build: Release v39.0

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>

.github/workflows/audit.yaml

@@ -4,12 +4,13 @@ on:
     paths: 
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+
 jobs:
   security_audit:
     name: Audit
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions-rs/audit-check@v1
+      - uses: actions-rust-lang/audit@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build.yaml

@@ -1,9 +1,11 @@
 name: Cloud Hypervisor Build
-on: [pull_request, create]
+on: [pull_request, merge_group]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
-    if: github.event_name == 'pull_request'
     name: Build
     runs-on: ubuntu-latest
     strategy:
@@ -13,7 +15,7 @@ jobs:
           - stable
           - beta
           - nightly
-          - "1.70"
+          - "1.74.1"
         target:
           - x86_64-unknown-linux-gnu
           - x86_64-unknown-linux-musl
@@ -27,11 +29,10 @@ jobs:
         run: sudo apt install -y musl-tools
 
       - name: Install Rust toolchain (${{ matrix.rust }})
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ matrix.rust }}
           target: ${{ matrix.target }}
-          override: true
 
       - name: Build (default features)
         run: cargo rustc --locked --bin cloud-hypervisor -- -D warnings -D clippy::undocumented_unsafe_blocks

.github/workflows/dco.yaml

@@ -1,8 +1,9 @@
 name: DCO
-on:
-  pull_request:
+on: [pull_request, merge_group]
+
 jobs:
   check:
+    name: DCO Check ("Signed-Off-By")
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -11,6 +12,7 @@ jobs:
       with:
         python-version: '3.x'
     - name: Check DCO
+      if: ${{ github.event_name == 'pull_request' }}
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |

.github/workflows/docker-image.yaml

@@ -1,11 +1,13 @@
 name: Cloud Hypervisor's Docker image update
-
 on:
   push:
     branches: main
     paths: resources/Dockerfile
   pull_request:
     paths: resources/Dockerfile
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 env:
   REGISTRY: ghcr.io
@@ -39,7 +41,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           # generate Docker tags based on the following events/attributes
           tags: |
-            type=raw,value={{date 'YYYYMMDD'}}-0
+            type=raw,value=20240407-0
             type=sha
 
       - name: Build and push

.github/workflows/fuzz-build.yaml

@@ -1,9 +1,11 @@
 name: Cloud Hypervisor Cargo Fuzz Build
-on: [pull_request, create]
+on: [pull_request, merge_group]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
-    if: github.event_name == 'pull_request'
     name: Cargo Fuzz Build
     runs-on: ubuntu-latest
     strategy:
@@ -18,11 +20,10 @@ jobs:
       - name: Code checkout
         uses: actions/checkout@v4
       - name: Install Rust toolchain (${{ matrix.rust }})
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@stable
         with:
             toolchain: ${{ matrix.rust }}
             target: ${{ matrix.target }}
-            override: true
       - name: Install Cargo fuzz
         run: cargo install cargo-fuzz
       - name: Fuzz Build

.github/workflows/gitlint.yaml

@@ -1,5 +1,4 @@
 name: Commit messages check
-
 on:
   pull_request:
 

.github/workflows/hadolint.yaml

@@ -1,5 +1,4 @@
 name: Lint Dockerfile
-
 on:
   push:
     paths:

.github/workflows/integration-arm64.yaml

@@ -0,0 +1,54 @@
+name: Cloud Hypervisor Tests (ARM64)
+on: [pull_request, merge_group]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    timeout-minutes: 60
+    name: Tests (ARM64)
+    runs-on: focal-arm64
+    steps:
+      - name: Fix workspace permissions
+        run: sudo chown -R github-runner:github-runner ${GITHUB_WORKSPACE}
+      - name: Code checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run unit tests (musl)
+        run: scripts/dev_cli.sh tests --unit --libc musl
+      - name: Load openvswitch module
+        run: sudo modprobe openvswitch
+      - name: Run integration tests (musl)
+        timeout-minutes: 30
+        run: scripts/dev_cli.sh tests --integration --libc musl
+      - name: Install Azure CLI
+        if: ${{ github.event_name != 'pull_request' }}
+        run: |
+          sudo apt install -y ca-certificates curl apt-transport-https lsb-release gnupg
+          curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null
+          echo "deb [arch=arm64] https://packages.microsoft.com/repos/azure-cli/ focal main" | sudo tee /etc/apt/sources.list.d/azure-cli.list
+          sudo apt update
+          sudo apt install -y azure-cli
+      - name: Download Windows image
+        if: ${{ github.event_name != 'pull_request' }}
+        shell: bash
+        run: |
+          IMG_BASENAME=windows-11-iot-enterprise-aarch64.raw
+          IMG_PATH=$HOME/workloads/$IMG_BASENAME
+          IMG_GZ_PATH=$HOME/workloads/$IMG_BASENAME.gz
+          IMG_GZ_BLOB_NAME=windows-11-iot-enterprise-aarch64-9-min.raw.gz
+          cp "scripts/$IMG_BASENAME.sha1" "$HOME/workloads/"
+          pushd "$HOME/workloads"
+          if sha1sum "$IMG_BASENAME.sha1" --check; then
+              exit
+          fi
+          popd
+          mkdir -p "$HOME/workloads"
+          az storage blob download --container-name private-images --file "$IMG_GZ_PATH" --name "$IMG_GZ_BLOB_NAME" --connection-string "${{ secrets.CH_PRIVATE_IMAGES }}"
+          gzip -d $IMG_GZ_PATH
+      - name: Run Windows guest integration tests
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 30
+        run: scripts/dev_cli.sh tests --integration-windows --libc musl

