Bump to the released versions that are compatible wherever possible but
for the vhost and vfio crates they are git hashes as no releases with
compatible versions have yet been made.
Signed-off-by: Rob Bradford <rbradford@meta.com>
This now required after Rust-VMM crate bumps. Also reorder some syscalls
so that they are now in alphabetical order.
Signed-off-by: Rob Bradford <rbradford@meta.com>
Add range validation for DISCARD and WRITE_ZEROES, matching the
existing check in the read/write path. Per virtio spec section
5.2.6.1, a driver must not submit a request which would cause a
read or write beyond capacity. Use checked_add to guard against
overflow, then compare against disk_nsectors.
Without this, requests beyond device capacity pass through to the
host punch_hole/write_zeroes calls, relying on backend specific
behavior rather than returning VIRTIO_BLK_S_IOERR consistently.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Split the data length check into two conditions:
- reject descriptors shorter than one
virtio_blk_discard_write_zeroes segment, and
- reject payloads exceeding MAX_DISCARD_WRITE_ZEROES_SEG segments
Previously only the minimum length was checked and extra segments
were silently dropped.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
All public qcow functions now return BlockResult with explicit error
classification at every site. The temporary From impl introduced in
the first commit of this series is no longer needed and is removed.
Internal functions in header.rs and the rebuild_refcounts helpers
stay on qcow::Result. Classification happens at the call site
boundary where qcow::Result meets BlockResult.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch detect_image_type from qcow::Result to BlockResult with
explicit error classification at every I/O site. This is the last
function migrated before the From scaffolding can be removed.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch rebuild_refcounts from qcow::Result to BlockResult. The
inner helper functions remain on qcow::Result since they are purely
internal, and are wrapped with map_err at each call site where they
cross the BlockResult boundary.
InvalidRefcountTableSize errors are classified as CorruptImage since
they indicate inconsistent internal refcount structures rather than
a format violation.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch resize and grow_l1_table from qcow::Result to BlockResult.
All I/O error sites use explicit BlockError::new with the Io kind.
The write_to call in grow_l1_table rewraps WritingHeader as
ResizeIo to preserve the existing error semantics.
The two resize tests that check for ShrinkNotSupported and
ResizeWithBackingFile are updated to match on BlockErrorKind with
downcast to inspect the underlying variant.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Replace remaining automatic From conversions in parse_qcow and
BackingFile::new with explicit BlockError::new calls carrying the
appropriate BlockErrorKind at every error site.
Internal functions that still return qcow::Result (QcowHeader::new,
offset_is_cluster_boundary, clear_autoclear_features and others) are
wrapped with map_err at the boundary. These functions stay on
qcow::Result as they are internal to the qcow module and the
classification belongs at the call site rather than inside the
function itself.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch parse_qcow and BackingFile::new from qcow::Result to
BlockResult. Every early return site now produces an explicit
BlockError with the appropriate kind. Remaining internal calls to
functions still on qcow::Result rely on the From scaffolding and
will be converted in subsequent commits.
Two helpers are added to BlockError. with_kind replaces the
classification on an existing error, used in QcowDiskSync::new to
avoid double wrapping when the caller needs a different kind.
into_source consumes the error and returns the boxed source, used
at the recursive BackingFile open to extract the qcow::Error for
BackingFileOpen without letting qcow::Error hold a BlockError.
The qcow_sync boundary is simplified to a single closure that
operates on the BlockError already returned by parse_qcow.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Switch the public QcowFile constructors (new, new_from_backing,
new_from_header, from, from_backing, from_file_and_header) from
qcow::Result to BlockResult. Internal calls to header functions
that still return qcow::Result are wrapped with explicit error
classification at each call site.
Test assertions are updated to match on BlockErrorKind and use
downcast to inspect the underlying qcow::Error variant.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Temporary From impl that classifies each qcow::Error variant into
the appropriate BlockErrorKind. This enables an incremental migration
of qcow functions from qcow::Result to BlockResult, where each
subsequent commit replaces bare ? sites with explicit BlockError::new
calls until this impl can be removed.
The mapping assigns InvalidFormat for structural header violations,
UnsupportedFeature for version and feature mismatches, CorruptImage
for internal inconsistencies, Overflow for nesting depth and Io for
everything else.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Move shared integration test logic out of tests/integration.rs.
Add tests/common/{mod.rs,tests_wrappers.rs,utils.rs} and migrate
API, VM lifecycle, disk/net, and utility helpers.
Update integration.rs to import common modules and keep test
entrypoints thin.
Benefits:
Reduces integration.rs size and duplication
Groups reusable helpers by role
Improves readability and future maintenance
Fixes: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7808
Signed-off-by: Muminul Islam <muislam@microsoft.com>
We only verify devices are under some group but not which one.
