Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_virtio_vsock_hotplug. The aarch64 variant chains
with_kernel_path for EDK2 firmware support.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_virtio_vsock for consistency and reduced boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_direct_kernel_boot for consistency and reduced
boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_pci_multiple_segments for consistency and reduced
boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_virtio_net_ctrl_queue for consistency and reduced
boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_pci_msi for consistency and reduced boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_power_button for consistency and reduced boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_virtio_queue_affinity, chaining with_cpu(4) for the
required CPU count configuration.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_cpu_affinity, chaining with_cpu(2) for the required
CPU count configuration.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Replace manual UbuntuDiskConfig and GuestFactory guest
creation with the basic_regular_guest! macro in
test_multi_cpu for consistency and reduced boilerplate.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move the DMI serial number test logic from integration.rs
into a shared _test_dmi_serial_number() function in
tests_wrappers.rs. The original test now delegates to
this shared function, enabling reuse by CVM tests.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM variant of the split IRQ chip test in
integration_cvm.rs. This test creates a confidential
guest and invokes the shared _test_split_irqchip()
wrapper to validate split IRQ chip behavior under CVM.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move the split IRQ chip test logic from integration.rs
into a shared _test_split_irqchip() function in
tests_wrappers.rs. The original test now delegates to
this shared function, enabling reuse by CVM tests.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM variant of the virtio block dynamic VHDX expand
test in integration_cvm.rs. This test creates a
confidential guest and invokes the shared
_test_virtio_block_dynamic_vhdx_expand() wrapper to
validate VHDX expansion under CVM.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move the virtio block dynamic VHDX expand test logic from
integration.rs into a shared _test_virtio_block_dynamic_
vhdx_expand() function in tests_wrappers.rs. The original
test in integration.rs now calls this shared function,
enabling reuse by CVM tests.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Refactor test_focal_ovmf to use the basic_regular_guest!
macro with the with_kernel() builder instead of manually
constructing UbuntuDiskConfig and setting kernel_path.
This also removes leftover unused disk_config in
test_focal_hypervisor_fw.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Introduce a basic_regular_guest! macro in integration.rs
to reduce boilerplate when creating regular (non-CVM)
guest instances. Also add a with_kernel() builder method
to Guest in test_infra, allowing fluent configuration of
the kernel path.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Introduce a basic_cvm_guest! macro in integration_cvm.rs
to reduce boilerplate when creating confidential VM guest
instances. This replaces repetitive UbuntuDiskConfig and
GuestFactory::new_confidential_guest_factory() calls
across multiple CVM test functions.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move all CVM (Confidential VM) integration tests from
integration.rs into a dedicated integration_cvm.rs file.
This separation improves code organization and makes it
easier to manage CVM-specific test cases independently
from regular integration tests.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
This summarizes the latest state all relevant parties have agreed on
in the last meeting.
This commit was rephrased and improved with the help of Claude Code
using the Sonnet 4.6 model.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
On-behalf-of: SAP philipp.schuster@sap.com
Mosts tests used 4GB of RAM, although the VM is mostly idling. In CI, we
experienced OOM issues on the ARM runners. If we reduce the VM memory of
the parallel live migration tests to 1.5GB RAM, we still have enough
capacity in the VM so that everything succeeds while reducing resource
usage.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
On-behalf-of: SAP philipp.schuster@sap.com
This adds two new integration tests for the new functionality:
- VM under load, downtime=1ms, timeout=1s, timeout_strategy=cancel
- VM under load, downtime=1ms, timeout=1s, timeout_strategy=force
By using a short downtime and timeout plus adding a stress worker in the
guest, we can prevent quick migration. Therefore, we can nicely test the
timeout_strategy.
Testing for a specific downtime is cumbersome to do and highly depends
on CPU/host utilization. To prevent flakiness, there is no such test
integration test. I did, however, manual testing of that functionality.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
On-behalf-of: SAP philipp.schuster@sap.com
Wire the new `downtime_ms`, `timeout_s`, and `timeout_strategy` fields
from `VmSendMigrationData` into the precopy loop, replacing the previous
hard-coded 5-iteration cap.
Each iteration now evaluates three convergence criteria in order:
- no dirty pages remain;
- the estimated final-iteration downtime is within the configured budget
- or the overall migration timeout has elapsed.