.github/workflows/integration-metrics.yaml

@@ -0,0 +1,22 @@
+name: Cloud Hypervisor Tests (Metrics)
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    name: Tests (Metrics)
+    runs-on: jammy-metrics
+    env:
+      METRICS_PUBLISH_KEY: ${{ secrets.METRICS_PUBLISH_KEY }}
+    steps:
+      - name: Code checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run metrics tests
+        timeout-minutes: 60
+        run: scripts/dev_cli.sh tests --metrics -- -- --report-file /root/workloads/metrics.json
+      - name: Upload metrics report
+        run: 'curl -X PUT https://ch-metrics.azurewebsites.net/api/publishmetrics -H "x-functions-key: $METRICS_PUBLISH_KEY" -T ~/workloads/metrics.json'

.github/workflows/integration-rate-limiter.yaml

@@ -0,0 +1,28 @@
+name: Cloud Hypervisor Tests (Rate-Limiter)
+on: [merge_group, pull_request]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Tests (Rate-Limiter)
+    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'jammy-rate-limiter' }}
+    env:
+      AUTH_DOWNLOAD_TOKEN: ${{ secrets.AUTH_DOWNLOAD_TOKEN }}
+    steps:
+      - name: Fix workspace permissions
+        if: ${{ github.event_name != 'pull_request' }}
+        run: sudo chown -R github-runner:github-runner ${GITHUB_WORKSPACE}
+      - name: Code checkout
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run rate-limiter integration tests
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 10
+        run: scripts/dev_cli.sh tests --integration-rate-limiter
+      - name: Skipping build for PR
+        if: ${{ github.event_name == 'pull_request' }}
+        run: echo "Skipping build for PR"

.github/workflows/integration-sgx.yaml

@@ -0,0 +1,32 @@
+name: Cloud Hypervisor Tests (SGX)
+on: [merge_group, pull_request]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Tests (SGX)
+    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'jammy-sgx' }}
+    env:
+      AUTH_DOWNLOAD_TOKEN: ${{ secrets.AUTH_DOWNLOAD_TOKEN }}
+    steps:
+      - name: Fix workspace permissions
+        if: ${{ github.event_name != 'pull_request' }}
+        run: sudo chown -R github-runner:github-runner ${GITHUB_WORKSPACE}
+      - name: Code checkout
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run SGX integration tests
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 10
+        run: scripts/dev_cli.sh tests --integration-sgx
+      - name: Run SGX integration tests for musl
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 10
+        run: scripts/dev_cli.sh tests --integration-sgx --libc musl
+      - name: Skipping build for PR
+        if: ${{ github.event_name == 'pull_request' }}
+        run: echo "Skipping build for PR"

.github/workflows/integration-vfio.yaml

@@ -0,0 +1,32 @@
+name: Cloud Hypervisor Tests (VFIO)
+on: [merge_group, pull_request]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Tests (VFIO)
+    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'jammy-vfio' }}
+    env:
+      AUTH_DOWNLOAD_TOKEN: ${{ secrets.AUTH_DOWNLOAD_TOKEN }}
+    steps:
+      - name: Fix workspace permissions
+        if: ${{ github.event_name != 'pull_request' }}
+        run: sudo chown -R github-runner:github-runner ${GITHUB_WORKSPACE}
+      - name: Code checkout
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run VFIO integration tests
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 15
+        run: scripts/dev_cli.sh tests --integration-vfio
+      - name: Run VFIO integration tests for musl
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 15
+        run: scripts/dev_cli.sh tests --integration-vfio --libc musl
+      - name: Skipping build for PR
+        if: ${{ github.event_name == 'pull_request' }}
+        run: echo "Skipping build for PR"

