This version is identical but with a new version number as the old
version is yanked due to a semver break.
Signed-off-by: Rob Bradford <rbradford@meta.com>
This test has failed at least once in upstream CI. With the applied
stress workload, reducing the downtime to 1 ms makes it virtually
impossible for CI runners with various speeds to complete VM migration.
In other words: we will always be able to cancel.
On-behalf-of: SAP philipp.schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
Add test_snapshot_restore_virtio_fs which validates that virtio-fs
continues to work correctly across a snapshot/restore cycle.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Enable the DEVICE_STATE protocol feature negotiation for all vhost-user
devices (block, fs, net, and generic). Restoring the state (including
the backend state if present) and vrings.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Add a common method for validating the state (checking vrings &
device_state) and then restoring the backend state if present.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Fetch the opaque device state from the backend and store it along with
the last vring used in the state used for the snapshot.
Signed-off-by: Rob Bradford <rbradford@meta.com>
The vhost-user protocol now has support for the backend to provide an
opaque blob of data (read or written through a pipe) that the VMM can
use to save/restore state after snapshot/restore or live migration.
It also adds a command for checking the backend accepts the uploaded
device state. One quirk of saving the state is that GET_VRING_BASE must
be used first to quiesce the state of the backend and flush any
in-flight requests. This then also requires saving that index for use on
the restore.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Rename update_supports_migration() to update_supported_features() as
this method will be extended to track additional capability flags beyond
just migration support (e.g. DEVICE_STATE for snapshot/restore.)
Signed-off-by: Rob Bradford <rbradford@meta.com>
This is a refactoring step in preparation for fetching backend device
state via SET_DEVICE_STATE_FD which can fail.
Signed-off-by: Rob Bradford <rbradford@meta.com>
In GenericVhostUser's read_config and write_config, access
vu_common.acked_protocol_features directly instead of going through
the state() method which creates a struct. This removes creating the
struct just to access two fields that are already directly accessible.
Signed-off-by: Rob Bradford <rbradford@meta.com>
With a common state structure for all vhost-user devices the state()
methods can also be refactored for reuse. This will make it easier to
add new common fields in the future for snapshot/restore.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Each vhost-user device type had near identical State structs.
Deduplicate those by introducing a new common struct (and parameterising
it when it needs to embed a config member.) This will make it easier to
reuse more code in the future and to add more struct members to handle
the requirements of snapshot/restore.
These changes have been designed to have no impact on the existing
snapshot/restore state.
Signed-off-by: Rob Bradford <rbradford@meta.com>
When landlock support was added, creation of file descriptors was
moved out into a function called pre_create_console_devices, with the
idea being that this could be run before Landlock rules are applied
and access to all the necessary paths are dropped.
This idea didn't take reboots into account, though. When a VM is
rebooted, pre_create_console_devices is called again, but now the
Landlock rules have been applied, so they need to allow access to all
those paths anyway.
I imagine the way this was intended to work was that file descriptors
would be preserved across reboot, but that's not currently the case,
and it's not a trivial change to make because they get dropped when
the VM is destroyed. Longer term it would be ideal if Cloud
Hypervisor's implementation was more focused on file descriptors than
paths[1], and if created VMs only took references to file descriptors,
so they were easily preserved across reboots.
Fixes: b3e5738b4 ("vmm: Introduce ApplyLandlock trait")
Closes: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7547
Link: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7704 [1]
Signed-off-by: Alyssa Ross <hi@alyssa.is>
Use logical_size() instead of physical_size() for the byte-range
advisory lock. physical_size() returns st_blocks*512 which is the
actual host allocation and can be smaller than the guest visible
extent on sparse files, leaving part of the range unprotected.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Use query_device_size() instead of metadata().len() to correctly
handle block device and regular file handles.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Use query_device_size() instead of seek(End(0)) and metadata().len()
to correctly handle block device and regular file handles.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Use query_device_size() instead of seek(End(0)) and metadata().len()
to correctly handle block device and regular file handles.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Use query_device_size() instead of seek(End(0)) and metadata().len()
to correctly handle block device and regular file handles.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Add a shared helper that returns the logical size in bytes for both
regular files and block devices using an immutable &File reference.
Regular files use metadata().len(). Block devices use the BLKGETSIZE64
ioctl. Any other file type returns an InvalidInput error.
This avoids seek(SeekFrom::End(0)) which requires &mut self and can
return incorrect results for block devices when the file position is
in an unexpected state.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Add BLKGETSIZE64 0x80081272 to the VMM seccomp ioctl allow list
alongside the existing BLK* ioctls. This is needed for querying
block device size without seeking.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
For VFIO devices with non page aligned MSI-X offsets,
fixup_msix_region() relocates MSI-X table and PBA offsets
into an enlarged virtual BAR by mutating msix.cap in place.
generate_sparse_areas() later reads those relocated offsets
to carve mmap holes, but receives the physical BAR size as
region_size. The relocated offsets exceed the physical BAR
boundary, and the kernel rejects the mmap with EINVAL.