On timeout, `TimeoutStrategy::Cancel` aborts and keeps the VM live on
the source, while `TimeoutStrategy::Force` proceeds regardless of the
downtime target. The convergence callback is updated to return a Result
to propagate the cancel error cleanly up the call stack.
With the recent changes [0], it is fairly easy to implement the new
checks and operate on actual metrics.
These changes are inspired by [1] but differ significantly in details.
[0] https://github.com/cloud-hypervisor/cloud-hypervisor/pull/7799
[1] https://github.com/cloud-hypervisor/cloud-hypervisor/pull/7033
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
On-behalf-of: SAP philipp.schuster@sap.com
Management software needs fine-grained control over live migration to
meet QoS requirements for VM guests. Add `downtime_ms`, `timeout_s`, and
`timeout_strategy` fields to `VmSendMigrationData`, exposed via API.
This commit contains the API changes only; the VMM does not yet act on
these values. This follows in the next commit.
For the JSON API, downtime and timeout are represented as plain integers
(downtime_ms and timeout_s) to make the units explicit. Using Duration
directly would require custom (de)serialization logic, so instead the
internal raw integers are exposed as Duration via getters. This
introduces minor conversion overhead but keeps the Rust API clear and
unambiguous.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
On-behalf-of: SAP philipp.schuster@sap.com
This change prepares upcoming options (following commit) that are added
to VmSendMigrationData.
VmSendMigrationData is a special case as it is currently the only
"rich configuration" type that lives outside `config.rs`, as it is
purely API-facing. Therefore, it isn't integrated into the existing
OptionParser infrastructure. We therefore introduce a `parse()` method
to use that in `ch-remote` in the following.
In `ch-remote`, we remove `--local` for `send-migration` and switch to
the new option string parsing constructor (breaking change!). This
prepares the addition of downtime and timeout options in the following
and streamlines the `ch-remote` command line interface with other
commands, such as `ch-remote add-net`.
Lastly, this commit updates the integration tests.
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
On-behalf-of: SAP philipp.schuster@sap.com
When configuring multiple queues for a virtio device, the guest can
activate between 1 and the configured amount of queues. The firmware,
for example, may activate only one queue, while a Linux guest would
likely activate all available queues.
The constructor of virtio-blk initializes the `paused_sync` barrier
using the configured queue count (plus one for the main thread). This
can be wrong if the guest enable a different number of queues at
activation time, which can make pause hang. Thus, we now recompute the
barrier size from the queues that are actually activated.
On-behalf-of: SAP sebastian.eydam@sap.com
Signed-off-by: Sebastian Eydam <sebastian.eydam@cyberus-technology.de>
When configuring multiple queues for a virtio device, the guest can
activate between 1 and the configured amout of queues. The firmware,
for example, may activate only one queue, while a Linux guest would
likely activate all available queues.
The constructor of virtio-net initializes the `paused_sync` barrier
using the configured queue count (plus one for the main thread). This
can be wrong if the guest enables a different number of queues at
activation time, which can make pause hang. Thus, we now recompute the
barrier size from the queues that are actually activated.
On-behalf-of: SAP sebastian.eydam@sap.com
Signed-off-by: Sebastian Eydam <sebastian.eydam@cyberus-technology.de>
Include the number of segments found in the request payload in
the TooManySegments error variant so the logged message shows
both the actual and maximum values.
Suggested-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Introduce DISCARD_WZ_MAX_PAYLOAD as the precomputed product of
DISCARD_WZ_SEG_SIZE and MAX_DISCARD_WRITE_ZEROES_SEG. Use it in the
DISCARD and WRITE_ZEROES segment count checks instead of repeating
the multiplication inline.
Suggested-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
The libc crate provides all functionality provided by the net_gen crate.
Removing the net_gen crate reduces the maintenance burden.
The switch to libc required some fixes, most notably the switch from a
`Vec<u8>` to a `CString` for the `net_util::Tap.if_name` field.
On-behalf-of: SAP julian.schindel@sap.com
Signed-off-by: Julian Schindel <julian.schindel@cyberus-technology.de>
Bump to the released versions that are compatible wherever possible but
for the vhost and vfio crates they are git hashes as no releases with
compatible versions have yet been made.
Signed-off-by: Rob Bradford <rbradford@meta.com>
This now required after Rust-VMM crate bumps. Also reorder some syscalls
so that they are now in alphabetical order.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Add range validation for DISCARD and WRITE_ZEROES, matching the
existing check in the read/write path. Per virtio spec section
5.2.6.1, a driver must not submit a request which would cause a
read or write beyond capacity. Use checked_add to guard against
overflow, then compare against disk_nsectors.