.github/workflows/integration-windows.yaml

@@ -0,0 +1,50 @@
+name: Cloud Hypervisor Tests (Windows Guest)
+on: [merge_group, pull_request]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Tests (Windows Guest)
+    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'garm-jammy-16' }}
+    steps:
+      - name: Code checkout
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Docker
+        if: ${{ github.event_name != 'pull_request' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install ca-certificates curl gnupg
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+          sudo chmod a+r /usr/share/keyrings/docker-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt-get update
+          sudo apt install -y docker-ce docker-ce-cli
+      - name: Install Azure CLI
+        if: ${{ github.event_name != 'pull_request' }}
+        run: |
+          sudo apt install -y ca-certificates curl apt-transport-https lsb-release gnupg
+          curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null
+          echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ jammy main" | sudo tee /etc/apt/sources.list.d/azure-cli.list
+          sudo apt update
+          sudo apt install -y azure-cli
+      - name: Download Windows image
+        if: ${{ github.event_name != 'pull_request' }}
+        run: |
+          mkdir $HOME/workloads
+          az storage blob download --container-name private-images --file "$HOME/workloads/windows-server-2022-amd64-2.raw" --name windows-server-2022-amd64-2.raw --connection-string "${{ secrets.CH_PRIVATE_IMAGES }}"
+      - name: Run Windows guest integration tests
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 15
+        run: scripts/dev_cli.sh tests --integration-windows
+      - name: Run Windows guest integration tests for musl
+        if: ${{ github.event_name != 'pull_request' }}
+        timeout-minutes: 15
+        run: scripts/dev_cli.sh tests --integration-windows --libc musl
+      - name: Skipping build for PR
+        if: ${{ github.event_name == 'pull_request' }}
+        run: echo "Skipping build for PR"

.github/workflows/integration-x86-64.yaml

@@ -0,0 +1,52 @@
+name: Cloud Hypervisor Tests (x86-64)
+on: [pull_request, merge_group]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: ['garm-jammy', "garm-jammy-amd"]
+        libc: ["musl", 'gnu']
+    name: Tests (x86-64)
+    runs-on: ${{ github.event_name == 'pull_request' && !(matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') && 'ubuntu-latest' || format('{0}-16', matrix.runner) }}
+    steps:
+      - name: Code checkout
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Docker
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install ca-certificates curl gnupg
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+          sudo chmod a+r /usr/share/keyrings/docker-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt-get update
+          sudo apt install -y docker-ce docker-ce-cli
+      - name: Prepare for VDPA
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        run: scripts/prepare_vdpa.sh
+      - name: Run unit tests
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        run: scripts/dev_cli.sh tests --unit --libc ${{ matrix.libc }}
+      - name: Load openvswitch module
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        run: sudo modprobe openvswitch
+      - name: Run integration tests
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        timeout-minutes: 40
+        run: scripts/dev_cli.sh tests --integration --libc ${{ matrix.libc }}
+      - name: Run live-migration integration tests
+        if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
+        timeout-minutes: 20
+        run: scripts/dev_cli.sh tests --integration-live-migration --libc ${{ matrix.libc }}
+      - name: Skipping build for PR
+        if: ${{ github.event_name == 'pull_request' && matrix.runner != 'garm-jammy' && matrix.libc != 'gnu' }}
+        run: echo "Skipping build for PR"

.github/workflows/openapi.yaml

@@ -1,7 +1,5 @@
 name: Cloud Hypervisor OpenAPI Validation
-
-on:
-  pull_request:
+on: [pull_request, merge_group]
 
 jobs:
   Validate:

.github/workflows/quality.yaml

@@ -1,9 +1,11 @@
 name: Cloud Hypervisor Quality Checks
-on: [pull_request, create]
+on: [pull_request, merge_group]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
-    if: github.event_name == 'pull_request'
     name: Quality (clippy, rustfmt)
     runs-on: ubuntu-latest
     continue-on-error: ${{ matrix.experimental }}
@@ -46,8 +48,8 @@ jobs:
           override: true
           components: rustfmt, clippy
 
-      - name: Debug Check (default features)
-        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
+      - name: Bisectability Check (default features)
+        if: ${{ github.event_name == 'pull_request' && matrix.target == 'x86_64-unknown-linux-gnu' }}
         run: |
           set -e
           commits=$(git rev-list origin/${{ github.base_ref }}..${{ github.sha }})

