TL;DR: Improved developer productivity for many contributors
Add a shared .editorconfig so contributors get lightweight,
editor-native hints while writing code instead of only discovering
formatting issues later in style checks.
This is advisory, but useful: editors can already guide indentation,
whitespace, line endings, and final newlines as you type. They can also
show a visual guide at the 80-character line width, which is one of the
main motivations here. Most LLM-generated code and contributions over
the past year have already conventionally followed the 80-character
limit, so this makes the expected style visible and consistent for
everyone.
.editorconfig is a decade-old standard, and virtually every editor or
IDE supports it.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
Initial attempt for a lightweight AGENTS.md to improve working with
LLMs on this repository and avoid common pitfalls.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
User-defined zones may be mapped private. Create a memfd for private
zones so that fallocate operations are available on all regions, not
just shared ones. This prepares for zone management via hole punching.
The MAP_ANONYMOUS flag is now omitted since the memory becomes
tmpfs-backed via memfd.
Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
When a guest resets a device by writing status=0 and reinitializes
without enabling queues before writing DRIVER_OK, the activation
path would collect zero ready queues and treat that as a fatal
error, killing the entire VMM process.
The PCI transport now checks that at least one queue is ready
before reporting that the device needs activation. This prevents
a spurious activation attempt that would fatally fail when no
queues are enabled.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Add common PCI device configuration to the virtio-console device
configuration. This allows setting the device ID (the name), ID, the
PCI segment, and the PCI device ID (BDF), which were previously not
configurable for the virtio-console device.
This gives management software, such as libvirt, more control over PCI
resource assignment and aligns virtio-console with other devices that
already support this functionality [0].
[0] https://github.com/cloud-hypervisor/cloud-hypervisor/issues/8175
On-behalf-of: Philipp Schuster <philipp.schuster@sap.com>
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
`--serial` still accepted `iommu=on|off` from the shared serial/console
configuration shape, even though only virtio-console has a meaningful
IOMMU connection.
Cloud Hypervisor wires virtio-iommu support through DMA-capable
virtio/VFIO PCI endpoints. The serial devices are legacy UARTs accessed
through PIO or MMIO registers, so exposing an IOMMU option there is
misleading.
On-behalf-of: Philipp Schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
This commit introduces a new struct `CommonConsoleConfig` which is the
base for the split into `ConsoleConfig` and `SerialConfig`. This is a
pre-requisite for allowing more configurable PCI options for the
virtio-console device.
The commit doesn't change or add any functionality.
On-behalf-of: Philipp Schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
config_generation is a u8 and the spec mandates wrap around.
Verify the increment past 0xff lands on 0x00 without panicking
under overflow checks.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Cover the three observable cases of consume_config_change. With
the flag set the counter advances by one and the flag is cleared.
With the flag clear the call is a no-op. A burst of flag sets
between two reads results in only one bump, which is the wrap
hazard mitigation the spec asks for.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
A Config trigger must set the config_changed flag so the next
device specific configuration read can bump config_generation. A
Queue trigger must leave the flag alone.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Set a config_changed flag in VirtioInterruptMsix when a Config
interrupt fires, and increment config_generation only when the
driver next reads the device specific configuration region. The
flag is cleared by that read so the driver observes a stable
value across the read and a fresh value on any later read.
This avoids the wrap hazard of incrementing on every Config
event, where a burst of interrupts could roll the 8 bit counter
back to its previous value between two driver reads.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Convert the u8 field to Arc<AtomicU8> so the interrupt path can
mutate it without holding the common config mutex. Reads at
offset 0x15 use Acquire ordering. State serialization preserves
the value.
Update the three unit tests that construct
VirtioPciCommonConfig directly.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
This prints the time in the local time. The "Z" suffix usually indicates
UTC time. This is left over from when there was manual implementation
using libc::gmtime()
Signed-off-by: Rob Bradford <rbradford@meta.com>
An edk2 boot is needed for ACPI support but the stock ARM64 kernel does
not support ACPI memory hotplug or virtio-pmem. For now disable those
tests but track them in #8187.
Signed-off-by: Rob Bradford <rbradford@meta.com>
This is a niche feature and we were overly testing it. Let's just switch
to two tests. One for live migration and one for plain watchdog. This
will reduce the CI time. As we are now running these tests sequentially
we can also reduce some the delays in the tests.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Focal has served us well for many years but is now beyond EOL. Remove
all remaining use of focal images from the CI.
Signed-off-by: Rob Bradford <rbradford@meta.com>
The PciDeviceHandle::VfioUser arm in eject_device propagated dma_unmap
failures with ?, which short-circuited the subsequent
remove_dma_mapping_handler loop and left stale Arc<VfioUserDmaMapping>
entries in every virtio-mem device's handler map. Log unmap errors
with warn! and continue so the handler map cleanup always runs.
This only happens if a vfio-user process crashes and the same device is
later removed. However, given we've seen similar issues on vhost-user
this is probably worth cleaning up.
Signed-off-by: Dylan Reid <dgreid@fb.com>
The BusDevice read and write arms for B0EJ_FIELD_OFFSET and
PSEG_FIELD_OFFSET opened with assert!/assert_eq! on data.len(), so a
guest 1/2/8-byte MMIO access to either register panicked the vCPU
thread. Replace each assert with a warn! and early return so unusual
access widths are logged and ignored instead of crashing the VMM.