Guard inter_ranges insertion with an offset < region_size
check so relocated entries are skipped. The full physical
BAR is mmapped as a single region. The relocated MSI-X in
the upper half of the virtual BAR remains trapped because
it has no mmap backing.
Linux kernel commit a32295c612c5 ("vfio-pci: Allow mapping
MSIX BAR") allows mmapping the entire BAR including the
MSI-X region when VFIO_REGION_INFO_CAP_MSIX_MAPPABLE is
advertised. The actual security guarantees come from IOMMU
isolation and interrupt remapping, not from filtering
MSI-X table accesses. QEMU follows the same pattern,
mmapping the entire physical BAR when MsixMappable is
present.
Fixes: #7898
Signed-off-by: Saravanan D <saravanand@crusoe.ai>
Following the `VfioContainer` to `VfioOps` trait switch, update the
remaining field names, method names, comments, and log messages to use
`vfio_ops` and "host IOMMU address space" consistently.
No fucntional changes.
Signed-off-by: Bo Chen <bchen@crusoe.ai>
Replace the concrete `VfioContainer` type with the `VfioOps` trait
object for device passthrough. This decouples the VFIO DMA mapping
interface from the legacy VFIO container/group implementation, allowing
it to be extended to support VFIO cdev and iommufd in the future.
Signed-off-by: Bo Chen <bchen@crusoe.ai>
Use IFS-based splitting instead of parameter expansion to
correctly separate '#'-delimited volume paths in
process_volumes_args(). The previous approach placed all
volumes into a single array element, causing Docker to
receive malformed --volume arguments.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Previously this code could lead to the device being trying to be
activated multiple times as the code to trigger the activation was based
on the state of the device (not yet activated and device being ready).
This could occur if anothe vCPU wrote to a PCI BAR on this device before
the device activation was completed by the VMM thread. Now we only
trigger the activation if the device readiness has changed as a result
of this BAR write (by checking that the readiness was originally
unready.)
Signed-off-by: Rob Bradford <rbradford@meta.com>
The actual size of the balloon is taken directly from the guest. A
misbehaving guest can set it to an arbitrary value and cause underflow
on the next vm.info call. Use a saturation_sub instead to avoid a panic
in a debug build or a crazy number in a release build.
Signed-off-by: Dylan Reid <dgreid@dylanreid.com>
As far as I can tell, PIDTYPE_PID is a kernel-internal name, and
PR_SCHED_CORE_SCOPE_THREAD is the UAPI name. There's no PIDTYPE_PID
in the UAPI headers, and the core scheduling documentation says that
the fourth prctl argument should be a "PR_SCHED_CORE_SCOPE_-prefixed
macro constant".
Link: https://www.kernel.org/doc/html/v6.19/admin-guide/hw-vuln/core-scheduling.html#usage
Fixes: 3f800d2bb ("vmm: Add core scheduling support for vCPU threads")
Signed-off-by: Alyssa Ross <hi@alyssa.is>
Switch to a git hash of virtiofsd as unfortunately the last release is
some time ago and does not incorporate a dependency bump that enables it
to work with snapshot-restore.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Add a CVM integration test for vdpa_block that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro and with_cpu(2).
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for macvtap_hotplug that validates
the same functionality using a confidential guest with the
basic_cvm_guest macro and with_cpu(2).
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for macvtap that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro and with_cpu(2).
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for tap_from_fd that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro and with_cpu(2).
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for pvpanic that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for watchdog that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro and FOCAL_IMAGE_NAME.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for counters that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for net_hotplug that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for disk_hotplug that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for landlock that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for memory_overhead that validates
the same functionality using a confidential guest with the
basic_cvm_guest macro and custom memory size.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for pci_bar_reprogramming that
validates the same functionality using a confidential guest
with the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for direct_kernel_boot_noacpi
that validates the same functionality using a confidential
guest with the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for console_file that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for virtio_console that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for serial_off that validates
the same functionality using a confidential guest with
the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add a CVM integration test for multiple_network_interfaces
that validates the same functionality using a confidential
guest with the basic_cvm_guest macro.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract test logic from test_vdpa_block into a shared
_test_vdpa_block wrapper function in tests_wrappers.rs.
The vdpa module check is kept in the parent test case.
Update the parent to use basic_regular_guest macro with
with_cpu(2). The wrapper uses default_kernel_cmdline()
for kernel/cmdline setup.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract test logic from _test_macvtap into a shared wrapper
function in tests_wrappers.rs. Update both test_macvtap and
test_macvtap_hotplug to use the basic_regular_guest macro
with with_cpu(2). The wrapper uses default_kernel_cmdline()
for kernel/cmdline setup.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract test logic from test_tap_from_fd into a shared
_test_tap_from_fd wrapper function in tests_wrappers.rs.
Update the parent test case to use the basic_regular_guest
macro with with_cpu(2). The wrapper uses
default_kernel_cmdline() for kernel/cmdline setup.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