.github/workflows/release.yaml

@@ -1,134 +1,69 @@
 name: Cloud Hypervisor Release
-on: [pull_request, create]
+on: [create, merge_group]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+env:
+  GITHUB_TOKEN: ${{ github.token }}
 
 jobs:
   release:
-    if: (github.event_name == 'create' && github.event.ref_type == 'tag') || github.event_name == 'pull_request'
-    name: Release
+    if: (github.event_name == 'create' && github.event.ref_type == 'tag') || github.event_name == 'merge_group'
+    name: Release ${{ matrix.platform.target }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+        - target: x86_64-unknown-linux-gnu
+          args: --all --release --features mshv
+          name_ch: cloud-hypervisor
+          name_ch_remote: ch-remote
+        - target: x86_64-unknown-linux-musl
+          args: --all --release --features mshv
+          name_ch: cloud-hypervisor-static
+          name_ch_remote: ch-remote-static
+        - target: aarch64-unknown-linux-musl
+          args:  --all --release
+          name_ch: cloud-hypervisor-static-aarch64
+          name_ch_remote: ch-remote-static-aarch64
     runs-on: ubuntu-latest
     steps:
       - name: Code checkout
         uses: actions/checkout@v4
       - name: Install musl-gcc
+        if: contains(matrix.platform.target, 'musl')
         run: sudo apt install -y musl-tools
       - name: Create release directory
+        if: |
+          github.event_name == 'create' && github.event.ref_type == 'tag' &&
+          matrix.platform.target == 'x86_64-unknown-linux-gnu'
         run: rsync -rv --exclude=.git . ../cloud-hypervisor-${{ github.event.ref }}
-      - name: Install Rust toolchain (x86_64-unknown-linux-gnu)
-        uses: actions-rs/toolchain@v1
+      - name: Build ${{ matrix.platform.target }}
+        uses: houseabsolute/actions-rust-cross@v0
         with:
-          toolchain: "1.70"
-          target: x86_64-unknown-linux-gnu
-      - name: Install Rust toolchain (x86_64-unknown-linux-musl)
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: "1.70"
-          target: x86_64-unknown-linux-musl
-      - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          toolchain: "1.70"
           command: build
-          args: --all --release --features mshv --target=x86_64-unknown-linux-gnu
-      - name: Static Build
-        uses: actions-rs/cargo@v1
-        with:
-          toolchain: "1.70"
-          command: build
-          args: --all --release --features mshv --target=x86_64-unknown-linux-musl
-      - name: Install Rust toolchain (aarch64-unknown-linux-musl)
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: "1.70"
-          target: aarch64-unknown-linux-musl
-          override: true
-      - name: Create Release
+          target: ${{ matrix.platform.target }}
+          args: ${{ matrix.platform.args  }}
+          strip: true
+          toolchain: 1.74.1
+      - name: Copy Release Binaries
         if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: ${{ github.ref }}
-          draft: true
-          prerelease: true
-      - name: Upload cloud-hypervisor
+        shell: bash
+        run: |
+          cp target/${{ matrix.platform.target }}/release/cloud-hypervisor ./${{ matrix.platform.name_ch }}
+          cp target/${{ matrix.platform.target }}/release/ch-remote ./${{ matrix.platform.name_ch_remote }}
+      - name: Upload Release Artifacts
         if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: upload-release-cloud-hypervisor
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: actions/upload-artifact@v3
         with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: target/x86_64-unknown-linux-gnu/release/cloud-hypervisor
-          asset_name: cloud-hypervisor
-          asset_content_type: application/octet-stream
-      - name: Upload static cloud-hypervisor
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: upload-release-static-cloud-hypervisor
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: target/x86_64-unknown-linux-musl/release/cloud-hypervisor
-          asset_name: cloud-hypervisor-static
-          asset_content_type: application/octet-stream
-      - name: Upload ch-remote
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: upload-release-ch-remote
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: target/x86_64-unknown-linux-gnu/release/ch-remote
-          asset_name: ch-remote
-          asset_content_type: application/octet-stream
-      - name: Upload static-ch-remote
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: upload-release-static-ch-remote
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: target/x86_64-unknown-linux-musl/release/ch-remote
-          asset_name: ch-remote-static
-          asset_content_type: application/octet-stream
-      - name: Clean build tree ahead of cross build
-        uses: actions-rs/cargo@v1
-        with:
-          command: clean
-      - name: Static Build (AArch64)
-        uses: actions-rs/cargo@v1
-        with:
-          use-cross: true
-          command: build
-          args: --all --release --target=aarch64-unknown-linux-musl
-      - name: Upload static AArch64 cloud-hypervisor
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: upload-release-static-aarch64-cloud-hypervisor
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: target/aarch64-unknown-linux-musl/release/cloud-hypervisor
-          asset_name: cloud-hypervisor-static-aarch64
-          asset_content_type: application/octet-stream
-      - name: Upload static AArch64 ch-remote
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
-        id: upload-release-static-aarch64-ch-remote
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: target/aarch64-unknown-linux-musl/release/ch-remote
-          asset_name: ch-remote-static-aarch64
-          asset_content_type: application/octet-stream
+          name: Artifacts for ${{ matrix.platform.target }}
+          path: |
+            ./${{ matrix.platform.name_ch }}
+            ./${{ matrix.platform.name_ch_remote }}
       - name: Vendor
+        if: |
+          github.event_name == 'create' && github.event.ref_type == 'tag' &&
+          matrix.platform.target == 'x86_64-unknown-linux-gnu'
         working-directory: ../cloud-hypervisor-${{ github.event.ref }}
         run: |
           mkdir ../vendor-cargo-home
@@ -136,16 +71,24 @@ jobs:
           mkdir .cargo
           cargo vendor > .cargo/config.toml
       - name: Create vendored source archive
-        working-directory: ../
-        run: tar cJf cloud-hypervisor-${{ github.event.ref }}.tar.xz cloud-hypervisor-${{ github.event.ref }}
+        if: |
+          github.event_name == 'create' && github.event.ref_type == 'tag' &&
+          matrix.platform.target == 'x86_64-unknown-linux-gnu'
+        run: tar cJf cloud-hypervisor-${{ github.event.ref }}.tar.xz ../cloud-hypervisor-${{ github.event.ref }}
       - name: Upload cloud-hypervisor vendored source archive
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
+        if: |
+          github.event_name == 'create' && github.event.ref_type == 'tag' &&
+          matrix.platform.target == 'x86_64-unknown-linux-gnu'
         id: upload-release-cloud-hypervisor-vendored-sources
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: actions/upload-artifact@v3
         with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ../cloud-hypervisor-${{ github.event.ref }}.tar.xz
-          asset_name: cloud-hypervisor-${{ github.event.ref }}.tar.xz
-          asset_content_type: application/x-xz
+          path: cloud-hypervisor-${{ github.event.ref }}.tar.xz
+          name: cloud-hypervisor-${{ github.event.ref }}.tar.xz
+      - name: Create GitHub Release
+        if: github.event_name == 'create' && github.event.ref_type == 'tag'
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            ./${{ matrix.platform.name_ch }}
+            ./${{ matrix.platform.name_ch_remote }}
+            ./cloud-hypervisor-${{ github.event.ref }}.tar.xz

