When no image_type is specified, sector 0 writes are disabled as a
safety measure for autodetected raw images. Extend this protection
to autodetected fixed VHD images, which carry metadata in the last
sector and are equally susceptible to accidental overwrites of the
first sector when the format is not explicitly acknowledged.
Update the corresponding warning in the virtio block worker to be
format agnostic.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Explanatory comments for the rollback paths in both PCI BAR
relocation branches.
Assisted-by: Claude (Anthropic)
Signed-off-by: CMGS <ilskdw@gmail.com>
After free(old_base), if allocate(new_base) fails the allocator
treats old_base as free even though the MMIO/PIO bus still maps the
device there. Subsequent allocations pick old_base, mmio_bus.insert
hits the live mapping and returns Overlap.
Restore old_base on the failure path in both the Memory*BitRegion
and IoRegion branches before bubbling the error up.
PR #7950 added restore_bar_addr() so the BAR config register stays
consistent on failed move_bar(); this completes the same picture
for the allocator side.
Signed-off-by: CMGS <ilskdw@gmail.com>
Quoting the spec:
> If VHOST_USER_PROTOCOL_F_REPLY_ACK is negotiated, and the back-end
> sets the VHOST_USER_NEED_REPLY flag, the front-end must respond with
> zero when operation is successfully completed, or non-zero
> otherwise.
cloud-hypervisor would previously not send a response to a
VHOST_USER_BACKEND_CONFIG_CHANGE_MSG message, even if
VHOST_USER_PROTOCOL_F_REPLY_ACK had been negotiated and
VHOST_USER_NEED_REPLY was set, in violation of the spec.
Link: https://qemu-project.gitlab.io/qemu/interop/vhost-user.html#back-end-message-types
Fixes: 8d6213338 ("virtio-devices: generic-vhost-user: Config change notification")
Signed-off-by: Alyssa Ross <hi@alyssa.is>
Event expectation helpers print detailed diagnostics when the observed
event stream does not match the expected one. That is useful for direct
assertions, but it becomes extremely noisy [0] when the helper is used
as the predicate for wait_until(), because every polling attempt emits
the full mismatch dump.
Add quiet wait wrappers for event polling and emit the existing detailed
diagnostics only once after the timeout expires.
[0] https://github.com/cloud-hypervisor/cloud-hypervisor/actions/runs/25745401604/job/75619840718?pr=8021
On-behalf-of: Philipp Schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
The test_vdpa_net integration test brings the vDPA-backed interface
(ens6) up and then asserts that both TX and RX packet counters are
exactly zero before sending an explicit ping. On guest kernels that
perform IPv6 link-local autoconfiguration quickly enough, however,
Router Solicitation / Neighbor Discovery frames are emitted as soon
as the link comes up. The vdpa_sim_net device loops those frames back
to the interface, so by the time the test queries
ip -j -p -s link show ens6 | grep -c '"packets": 0'
the TX and RX counters are already non-zero and the precondition
assertion fails (observed reliably with the Microsoft internal guest
kernel running on MSHV).
Disable IPv6 / accept_ra / autoconf on ens6 before bringing the link
up. With IPv6 disabled no autoconf traffic is generated, the counters
remain at zero until the explicit 'ping 172.16.1.10 -c 6' generates
exactly the 6 packets the rest of the test expects on each direction,
and the vDPA-specific portion of the test is unchanged.
Verified on an MSHV Azure VM (Linux 6.6.121.mshv2):
test common_parallel::test_vdpa_net ... ok
test result: ok. 1 passed; 0 failed; ...; finished in 26.13s
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Using `jiff::Timestamp::now()` instead of `jiff::Zoned::now()` skips the
timezone logic required for `Zoned`. This makes the timestamp UTC, with
the appropriate `Z` suffix.
On-behalf-of: SAP julian.schindel@sap.com
Signed-off-by: Julian Schindel <julian.schindel@cyberus-technology.de>
If a guest observes DEVICE_NEEDS_RESET, resets the device, and tries to
re-initialize it, but the VMM knows the backend is disconnected, we can
short-circuit the doomed activation.
This is not incorrect, but saves the VMM from making several round-trip
calls to a peer process that doesn't exist. It'll also make the logs
cleaner.
Signed-off-by: Dylan Reid <dgreid@fb.com>
resume() mirrors pause() for backend communication: it skips the
vhost-user backend call when the device is already disconnected, and it
marks newly failed resume_vhost_user() calls disconnected only when the
classifier identifies transport loss.
Signed-off-by: Dylan Reid <dgreid@fb.com>
pause() returns DeviceDisconnected without calling into the backend when
VhostUserCommon already knows the socket is gone. DeviceManager treats
only that sentinel as log-and-continue, so one dead vhost-user device
does not abort the whole pause iteration.