Signed-off-by: Dylan Reid <dgreid@fb.com>
self.balloon and self.virtio_mem_devices are not updated when
eject_device removes the underlying device, leaving stale
Arc<Mutex<...>> entries that resize_balloon / balloon_size and the
virtio-mem DMA-handler iteration would dereference if reached after
eject. Clear self.balloon and retain-out the matching virtio-mem entry
in the PciDeviceHandle::Virtio eject arm, identifying the ejected
device by Arc pointer-equality against the already-resolved
Arc<Mutex<dyn VirtioDevice>>.
This change is defensive: DeviceManager::remove_device currently
rejects VirtioDeviceType::Balloon and VirtioDeviceType::Mem with
RemovalNotAllowed before pci_devices_down is set, so the guest never
sees an eject notification and eject_device is never reached for
either type today. If the allowlist is extended later, this cleanup
keeps the post-eject state consistent.
Signed-off-by: Dylan Reid <dgreid@fb.com>
Currently only the existing format options are supported and the default
format string is unchanged. This allows more fine grained logging
control.
Assisted-by: Claude:Opus-4.7
Signed-off-by: Rob Bradford <rbradford@meta.com>
Introduces a custom format string parser for use for log entries. For
now only the existing format string entries are covered and the default
format string matches the existing behaviour.
The format string is tokenized once and then that token stream is used
for each log entry.
Assisted-by: Claude:Opus-4.7
Signed-off-by: Rob Bradford <rbradford@meta.com>
In preparation for extending its functionality, refactor the Logger
struct and its implementation to a new file / module.
Assisted-by: Claude:Opus-4.6
Signed-off-by: Rob Bradford <rbradford@meta.com>
process_queue() unwrapped four guest-reachable Results.
Convert each unwrap to a logged error path. A failed status write is
demoted to len = 0 so the head is still retired via add_used; an
add_used failure breaks the batch (queue is in a bad state); a
needs_notification failure signals; a signal failure is logged. The
daemon stays up.
Signed-off-by: Dylan Reid <dgreid@fb.com>
set_config() split the config slice at `offset` and copy_from_slice'd
the entire suffix, which asserts src.len() == self.len(). This panics if
the guest issues a write shorter than `config_len - offset`.
Signed-off-by: Dylan Reid <dgreid@fb.com>
Although a response is sent to the client these errors are not logged in
the log file making it hard to cross reference these with other log
entries.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Currently when the socket is disconnected by the other end there is no
logging of such an event. Add a log to aid identifying when this has
happened.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Abandon the reconnection to the vhost-user socket if the kill_evt is
fired because e.g. a device removal request has come in during the
reconnection.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Replace the use of sleeps with a TimerFd. Initially this is functionally
equivalent but it can be extended to also handle other events.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Drop inflate or deflate descriptors whose len exceeds the Linux
driver maximum of VIRTIO_BALLOON_ARRAY_PFNS_MAX PFN entries of 4
bytes each. Without the cap, a guest can submit a descriptor with
a huge len over a small backing and drive an unbounded warn loop
in the device thread.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
The old implementation used an ever monotonically increasing u32 counter
to allocate new GSIs. The counter increased every time a new GSI was
allocated, and freeing GSIs was not possible. Thus, Cloud Hypervisor
can run out of GSIs and panics. This currently happened at the 1024th
GSI [0]. Further, this caused the `KVM_SET_GSI_ROUTING` ioctl to carry
much more payload than needed.
This new implementation uses a bitmap for proper tracking of resources
and can gracefully free GSIs - this is abstracted in type
InterruptAllocator.
Please note that this commit only replaces the old mechanism. The next
commit will introduce freeing used GSIs automatically when an
InterruptRoute is dropped.
While being on this, we also propagate the errors that the allocator may
throw where necessary.
Co-authored-by: Sebastian Eydam <sebastian.eydam@cyberus-technology.de>
On-behalf-of: SAP sebastian.eydam@sap.com
Signed-off-by: Sebastian Eydam <sebastian.eydam@cyberus-technology.de>
On-behalf-of: Philipp Schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
When an SEV-SNP guest transitions pages from private to shared via
KVM_HC_MAP_GPA_RANGE, punch holes in the corresponding guest_memfd
backing it. Without this the balloon driver's `set_memory_decrypted()`
path transitions the page attributes but the physical memory stays
pinned in guest_memfd, making virtio-balloon ineffective for memory
overcommit with confidential VMs. Even without ballooning these pages
are unused by the guest so consume resources. This mirrors the hole
punching that the balloon device does for releasing pages.
The memory_slots Arc is cloned into each KvmVcpu at creation so the
punch can happen in the vcpu thread.
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Rob Bradford <rbradford@meta.com>
Replace the bare OwnedFd map (guest_memfds) with a KvmMemorySlot struct
wrapped in an Arc so it can later be shared with KvmVcpu. This is a
pure refactor with no functional change; KvmMemorySlot currently holds
only the guest_memfd OwnedFd.
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Rob Bradford <rbradford@meta.com>
block::Error implements Display via thiserror, so the user facing
log lines do not need the Debug formatter.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
With the per handler needs_reset() gates removed from net and
block, nothing reads DEVICE_NEEDS_RESET anymore. Drop the
device_needs_reset helper and refresh the doc comment on
mark_device_needs_reset to reflect the central call site in
spawn_virtio_thread, where it runs after the worker has already
exited.
No functional change.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
With virtqueue iterator errors now killing the worker and
spawn_virtio_thread marking NEEDS_RESET centrally, the per
handler needs_reset() gate on process_queue_submit and
process_queue_complete is unreachable.
Drop needs_reset(), the two early returns, the unused
device_status field on BlockEpollHandler and its initializer,
and the device_needs_reset import.
No functional change.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