.github/workflows/reuse.yaml

@@ -0,0 +1,12 @@
+name: REUSE Compliance Check
+
+on: [push, pull_request]
+
+jobs:
+  reuse:
+    name: REUSE Compliance Check
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: REUSE Compliance Check
+      uses: fsfe/reuse-action@v3

.github/workflows/shlint.yaml

@@ -1,7 +1,7 @@
 name: Shell scripts check
-
 on:
   pull_request:
+  merge_group:
   push:
     branches:
       - main

.reuse/dep5

@@ -0,0 +1,12 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: cloud-hypervisor
+Upstream-Contact:  <>
+Source: https://www.cloudhypervisor.org
+
+Files: docs/*.md *.md
+Copyright: 2024
+License: CC-BY-4.0
+
+Files: scripts/* test_data/* *.toml .git* fuzz/Cargo.lock fuzz/.gitignore resources/linux-config-* vmm/src/api/openapi/cloud-hypervisor.yaml CODEOWNERS Cargo.lock
+Copyright: 2024
+License: Apache-2.0

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cloud-hypervisor"
-version = "38.0.0"
+version = "39.0.0"
 authors = ["The Cloud Hypervisor Authors"]
 edition = "2021"
 default-run = "cloud-hypervisor"
@@ -15,7 +15,7 @@ homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor"
 # a.) A dependency requires it,
 # b.) If we want to use a new feature and that MSRV is at least 6 months old,
 # c.) There is a security issue that is addressed by the toolchain update.
-rust-version = "1.70"
+rust-version = "1.74.1"
 
