounds.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Update device_manager.rs to construct DiskBackend::Next
instead of DiskBackend::Legacy for the io_uring raw backend.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