With the change, the acpi variable is only needed for aarch64. Add an
underscore prefix to avoid a compilation warning on x86_64.
Signed-off-by: Wei Liu <liuwe@microsoft.com>
Linux kernel's behavior changes overtime. The grouping can be different
across different versions and different architectures.
We only cares about the exact SBDF exists somewhere. It doesn't matter
which group it is under.
Change the check so that this test case is no longer tied to the
grouping behavior of a particular kernel.
Signed-off-by: Wei Liu <liuwe@microsoft.com>
QcowDiskSync now exclusively uses disk_file::DiskFile and
disk_file::AsyncDiskFile. The old async_io::DiskFile impl is removed
along with its unused imports (DiskFile, DiskFileError, DiskFileResult).
Tests are updated to import the new traits.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Change Block to hold DiskBackend instead of
Box<dyn async_io::DiskFile>. In device_manager, existing formats
(raw, vhd, vhdx) are wrapped in DiskBackend::Legacy while
QcowDiskSync uses DiskBackend::Next. The fuzz target is updated
accordingly.
The Error::DiskResize variant now carries BlockError instead of
DiskFileError, matching the BlockResult return type of
DiskBackend::resize().
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Introduce DiskBackend with two variants:
- Legacy: wraps Box<dyn async_io::DiskFile> for existing formats
- Next: wraps Box<dyn disk_file::AsyncFullDiskFile>
Methods return BlockResult, with DiskFileError converted up to
BlockError on the Legacy path. The Next path passes through
directly with zero conversion overhead.
This is a transitional type. Once all formats implement
AsyncFullDiskFile, DiskBackend and Legacy are removed and
callers hold Box<dyn AsyncFullDiskFile> directly.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Implement try_clone by sharing the metadata Arc and cloning the data
file descriptor. The new_async_io method creates a QcowSync worker
identical to the async_io::DiskFile version.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Add ErrorOp::Resize variant and implement the Resizable trait.
Resize is rejected when a backing file is present.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Advertise support for sparse operations and the zero flag. QCOW2
inherently supports both through cluster deallocation.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Uses the default DiskTopology (512B logical/physical) since
QCOW2 does not probe the underlying device geometry.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Borrows the raw file descriptor from the underlying QcowRawFile
for fcntl() operations. Uses &self for shared access.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Delegate to QcowRawFile::physical_size() which returns the actual
host allocation size of the QCOW2 container file.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Delegate to QcowMetadata::virtual_size() which returns the guest
visible capacity stored in the QCOW2 header.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
The new composable traits require Debug. Implement it manually since
QcowMetadata contains RwLock state that cannot auto derive.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Marker trait combining FullDiskFile and AsyncDiskFile. Blanket impl
covers any type implementing both supertraits.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Marker trait bundling all optional capabilities (PhysicalSize, DiskFd,
SparseCapable, Resizable) on top of DiskFile. Blanket impl covers any
type implementing all constituent traits.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Extend DiskFile with async I/O construction for virtio queue workers.
AsyncDiskFile adds try_clone() for creating independent handles to
the same backing storage, and new_async_io() for constructing an
async I/O engine at the given ring depth.
Bounds: DiskFile + Unpin. Unpin ensures trait objects can be moved
freely (all concrete disk file types are naturally Unpin since they
hold no self referential state).
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Bundles DiskSize and Geometry as the universal disk
capabilities every format must implement. Adds Sync so
that Arc<dyn DiskFile> can be shared across threads for
concurrent readonly access.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Live disk resize support. Single method resize() taking
&mut self and the new size in bytes. Implementations may
return an error if the backend does not support resizing.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Sparse and zero flag support for thin provisioned disk
images. Two methods with false defaults: sparse operations
(punch hole, write zeroes, discard) and zero flag
optimization in WRITE_ZEROES.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Sector and cluster geometry of a disk image. Returns
DiskTopology with a default implementation providing
512B logical and physical block sizes. Formats that
probe the underlying device override this.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Backing file descriptor access for disk images backed by
a file. Returns a BorrowedDiskFd that wraps the raw fd
with lifetime tracking. Not available for network or
memory backed disk formats.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Host allocation size for file-backed disk images. Reports
actual bytes occupied on the host filesystem. Not every
format supports this, e.g. network or memory backed disks.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Reported capacity of a disk image. Every format, be it
file backed, network, memory, exposes a logical size.
Single method logical_size() returning the virtual size
in bytes.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Composable disk capability traits with DiskFile as a supertrait
bundling DiskSize and Geometry. Optional capabilities are
separate traits: PhysicalSize, DiskFd, SparseCapable, Resizable.
AsyncDiskFile extends DiskFile with async I/O construction.
Empty module with doc comment, trait definitions follow.
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Add a full suite of test_virtio_block_* tests to the common_cvm
integration test module to verify virtio block functionality in
confidential guest environments.