 [profile.release]
 lto = true
@@ -29,37 +29,32 @@ strip = false
 debug = true
 
 [dependencies]
-anyhow = "1.0.79"
+anyhow = "1.0.81"
 api_client = { path = "api_client" }
-clap = { version = "4.4.7", features = ["string"] }
+clap = { version = "4.5.4", features = ["string"] }
 dhat = { version = "0.3.3", optional = true }
 epoll = "4.3.3"
 event_monitor = { path = "event_monitor" }
 hypervisor = { path = "hypervisor" }
 libc = "0.2.153"
-log = { version = "0.4.20", features = ["std"] }
+log = { version = "0.4.21", features = ["std"] }
 option_parser = { path = "option_parser" }
 seccompiler = "0.4.0"
-serde_json = "1.0.109"
+serde_json = "1.0.115"
 signal-hook = "0.3.17"
-thiserror = "1.0.52"
+thiserror = "1.0.58"
 tpm = { path = "tpm"}
 tracer = { path = "tracer" }
 vmm = { path = "vmm" }
 vmm-sys-util = "0.12.1"
-vm-memory = "0.14.0"
-zbus = { version = "3.11.1", optional = true }
-
-# List of patched crates
-[patch.crates-io]
-kvm-bindings = { git = "https://github.com/cloud-hypervisor/kvm-bindings", branch = "ch-v0.7.0" }
-versionize_derive = { git = "https://github.com/cloud-hypervisor/versionize_derive", branch = "ch-0.1.6" }
+vm-memory = "0.14.1"
+zbus = { version = "3.15.2", optional = true }
 
 [dev-dependencies]
-dirs = "5.0.0"
+dirs = "5.0.1"
 net_util = { path = "net_util" }
 once_cell = "1.19.0"
-serde_json = "1.0.109"
+serde_json = "1.0.115"
 test_infra = { path = "test_infra" }
 wait-timeout = "0.2.0"
 

