From 10e2a6d0daa8d61261f435f1afcae25c962a50ae Mon Sep 17 00:00:00 2001 From: Darko Draskovic Date: Fri, 14 Jul 2023 13:34:06 +0200 Subject: [PATCH 01/25] Refactor manager to start AMD SEV encrypted VM Signed-off-by: Darko Draskovic --- cmd/manager/script/launch-qemu.sh | 189 ++++++++++++++++++++++++++++++ 1 file changed, 189 insertions(+) create mode 100755 cmd/manager/script/launch-qemu.sh diff --git a/cmd/manager/script/launch-qemu.sh b/cmd/manager/script/launch-qemu.sh new file mode 100755 index 0000000..41c1bfd --- /dev/null +++ b/cmd/manager/script/launch-qemu.sh @@ -0,0 +1,189 @@ +#!/bin/bash + +# +# user changeable parameters +# +HDA_FILE="${HOME}/ubuntu-18.04-desktop.qcow2" +GUEST_SIZE_IN_MB="4096" +SEV_GUEST="1" +SMP_NCPUS="4" +CONSOLE="qxl" +QEMU_INSTALL_DIR=/usr/local/bin/ +UEFI_BIOS_CODE="/usr/local/share/qemu/OVMF_CODE.fd" +UEFI_BIOS_VARS="OVMF_VARS.fd" +#VNC_PORT="" +USE_VIRTIO="1" + +CBITPOS=51 + +usage() { + echo "$0 [options]" + echo "Available :" + echo " -hda hard disk ($HDA_FILE)" + echo " -nosev disable sev support" + echo " -mem guest memory" + echo " -smp number of cpus" + echo " -console display console to use (serial or gxl)" + echo " -vnc VNC port to use" + echo " -bios bios to use (default $UEFI_BIOS_CODE)" + echo " -kernel kernel to use" + echo " -initrd initrd to use" + echo " -cdrom CDROM image" + echo " -virtio use virtio devices" + echo " -gdb start gdbserver" + exit 1 +} + +add_opts() { + echo -n "$* " >> ${QEMU_CMDLINE} +} + +run_cmd() { + if ! "$@"; then + echo "Command '$*' failed" + exit 1 + fi +} + +if [ "$(id -u)" -ne 0 ]; then + echo "This script must be run as root!" + exit 1 +fi + +while [[ $1 != "" ]]; do + case "$1" in + -hda) HDA_FILE="${2}" + shift + ;; + -nosev) SEV_GUEST="0" + ;; + -mem) GUEST_SIZE_IN_MB=${2} + shift + ;; + -console) CONSOLE=${2} + shift + ;; + -smp) SMP_NCPUS=$2 + shift + ;; + -vnc) VNC_PORT=$2 + shift + if [ "${VNC_PORT}" = "" ]; then + usage + fi + ;; + -bios) UEFI_BIOS_CODE="`readlink -f $2`" + shift + ;; + -netconsole) NETCONSOLE_PORT=$2 + shift + ;; + -initrd) INITRD_FILE=$2 + shift + ;; + -kernel) KERNEL_FILE=$2 + shift + ;; + -cdrom) CDROM_FILE=$2 + shift + ;; + -virtio) USE_VIRTIO="1" + ;; + -gdb) USE_GDB="1" + ;; + *) usage;; + esac + shift +done + +# we add all the qemu command line options into a file +QEMU_CMDLINE=/tmp/cmdline.$$ +rm -rf ${QEMU_CMDLINE} + +add_opts "${QEMU_INSTALL_DIR}qemu-system-x86_64" + +# Basic virtual machine property +add_opts "-enable-kvm -cpu EPYC -machine q35" + +# add number of VCPUs +[ ! -z ${SMP_NCPUS} ] && add_opts "-smp ${SMP_NCPUS},maxcpus=64" + +# define guest memory +add_opts "-m ${GUEST_SIZE_IN_MB}M,slots=5,maxmem=30G" + +# The OVMF binary, including the non-volatile variable store, appears as a +# "normal" qemu drive on the host side, and it is exposed to the guest as a +# persistent flash device. +add_opts "-drive if=pflash,format=raw,unit=0,file=${UEFI_BIOS_CODE},readonly" +add_opts "-drive if=pflash,format=raw,unit=1,file=${UEFI_BIOS_VARS}" + +# add CDROM if specified +[ ! -z ${CDROM_FILE} ] && add_opts "-drive file=${CDROM_FILE},media=cdrom -boot d" + +add_opts "-netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::9301-:9031,hostfwd=tcp::7020-:7002" +add_opts "-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile=" + +# If harddisk file is specified then add the HDD drive +if [ ! -z ${HDA_FILE} ]; then + if [ "$USE_VIRTIO" = "1" ]; then + if [[ ${HDA_FILE} = *"qcow2" ]]; then + add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=qcow2" + else + add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=raw" + fi + add_opts "-device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true" + add_opts "-device scsi-hd,drive=disk0" + else + if [[ ${HDA_FILE} = *"qcow2" ]]; then + add_opts "-drive file=${HDA_FILE},format=qcow2" + else + add_opts "-drive file=${HDA_FILE},format=raw" + fi + fi +fi + +# If this is SEV guest then add the encryption device objects to enable support +if [ ${SEV_GUEST} = "1" ]; then + add_opts "-object sev-guest,id=sev0,cbitpos=${CBITPOS},reduced-phys-bits=1" + add_opts "-machine memory-encryption=sev0" +fi + +# if console is serial then disable graphical interface +if [ "${CONSOLE}" = "serial" ]; then + add_opts "-nographic" +else + add_opts "-vga ${CONSOLE}" +fi + +# if -kernel arg is specified then use the kernel provided in command line for boot +if [ "${KERNEL_FILE}" != "" ]; then + add_opts "-kernel $KERNEL_FILE" + add_opts "-append \"console=ttyS0 earlyprintk=serial root=/dev/sda2\"" + [ ! -z ${INITRD_FILE} ] && add_opts "-initrd ${INITRD_FILE}" +fi + +# start vnc server +[ ! -z ${VNC_PORT} ] && add_opts "-vnc :${VNC_PORT}" && echo "Starting VNC on port ${VNC_PORT}" + +# start monitor on pty +add_opts "-monitor pty" + +# log the console output in stdout.log +QEMU_CONSOLE_LOG=`pwd`/stdout.log + +# save the command line args into log file +cat $QEMU_CMDLINE | tee ${QEMU_CONSOLE_LOG} +echo | tee -a ${QEMU_CONSOLE_LOG} + + +# map CTRL-C to CTRL ] +echo "Mapping CTRL-C to CTRL-]" +stty intr ^] + +echo "Launching VM ..." +bash ${QEMU_CMDLINE} 2>&1 | tee -a ${QEMU_CONSOLE_LOG} + +# restore the mapping +stty intr ^c + +rm -rf ${QEMU_CMDLINE} From eaef7ddf9a0a0dc4b7fb4166e07737a64e6729ea Mon Sep 17 00:00:00 2001 From: Darko Draskovic Date: Fri, 14 Jul 2023 14:16:09 +0200 Subject: [PATCH 02/25] Add proper formatting Signed-off-by: Darko Draskovic --- cmd/manager/script/launch-qemu.sh | 202 ++++++++++++++++-------------- 1 file changed, 110 insertions(+), 92 deletions(-) diff --git a/cmd/manager/script/launch-qemu.sh b/cmd/manager/script/launch-qemu.sh index 41c1bfd..1b089e3 100755 --- a/cmd/manager/script/launch-qemu.sh +++ b/cmd/manager/script/launch-qemu.sh @@ -17,83 +17,101 @@ USE_VIRTIO="1" CBITPOS=51 usage() { - echo "$0 [options]" - echo "Available :" - echo " -hda hard disk ($HDA_FILE)" - echo " -nosev disable sev support" - echo " -mem guest memory" - echo " -smp number of cpus" - echo " -console display console to use (serial or gxl)" - echo " -vnc VNC port to use" - echo " -bios bios to use (default $UEFI_BIOS_CODE)" - echo " -kernel kernel to use" - echo " -initrd initrd to use" - echo " -cdrom CDROM image" - echo " -virtio use virtio devices" - echo " -gdb start gdbserver" - exit 1 + echo "$0 [options]" + echo "Available :" + echo " -hda hard disk ($HDA_FILE)" + echo " -nosev disable sev support" + echo " -mem guest memory" + echo " -smp number of cpus" + echo " -console display console to use (serial or gxl)" + echo " -vnc VNC port to use" + echo " -bios bios to use (default $UEFI_BIOS_CODE)" + echo " -kernel kernel to use" + echo " -initrd initrd to use" + echo " -cdrom CDROM image" + echo " -virtio use virtio devices" + echo " -gdb start