The following tests are added, all using 4-vCPU confidential
VMs created via GuestFactory:
- test_virtio_block_io_uring (Raw image, io_uring backend)
- test_virtio_block_aio (Raw image, AIO backend)
- test_virtio_block_sync (Raw image, sync backend)
- test_virtio_block_qcow2 (QCOW2 image)
- test_virtio_block_qcow2_zlib (QCOW2 with zlib compression)
- test_virtio_block_qcow2_zstd (QCOW2 with zstd compression)
- test_virtio_block_qcow2_backing_zstd_file
- test_virtio_block_qcow2_backing_uncompressed_file
- test_virtio_block_qcow2_backing_raw_file
This extends CVM test coverage to all virtio block I/O backends
and disk image formats.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Move _test_virtio_block to module-level scope, accepting a
Guest reference instead of an image name string. Replace
hardcoded CPU, kernel, and cmdline arguments with default_cpus
and default_kernel_cmdline.
Promote all supporting disk utilities to module-level scope:
compute_backing_checksum, disk_check_consistency, run_qemu_img,
get_image_info, get_qcow2_v3_info, check_dirty_flag,
check_corrupt_flag, set_corrupt_flag, resolve_disk_path, and
compute_file_checksum.
Update all test_virtio_block_* call sites in common_parallel
to create guests via GuestFactory::new_regular_guest_factory()
with 4 vCPUs and pass them to the helper. This enables reuse
with different guest types such as confidential VMs.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add test_direct_kernel_boot to the common_cvm integration test
module to verify that boot, CPU, memory, and MSI interrupt
functionality work correctly in confidential guest environments.
The test creates an Ubuntu Jammy-based confidential VM using
GuestFactory and delegates to the existing
_test_direct_kernel_boot helper.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract direct kernel boot test logic into a standalone
_test_direct_kernel_boot helper that accepts a Guest reference.
The helper boots a VM, validates CPU count and memory using
generic validate_cpu_count and validate_memory methods, and
asserts 12 MSI interrupts in /proc/interrupts.
Replace hardcoded kernel and cmdline arguments with
default_kernel_cmdline(). Update the test call site in
common_parallel to use GuestFactory and delegate to the new
helper, enabling reuse with different guest types.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add test_pci_multiple_segments to the common_cvm integration
test module to verify multiple PCI segment support in
confidential guest environments.
The test uses 8 PCI segments, which exceeds the Linux default
of 6 and matches the maximum supported by the IGVM file for
SEV-SNP guests. A test disk is placed on segment 5 to validate
cross-segment device functionality.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract common PCI multiple segment disk test logic into
_test_pci_multiple_segments() and reuse it from the test case.
Switch guest creation to GuestFactory in test_pci_multiple_segments
and pass segment values through helper parameters.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Introduce default_kernel_cmdline_with_platform() in GuestCommand
that accepts an optional platform parameter. For confidential
VMs, the platform arg is prepended to sev_snp=on. For regular
VMs, it is passed via --platform if provided.
Retain default_kernel_cmdline() as a convenience wrapper that
calls the new method with None, preserving backward
compatibility.
This enables tests to pass additional platform configuration
such as num_pci_segments alongside the default kernel and
cmdline setup.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add test_virtio_net_ctrl_queue to the common_cvm integration
test module to verify that virtio net control queue functionality
works correctly in confidential guest environments.
The test creates an Ubuntu Jammy-based confidential VM using
GuestFactory and delegates to the existing
_test_virtio_net_ctrl_queue helper to validate MTU configuration
and ethtool offload settings.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract virtio net control queue test logic into a standalone
_test_virtio_net_ctrl_queue helper that accepts a Guest
reference. The helper boots a VM with MTU 3000, verifies
ethtool can disable rx-gro-hw, and asserts the guest interface
MTU is correctly set.
Replace hardcoded kernel and cmdline arguments with
default_kernel_cmdline(). Update the test call site in
common_parallel to use GuestFactory and delegate to the new
helper, enabling reuse with different guest types.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Add test_pci_msi to the common_cvm integration test module to
verify that PCI MSI interrupt functionality works correctly in
confidential guest environments.
The test creates an Ubuntu Jammy-based confidential VM using
GuestFactory and delegates to the existing _test_pci_msi helper
to validate MSI interrupts.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Extract PCI MSI interrupt test logic from test_pci_msi into a
standalone _test_pci_msi helper that accepts a Guest reference.
The helper boots a VM, waits for boot, and asserts that 12 MSI
interrupts are present in /proc/interrupts.
Replace hardcoded kernel and cmdline arguments with
default_kernel_cmdline(). Update the test call site in
common_parallel to use GuestFactory and delegate to the new
helper, enabling reuse with different guest types.
Signed-off-by: Muminul Islam <muislam@microsoft.com>