Jenkinsfile

@@ -1,530 +0,0 @@
-def runWorkers = true
-pipeline {
-    agent none
-    options {
-        timeout(time: 4, unit: 'HOURS')
-    }
-    stages {
-        stage('Early checks') {
-            agent { node { label 'built-in' } }
-            stages {
-                stage('Checkout') {
-                    steps {
-                        checkout scm
-                    }
-                }
-                stage('Check if worker build can be skipped') {
-                    when {
-                        expression {
-                            return skipWorkerBuild()
-                        }
-                    }
-                    steps {
-                        script {
-                            runWorkers = false
-                            echo 'No changes requiring a build'
-                        }
-                    }
-                }
-                stage('Check for RFC/WIP builds') {
-                    when {
-                        changeRequest comparator: 'REGEXP', title: '.*(rfc|RFC|wip|WIP).*'
-                        beforeAgent true
-                    }
-                    steps {
-                        error('Failing as this is marked as a WIP or RFC PR.')
-                    }
-                }
-                stage('Cancel older builds') {
-                    when { not { branch 'main' } }
-                    steps {
-                        cancelPreviousBuilds()
-                    }
-                }
-            }
-        }
-        stage('Build') {
-            parallel {
-                stage('Worker build') {
-                    agent { node { label 'jammy' } }
-                    when {
-                        beforeAgent true
-                        expression {
-                            return runWorkers
-                        }
-                    }
-                    environment {
-                        AUTH_DOWNLOAD_TOKEN = credentials('8a26fd74-d40e-414c-9132-ff3f867806ef')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Prepare environment') {
-                            steps {
-                                sh 'scripts/prepare_vdpa.sh'
-                            }
-                        }
-                        stage('Run unit tests') {
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --unit'
-                            }
-                        }
-                        stage('Run integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration'
-                            }
-                        }
-                        stage('Run live-migration integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration-live-migration'
-                            }
-                        }
-                        stage('Run unit tests for musl') {
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --unit --libc musl'
-                            }
-                        }
-                        stage('Run integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration --libc musl'
-                            }
-                        }
-                        stage('Run live-migration integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration-live-migration --libc musl'
-                            }
-                        }
-                    }
-                }
-                stage('Worker build - AMD') {
-                    agent { node { label 'jammy-amd' } }
-                    when {
-                        beforeAgent true
-                        expression {
-                            return runWorkers
-                        }
-                    }
-                    environment {
-                        AUTH_DOWNLOAD_TOKEN = credentials('8a26fd74-d40e-414c-9132-ff3f867806ef')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Prepare environment') {
-                            steps {
-                                sh 'scripts/prepare_vdpa.sh'
-                            }
-                        }
-                        stage('Run integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration'
-                            }
-                        }
-                        stage('Run live-migration integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration-live-migration'
-                            }
-                        }
-                        stage('Run integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration --libc musl'
-                            }
-                        }
-                        stage('Run live-migration integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration-live-migration --libc musl'
-                            }
-                        }
-                    }
-                }
-                stage('AArch64 worker build') {
-                    agent { node { label 'bionic-arm64' } }
-                    when {
-                        beforeAgent true
-                        expression {
-                            return runWorkers
-                        }
-                    }
-                    environment {
-                            AZURE_CONNECTION_STRING = credentials('46b4e7d6-315f-4cc1-8333-b58780863b9b')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Run unit tests') {
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --unit --libc musl'
-                            }
-                        }
-                        stage('Run integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'sudo modprobe openvswitch'
-                                sh 'scripts/dev_cli.sh tests --integration --libc musl'
-                            }
-                        }
-                        stage('Install azure-cli') {
-                            steps {
-                                installAzureCli('focal', 'arm64')
-                            }
-                        }
-                        stage('Download Windows image') {
-                            steps {
-                                sh '''#!/bin/bash -x
-                                    IMG_BASENAME=windows-11-iot-enterprise-aarch64.raw
-                                    IMG_PATH=$HOME/workloads/$IMG_BASENAME
-                                    IMG_GZ_PATH=$HOME/workloads/$IMG_BASENAME.gz
-                                    IMG_GZ_BLOB_NAME=windows-11-iot-enterprise-aarch64-9-min.raw.gz
-                                    cp "scripts/$IMG_BASENAME.sha1" "$HOME/workloads/"
-                                    pushd "$HOME/workloads"
-                                    if sha1sum "$IMG_BASENAME.sha1" --check; then
-                                        exit
-                                    fi
-                                    popd
-                                    mkdir -p "$HOME/workloads"
-                                    az storage blob download \
-                                        --container-name private-images \
-                                        --file "$IMG_GZ_PATH" \
-                                        --name "$IMG_GZ_BLOB_NAME" \
-                                        --connection-string "$AZURE_CONNECTION_STRING"
-                                    gzip -d $IMG_GZ_PATH
-                                '''
-                            }
-                        }
-                        stage('Run Windows guest integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-windows --libc musl'
-                            }
-                        }
-                    }
-                    post {
-                        always {
-                            sh "sudo chown -R jenkins.jenkins ${WORKSPACE}"
-                            deleteDir()
-                        }
-                    }
-                }
-                stage('Worker build - Windows guest') {
-                    agent { node { label 'jammy' } }
-                    when {
-                        beforeAgent true
-                        expression {
-                            return runWorkers