gdbserver" + echo " -cbitpos location of the C-bit" + exit 1 } add_opts() { - echo -n "$* " >> ${QEMU_CMDLINE} + echo -n "$* " >> ${QEMU_CMDLINE} } run_cmd() { - if ! "$@"; then - echo "Command '$*' failed" - exit 1 - fi + if ! "$@"; then + echo "Command '$*' failed" + exit 1 + fi } if [ "$(id -u)" -ne 0 ]; then - echo "This script must be run as root!" - exit 1 + echo "This script must be run as root!" + exit 1 fi while [[ $1 != "" ]]; do - case "$1" in - -hda) HDA_FILE="${2}" - shift - ;; - -nosev) SEV_GUEST="0" - ;; - -mem) GUEST_SIZE_IN_MB=${2} - shift - ;; - -console) CONSOLE=${2} - shift - ;; - -smp) SMP_NCPUS=$2 - shift - ;; - -vnc) VNC_PORT=$2 - shift - if [ "${VNC_PORT}" = "" ]; then - usage - fi - ;; - -bios) UEFI_BIOS_CODE="`readlink -f $2`" - shift - ;; - -netconsole) NETCONSOLE_PORT=$2 - shift - ;; - -initrd) INITRD_FILE=$2 - shift - ;; - -kernel) KERNEL_FILE=$2 - shift - ;; - -cdrom) CDROM_FILE=$2 - shift - ;; - -virtio) USE_VIRTIO="1" - ;; - -gdb) USE_GDB="1" - ;; - *) usage;; - esac - shift + case "$1" in + -hda) + HDA_FILE="${2}" + shift + ;; + -nosev) + SEV_GUEST="0" + ;; + -mem) + GUEST_SIZE_IN_MB=${2} + shift + ;; + -console) + CONSOLE=${2} + shift + ;; + -smp) + SMP_NCPUS=$2 + shift + ;; + -vnc) + VNC_PORT=$2 + shift + if [ "${VNC_PORT}" = "" ]; then + usage + fi + ;; + -bios) + UEFI_BIOS_CODE="`readlink -f $2`" + shift + ;; + -netconsole) + NETCONSOLE_PORT=$2 + shift + ;; + -initrd) + INITRD_FILE=$2 + shift + ;; + -kernel) + KERNEL_FILE=$2 + shift + ;; + -cdrom) + CDROM_FILE=$2 + shift + ;; + -virtio) + USE_VIRTIO="1" + ;; + -gdb) + USE_GDB="1" + ;; + -cbitpos) + CBITPOS=$2 + ;; + *) + usage;; + esac + shift done # we add all the qemu command line options into a file @@ -125,41 +143,41 @@ add_opts "-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vm # If harddisk file is specified then add the HDD drive if [ ! -z ${HDA_FILE} ]; then - if [ "$USE_VIRTIO" = "1" ]; then - if [[ ${HDA_FILE} = *"qcow2" ]]; then - add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=qcow2" - else - add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=raw" - fi - add_opts "-device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true" - add_opts "-device scsi-hd,drive=disk0" - else - if [[ ${HDA_FILE} = *"qcow2" ]]; then - add_opts "-drive file=${HDA_FILE},format=qcow2" - else - add_opts "-drive file=${HDA_FILE},format=raw" - fi - fi + if [ "$USE_VIRTIO" = "1" ]; then + if [[ ${HDA_FILE} = *"qcow2" ]]; then + add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=qcow2" + else + add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=raw" + fi + add_opts "-device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true" + add_opts "-device scsi-hd,drive=disk0" + else + if [[ ${HDA_FILE} = *"qcow2" ]]; then + add_opts "-drive file=${HDA_FILE},format=qcow2" + else + add_opts "-drive file=${HDA_FILE},format=raw" + fi + fi fi # If this is SEV guest then add the encryption device objects to enable support if [ ${SEV_GUEST} = "1" ]; then - add_opts "-object sev-guest,id=sev0,cbitpos=${CBITPOS},reduced-phys-bits=1" - add_opts "-machine memory-encryption=sev0" + add_opts "-object sev-guest,id=sev0,cbitpos=${CBITPOS},reduced-phys-bits=1" + add_opts "-machine memory-encryption=sev0" fi # if console is serial then disable graphical interface if [ "${CONSOLE}" = "serial" ]; then - add_opts "-nographic" + add_opts "-nographic" else - add_opts "-vga ${CONSOLE}" + add_opts "-vga ${CONSOLE}" fi # if -kernel arg is specified then use the kernel provided in command line for boot if [ "${KERNEL_FILE}" != "" ]; then - add_opts "-kernel $KERNEL_FILE" - add_opts "-append \"console=ttyS0 earlyprintk=serial root=/dev/sda2\"" - [ ! -z ${INITRD_FILE} ] && add_opts "-initrd ${INITRD_FILE}" + add_opts "-kernel $KERNEL_FILE" + add_opts "-append \"console=ttyS0 earlyprintk=serial root=/dev/sda2\"" + [ ! -z ${INITRD_FILE} ] && add_opts "-initrd ${INITRD_FILE}" fi # start vnc server @@ -180,10 +198,10 @@ echo | tee -a ${QEMU_CONSOLE_LOG} echo "Mapping CTRL-C to CTRL-]" stty intr ^] -echo "Launching VM ..." -bash ${QEMU_CMDLINE} 2>&1 | tee -a ${QEMU_CONSOLE_LOG} + echo "Launching VM ..." + bash ${QEMU_CMDLINE} 2>&1 | tee -a ${QEMU_CONSOLE_LOG} -# restore the mapping -stty intr ^c + # restore the mapping + stty intr ^c -rm -rf ${QEMU_CMDLINE} + rm -rf ${QEMU_CMDLINE} From b92c698800c756fdcd5a1b2c6befd3003df4d32c Mon Sep 17 00:00:00 2001 From: Darko Draskovic Date: Fri, 14 Jul 2023 14:44:44 +0200 Subject: [PATCH 03/25] Add host-guest http and grpc port parametrization Signed-off-by: Darko Draskovic --- cmd/manager/script/launch-qemu.sh | 42 +++++++++++++++++++++++-------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/cmd/manager/script/launch-qemu.sh b/cmd/manager/script/launch-qemu.sh index 1b089e3..d9c6abd 100755 --- a/cmd/manager/script/launch-qemu.sh +++ b/cmd/manager/script/launch-qemu.sh @@ -15,6 +15,10 @@ UEFI_BIOS_VARS="OVMF_VARS.fd" USE_VIRTIO="1" CBITPOS=51 +HOST_HTTP_PORT=9301 +GUEST_HTTP_PORT=9031 +HOST_GRPC_PORT=7020 +GUEST_GRPC_PORT=7002 usage() { echo "$0 [options]" @@ -32,6 +36,10 @@ usage() { echo " -virtio use virtio devices" echo " -gdb start gdbserver" echo " -cbitpos location of the C-bit" + echo " -hosthttp host http port" + echo " -guesthttp guest http port" + echo " -hostgrpc host grpc port" + echo " -guestgrpc guest grpc port" exit 1 } @@ -80,7 +88,7 @@ while [[ $1 != "" ]]; do fi ;; -bios) - UEFI_BIOS_CODE="`readlink -f $2`" + UEFI_BIOS_CODE=$(readlink -f "$2") shift ;; -netconsole) @@ -108,6 +116,18 @@ while [[ $1 != "" ]]; do -cbitpos) CBITPOS=$2 ;; + -hosthttp) + HOST_HTTP_PORT=$2 + ;; + -guesthttp) + GUEST_HTTP_PORT=$2 + ;; + -hostgrpc) + HOST_GRPC_PORT=$2 + ;; + -guestgrpc) + GUEST_GRPC_PORT=$2 + ;; *) usage;; esac @@ -124,7 +144,7 @@ add_opts "${QEMU_INSTALL_DIR}qemu-system-x86_64" add_opts "-enable-kvm -cpu EPYC -machine q35" # add number of VCPUs -[ ! -z ${SMP_NCPUS} ] && add_opts "-smp ${SMP_NCPUS},maxcpus=64" +[ -n "$SMP_NCPUS" ] && add_opts "-smp ${SMP_NCPUS},maxcpus=64" # define guest memory add_opts "-m ${GUEST_SIZE_IN_MB}M,slots=5,maxmem=30G" @@ -136,13 +156,13 @@ add_opts "-drive if=pflash,format=raw,unit=0,file=${UEFI_BIOS_CODE},readonly" add_opts "-drive if=pflash,format=raw,unit=1,file=${UEFI_BIOS_VARS}" # add CDROM if specified -[ ! -z ${CDROM_FILE} ] && add_opts "-drive file=${CDROM_FILE},media=cdrom -boot d" +[ -n "$CDROM_FILE" ] && add_opts "-drive file=${CDROM_FILE},media=cdrom -boot d" -add_opts "-netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::9301-:9031,hostfwd=tcp::7020-:7002" +add_opts "-netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::$HOST_HTTP_PORT-:$GUEST_HTTP_PORT,hostfwd=tcp::$HOST_GRPC_PORT-:$GUEST_GRPC_PORT" add_opts "-device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile=" # If harddisk file is specified then add the HDD drive -if [ ! -z ${HDA_FILE} ]; then +if [ -n "$HDA_FILE" ]; then if [ "$USE_VIRTIO" = "1" ]; then if [[ ${HDA_FILE} = *"qcow2" ]]; then add_opts "-drive file=${HDA_FILE},if=none,id=disk0,format=qcow2" @@ -177,21 +197,21 @@ fi if [ "${KERNEL_FILE}" != "" ]; then add_opts "-kernel $KERNEL_FILE" add_opts "-append \"console=ttyS0 earlyprintk=serial root=/dev/sda2\"" - [ ! -z ${INITRD_FILE} ] && add_opts "-initrd ${INITRD_FILE}" + [ -n "$INITRD_FILE" ] && add_opts "-initrd ${INITRD_FILE}" fi # start vnc server -[ ! -z ${VNC_PORT} ] && add_opts "-vnc :${VNC_PORT}" && echo "Starting VNC on port ${VNC_PORT}" +[ -n "$VNC_PORT" ] && add_opts "-vnc :${VNC_PORT}" && echo "Starting VNC on port ${VNC_PORT}" # start monitor on pty add_opts "-monitor pty" # log the console output in stdout.log -QEMU_CONSOLE_LOG=`pwd`/stdout.log +QEMU_CONSOLE_LOG=$(pwd)/stdout.log # save the command line args into log file -cat $QEMU_CMDLINE | tee ${QEMU_CONSOLE_LOG} -echo | tee -a ${QEMU_CONSOLE_LOG} +cat $QEMU_CMDLINE | tee "${QEMU_CONSOLE_LOG}" +echo | tee -a "${QEMU_CONSOLE_LOG}" # map CTRL-C to CTRL ] @@ -199,7 +219,7 @@ echo "Mapping CTRL-C to CTRL-]" stty intr ^] echo "Launching VM ..." - bash ${QEMU_CMDLINE} 2>&1 | tee -a ${QEMU_CONSOLE_LOG} + bash ${QEMU_CMDLINE} 2>&1 | tee -a "${QEMU_CONSOLE_LOG}" # restore the mapping stty intr ^c From b92806c3b55ab920599620ed9c79022f74abeb52 Mon Sep 17 00:00:00 2001 From: Darko Draskovic Date: Mon, 31 Jul 2023 17:32:48 +0200 Subject: [PATCH 04/25] Refactor dom.xml to start focal-server-cloudimg-amd64.qcow2 Signed-off-by: Darko Draskovic --- cmd/manager/script/launch-qemu-cmd.sh | 17 +++++++ cmd/manager/xml/copy.bkp.xml | 69 +++++++++++++++++++++++++++ cmd/manager/xml/dom.xml | 21 +++----- manager/libvirt.go | 43 +++++++++-------- 4 files changed, 115 insertions(+), 35 deletions(-) create mode 100644 cmd/manager/script/launch-qemu-cmd.sh create mode 100644 cmd/manager/xml/copy.bkp.xml diff --git a/cmd/manager/script/launch-qemu-cmd.sh b/cmd/manager/script/launch-qemu-cmd.sh new file mode 100644 index 0000000..816d078 --- /dev/null +++ b/cmd/manager/script/launch-qemu-cmd.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +/usr/bin/qemu-system-x86_64 \ + -enable-kvm \ + -cpu EPYC \ + -machine q35 \ + -smp 4,maxcpus=64 \ + -m 4096M,slots=5,maxmem=30G \ + -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE.fd,readonly \ + -drive if=pflash,format=raw,unit=1,file=OVMF_VARS.fd \ + -netdev user,id=vmnic,hostfwd=tcp::2222-:22,hostfwd=tcp::9301-:9031,hostfwd=tcp::7020-:7002 \ + -device virtio-net-pci,disable-legacy=on,iommu_platform=true,netdev=vmnic,romfile= \ + -drive file=./focal-server-cloudimg-amd64.qcow2,if=none,id=disk0,format=qcow2 \ + -device virtio-scsi-pci,id=scsi,disable-legacy=on,iommu_platform=true \ + -device scsi-hd,drive=disk0 \ + -vga qxl \ + -monitor pty diff --git a/cmd/manager/xml/copy.bkp.xml b/cmd/manager/xml/copy.bkp.xml new file mode 100644 index 0000000..8fd5546 --- /dev/null +++ b/cmd/manager/xml/copy.bkp.xml @@ -0,0 +1,69 @@ + + QEmu-alpine-standard-x86_64 + c7a5fdbd-cdaf-9455-926a-d65c16db1809 + + + + + + 786432 + 786432 + 1 + + hvm + + + + + + + + + + + + + + + destroy + restart + destroy + + + + + + /usr/bin/qemu-system-x86_64 + + + + +
+ + + + + + + + +
+ + + + + + +