Signed-off-by: Dylan Reid <dgreid@fb.com>
For add memory region, if the backend is disconnected or returns an
error, forward the appropriate error type to the caller. If the error
indicates that the vhost user backend has disconnected, mark it as such.
Signed-off-by: Dylan Reid <dgreid@fb.com>
reset() is teardown and must still clean up local state even if the
vhost-user backend has already gone away. When the disconnected flag is
already set, it skips reset_vhost_user() and proceeds with kill-event,
worker-unblock, event logging, and interrupt callback cleanup.
Signed-off-by: Dylan Reid <dgreid@fb.com>
This function hasn't been used since '22.
All callers removed with:
1f0e5eb66 vmm: virtio-devices: Restore every VirtioDevice upon creation
TEST: build and cargo test all still pass, grep returns no results.
Signed-off-by: Dylan Reid <dgreid@fb.com>
Add two explicit disconnected-backend error paths before wiring them
into the call sites.
MigratableError::DeviceDisconnected is the lifecycle sentinel for
operations that were skipped because a component is already known to be
disconnected. It lets the caller log and continue without treating it as
a VMM-fatal condition.
Error::BackendDisconnected is the vhost-user-local error used when
VhostUserCommon refuses to call a backend after its disconnected flag is
set. The transport classifier treats socket close/reset/EOF and
vhost-user partial-message/disconnected cases as transport loss, while
backend NACKs, invalid protocol state, and retry-able socket errors
remain ordinary operation failures.
Signed-off-by: Dylan Reid <dgreid@fb.com>
Add a 'disconnected' flag shared between VhostUserCommon and
VhostUserEpollHandler. This flag is set whenever the run loop hits an
error that would cause an exit (failed reconnect, broken backend req
handler, unknown event).
Following commits will use this to gate backend calls in order to avoid
repeated timeouts and errors when a backend disappears. This will
simplify shutdown sequencing for orchestrators using vhost-user devices.
Signed-off-by: Dylan Reid <dgreid@fb.com>
Slack's join.* endpoints reject automated GETs
and return 403, so lychee was failing the link availability
check on any PR that touched README.md
Add the join.slack.com/t/ prefix to the .lychee.toml
exclude list
Signed-off-by: Saravanan D <saravanand@crusoe.ai>
cloud-hypervisor/edk2 publishes prebuilt CLOUDHV.fd (x86-64) and
CLOUDHV_EFI.fd (AArch64) as release assets. docs/uefi.md only
described the build from source, and the AArch64 firmware
customizations required for cloud-hypervisor were left undocumented.
Add a "Using Prebuilt UEFI Firmware" section to docs/uefi.md and
an "AArch64 Firmware Notes" section covering both customizations.
Updates to "Building UEFI Firmware for AArch64" section.
Switch the boot examples from --kernel to --firmware, which is the
direct UEFI load path on AArch64.
Minor README.md updates.
Signed-off-by: Saravanan D <saravanand@crusoe.ai>
Bump the wait_until timeout for the guest-visible memory growth in
test_nvidia_card_memory_hotplug from 5s to 15s. The hot-add path inside
the guest kernel can take longer than 5s particularly when using
virtio-mem, which has been a source of flakes for this test.
Drop the trailing assert!(guest.get_total_memory() > 5_760_000), as it
is redundant.
See: #8160
Signed-off-by: Bo Chen <bchen@crusoe.ai>
The shared /tmp/cloud-hypervisor/ path is created by the first user to
run dev_cli.sh and owned by them, so other users on the same host fail
the +x+w check and cannot chmod it back. Move both tmp paths under
/tmp/cloud-hypervisor-${USER}/ so each user gets their own tree.
While here, fold the local BUILD_DIR in build_container() into the
existing (previously unused) CLH_CTR_BUILD_DIR, which ensure_build_dir()
already creates.
Assisted-by: Claude:Opus-4.7
Signed-off-by: Bo Chen <bchen@crusoe.ai>
TL;DR: Improved developer productivity for many contributors
Add a shared .editorconfig so contributors get lightweight,
editor-native hints while writing code instead of only discovering
formatting issues later in style checks.
This is advisory, but useful: editors can already guide indentation,
whitespace, line endings, and final newlines as you type. They can also
show a visual guide at the 80-character line width, which is one of the
main motivations here. Most LLM-generated code and contributions over
the past year have already conventionally followed the 80-character
limit, so this makes the expected style visible and consistent for
everyone.
.editorconfig is a decade-old standard, and virtually every editor or
IDE supports it.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
Initial attempt for a lightweight AGENTS.md to improve working with
LLMs on this repository and avoid common pitfalls.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
User-defined zones may be mapped private. Create a memfd for private
zones so that fallocate operations are available on all regions, not
just shared ones. This prepares for zone management via hole punching.