Without this, requests beyond device capacity pass through to the
host punch_hole/write_zeroes calls, relying on backend specific
behavior rather than returning VIRTIO_BLK_S_IOERR consistently.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Split the data length check into two conditions:
- reject descriptors shorter than one
virtio_blk_discard_write_zeroes segment, and
- reject payloads exceeding MAX_DISCARD_WRITE_ZEROES_SEG segments
Previously only the minimum length was checked and extra segments
were silently dropped.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
All public qcow functions now return BlockResult with explicit error
classification at every site. The temporary From impl introduced in
the first commit of this series is no longer needed and is removed.
Internal functions in header.rs and the rebuild_refcounts helpers
stay on qcow::Result. Classification happens at the call site
boundary where qcow::Result meets BlockResult.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch detect_image_type from qcow::Result to BlockResult with
explicit error classification at every I/O site. This is the last
function migrated before the From scaffolding can be removed.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch rebuild_refcounts from qcow::Result to BlockResult. The
inner helper functions remain on qcow::Result since they are purely
internal, and are wrapped with map_err at each call site where they
cross the BlockResult boundary.
InvalidRefcountTableSize errors are classified as CorruptImage since
they indicate inconsistent internal refcount structures rather than
a format violation.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch resize and grow_l1_table from qcow::Result to BlockResult.
All I/O error sites use explicit BlockError::new with the Io kind.
The write_to call in grow_l1_table rewraps WritingHeader as
ResizeIo to preserve the existing error semantics.
The two resize tests that check for ShrinkNotSupported and
ResizeWithBackingFile are updated to match on BlockErrorKind with
downcast to inspect the underlying variant.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Replace remaining automatic From conversions in parse_qcow and
BackingFile::new with explicit BlockError::new calls carrying the
appropriate BlockErrorKind at every error site.
Internal functions that still return qcow::Result (QcowHeader::new,
offset_is_cluster_boundary, clear_autoclear_features and others) are
wrapped with map_err at the boundary. These functions stay on
qcow::Result as they are internal to the qcow module and the
classification belongs at the call site rather than inside the
function itself.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch parse_qcow and BackingFile::new from qcow::Result to
BlockResult. Every early return site now produces an explicit
BlockError with the appropriate kind. Remaining internal calls to
functions still on qcow::Result rely on the From scaffolding and
will be converted in subsequent commits.
Two helpers are added to BlockError. with_kind replaces the
classification on an existing error, used in QcowDiskSync::new to
avoid double wrapping when the caller needs a different kind.
into_source consumes the error and returns the boxed source, used
at the recursive BackingFile open to extract the qcow::Error for
BackingFileOpen without letting qcow::Error hold a BlockError.
The qcow_sync boundary is simplified to a single closure that
operates on the BlockError already returned by parse_qcow.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch the public QcowFile constructors (new, new_from_backing,
new_from_header, from, from_backing, from_file_and_header) from
qcow::Result to BlockResult. Internal calls to header functions
that still return qcow::Result are wrapped with explicit error
classification at each call site.
Test assertions are updated to match on BlockErrorKind and use
downcast to inspect the underlying qcow::Error variant.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Temporary From impl that classifies each qcow::Error variant into
the appropriate BlockErrorKind. This enables an incremental migration
of qcow functions from qcow::Result to BlockResult, where each
subsequent commit replaces bare ? sites with explicit BlockError::new
calls until this impl can be removed.
The mapping assigns InvalidFormat for structural header violations,
UnsupportedFeature for version and feature mismatches, CorruptImage
for internal inconsistencies, Overflow for nesting depth and Io for
everything else.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Move shared integration test logic out of tests/integration.rs.
Add tests/common/{mod.rs,tests_wrappers.rs,utils.rs} and migrate
API, VM lifecycle, disk/net, and utility helpers.
Update integration.rs to import common modules and keep test
entrypoints thin.
Benefits:
Reduces integration.rs size and duplication
Groups reusable helpers by role
Improves readability and future maintenance
Fixes: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7808
Signed-off-by: Muminul Islam <muislam@microsoft.com>
We only verify devices are under some group but not which one.
With the change, the acpi variable is only needed for aarch64. Add an
underscore prefix to avoid a compilation warning on x86_64.
Signed-off-by: Wei Liu <liuwe@microsoft.com>