The MAP_ANONYMOUS flag is now omitted since the memory becomes
tmpfs-backed via memfd.
Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
When a guest resets a device by writing status=0 and reinitializes
without enabling queues before writing DRIVER_OK, the activation
path would collect zero ready queues and treat that as a fatal
error, killing the entire VMM process.
The PCI transport now checks that at least one queue is ready
before reporting that the device needs activation. This prevents
a spurious activation attempt that would fatally fail when no
queues are enabled.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Add common PCI device configuration to the virtio-console device
configuration. This allows setting the device ID (the name), ID, the
PCI segment, and the PCI device ID (BDF), which were previously not
configurable for the virtio-console device.
This gives management software, such as libvirt, more control over PCI
resource assignment and aligns virtio-console with other devices that
already support this functionality [0].
[0] https://github.com/cloud-hypervisor/cloud-hypervisor/issues/8175
On-behalf-of: Philipp Schuster <philipp.schuster@sap.com>
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
`--serial` still accepted `iommu=on|off` from the shared serial/console
configuration shape, even though only virtio-console has a meaningful
IOMMU connection.
Cloud Hypervisor wires virtio-iommu support through DMA-capable
virtio/VFIO PCI endpoints. The serial devices are legacy UARTs accessed
through PIO or MMIO registers, so exposing an IOMMU option there is
misleading.
On-behalf-of: Philipp Schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
This commit introduces a new struct `CommonConsoleConfig` which is the
base for the split into `ConsoleConfig` and `SerialConfig`. This is a
pre-requisite for allowing more configurable PCI options for the
virtio-console device.
The commit doesn't change or add any functionality.
On-behalf-of: Philipp Schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
config_generation is a u8 and the spec mandates wrap around.
Verify the increment past 0xff lands on 0x00 without panicking
under overflow checks.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Cover the three observable cases of consume_config_change. With
the flag set the counter advances by one and the flag is cleared.
With the flag clear the call is a no-op. A burst of flag sets
between two reads results in only one bump, which is the wrap
hazard mitigation the spec asks for.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
A Config trigger must set the config_changed flag so the next
device specific configuration read can bump config_generation. A
Queue trigger must leave the flag alone.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Set a config_changed flag in VirtioInterruptMsix when a Config
interrupt fires, and increment config_generation only when the
driver next reads the device specific configuration region. The
flag is cleared by that read so the driver observes a stable
value across the read and a fresh value on any later read.
This avoids the wrap hazard of incrementing on every Config
event, where a burst of interrupts could roll the 8 bit counter
back to its previous value between two driver reads.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Convert the u8 field to Arc<AtomicU8> so the interrupt path can
mutate it without holding the common config mutex. Reads at
offset 0x15 use Acquire ordering. State serialization preserves
the value.
Update the three unit tests that construct
VirtioPciCommonConfig directly.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
This prints the time in the local time. The "Z" suffix usually indicates
UTC time. This is left over from when there was manual implementation
using libc::gmtime()
Signed-off-by: Rob Bradford <rbradford@meta.com>
An edk2 boot is needed for ACPI support but the stock ARM64 kernel does
not support ACPI memory hotplug or virtio-pmem. For now disable those
tests but track them in #8187.
Signed-off-by: Rob Bradford <rbradford@meta.com>
This is a niche feature and we were overly testing it. Let's just switch
to two tests. One for live migration and one for plain watchdog. This
will reduce the CI time. As we are now running these tests sequentially
we can also reduce some the delays in the tests.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Focal has served us well for many years but is now beyond EOL. Remove
all remaining use of focal images from the CI.
Signed-off-by: Rob Bradford <rbradford@meta.com>
The PciDeviceHandle::VfioUser arm in eject_device propagated dma_unmap
failures with ?, which short-circuited the subsequent
remove_dma_mapping_handler loop and left stale Arc<VfioUserDmaMapping>
entries in every virtio-mem device's handler map. Log unmap errors
with warn! and continue so the handler map cleanup always runs.
This only happens if a vfio-user process crashes and the same device is
later removed. However, given we've seen similar issues on vhost-user
this is probably worth cleaning up.
Signed-off-by: Dylan Reid <dgreid@fb.com>
The BusDevice read and write arms for B0EJ_FIELD_OFFSET and
PSEG_FIELD_OFFSET opened with assert!/assert_eq! on data.len(), so a
guest 1/2/8-byte MMIO access to either register panicked the vCPU
thread. Replace each assert with a warn! and early return so unusual
access widths are logged and ignored instead of crashing the VMM.
Signed-off-by: Dylan Reid <dgreid@fb.com>