-                        }
-                    }
-                    environment {
-                            AZURE_CONNECTION_STRING = credentials('46b4e7d6-315f-4cc1-8333-b58780863b9b')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Install azure-cli') {
-                            steps {
-                                installAzureCli('jammy', 'amd64')
-                            }
-                        }
-                        stage('Download assets') {
-                            steps {
-                                sh "mkdir ${env.HOME}/workloads"
-                                sh 'az storage blob download --container-name private-images --file "$HOME/workloads/windows-server-2022-amd64-2.raw" --name windows-server-2022-amd64-2.raw --connection-string "$AZURE_CONNECTION_STRING"'
-                            }
-                        }
-                        stage('Run Windows guest integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-windows'
-                            }
-                        }
-                        stage('Run Windows guest integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-windows --libc musl'
-                            }
-                        }
-                    }
-                }
-                stage('Worker build - Metrics') {
-                    agent { node { label 'jammy-metrics' } }
-                    when {
-                        branch 'main'
-                        beforeAgent true
-                        expression {
-                            return runWorkers
-                        }
-                    }
-                    environment {
-                        METRICS_PUBLISH_KEY = credentials('52e0945f-ce7a-43d1-87af-67d1d87cc40f')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Run metrics tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --metrics -- -- --report-file /root/workloads/metrics.json'
-                            }
-                        }
-                        stage('Upload metrics report') {
-                            steps {
-                                sh 'curl -X PUT https://cloud-hypervisor-metrics.azurewebsites.net/api/publishmetrics -H "x-functions-key: $METRICS_PUBLISH_KEY" -T ~/workloads/metrics.json'
-                            }
-                        }
-                    }
-                }
-                stage('Worker build - Rate Limiter') {
-                    agent { node { label 'focal-metrics' } }
-                    when {
-                        branch 'main'
-                        beforeAgent true
-                        expression {
-                            return runWorkers
-                        }
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Run rate-limiter integration tests') {
-                            options {
-                                timeout(time: 10, unit: 'MINUTES')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-rate-limiter'
-                            }
-                        }
-                    }
-                }
-                stage('Worker build - SGX') {
-                    agent { node { label 'jammy-sgx' } }
-                    when {
-                        beforeAgent true
-                        allOf {
-                            branch 'main'
-                            expression {
-                                return runWorkers
-                            }
-                        }
-                    }
-                    environment {
-                        AUTH_DOWNLOAD_TOKEN = credentials('8a26fd74-d40e-414c-9132-ff3f867806ef')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Run SGX integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-sgx'
-                            }
-                        }
-                        stage('Run SGX integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-sgx --libc musl'
-                            }
-                        }
-                    }
-                    post {
-                        always {
-                            sh "sudo chown -R jenkins.jenkins ${WORKSPACE}"
-                            deleteDir()
-                        }
-                    }
-                }
-                stage('Worker build - VFIO') {
-                    agent { node { label 'jammy-vfio' } }
-                    when {
-                        beforeAgent true
-                        allOf {
-                            branch 'main'
-                            expression {
-                                return runWorkers
-                            }
-                        }
-                    }
-                    environment {
-                        AUTH_DOWNLOAD_TOKEN = credentials('8a26fd74-d40e-414c-9132-ff3f867806ef')
-                    }
-                    stages {
-                        stage('Checkout') {
-                            steps {
-                                checkout scm
-                            }
-                        }
-                        stage('Run VFIO integration tests') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-vfio'
-                            }
-                        }
-                        stage('Run VFIO integration tests for musl') {
-                            options {
-                                timeout(time: 1, unit: 'HOURS')
-                            }
-                            steps {
-                                sh 'scripts/dev_cli.sh tests --integration-vfio --libc musl'
-                            }
-                        }
-                    }
-                    post {
-                        always {
-                            sh "sudo chown -R jenkins.jenkins ${WORKSPACE}"
-                            deleteDir()
-                        }
-                    }
-                }
-            }
-        }
-    }
-    post {
-        regression {
-            script {
-                if (env.BRANCH_NAME == 'main') {
-                    slackSend(color: '#ff0000', message: '"main" branch build is now failing', channel: '#jenkins-ci')
-                }
-            }
-        }
-        fixed {
-            script {
-                if (env.BRANCH_NAME == 'main') {
-                    slackSend(color: '#00ff00', message: '"main" branch build is now fixed', channel: '#jenkins-ci')
-                }
-            }
-        }
-    }
-}
-
-def cancelPreviousBuilds() {
-    // Check for other instances of this particular build, cancel any that are older than the current one
-    def jobName = env.JOB_NAME
-    def currentBuildNumber = env.BUILD_NUMBER.toInteger()
-    def currentJob = Jenkins.instance.getItemByFullName(jobName)
-
-    // Loop through all instances of this particular job/branch
-    for (def build : currentJob.builds) {
-        if (build.isBuilding() && (build.number.toInteger() < currentBuildNumber)) {
-            echo "Older build still queued. Sending kill signal to build number: ${build.number}"
-            build.doStop()
-        }
-    }
-}
-
-def installAzureCli(distro, arch) {
-    sh 'sudo apt install -y ca-certificates curl apt-transport-https lsb-release gnupg'
-    sh 'curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null'
-    sh "echo \"deb [arch=${arch}] https://packages.microsoft.com/repos/azure-cli/ ${distro} main\" | sudo tee /etc/apt/sources.list.d/azure-cli.list"
-    sh 'sudo apt update'
-    sh 'sudo apt install -y azure-cli'
-}
-
-def boolean skipWorkerBuild() {
-    if (env.CHANGE_TARGET == null) {
-        return false
-    }
-
-    if (sh(
-        returnStatus: true,
-        script: "git diff --name-only origin/${env.CHANGE_TARGET}... | grep -v '\\.md'"
-    ) != 0) {
-        return true
-    }
-
-    if (sh(
-        returnStatus: true,
-        script: "git diff --name-only origin/${env.CHANGE_TARGET}... | grep -v -E 'fuzz/'"
-    ) != 0) {
-        return true
-    }
-
-    if (sh(
-        returnStatus: true,
-        script: "git diff --name-only origin/${env.CHANGE_TARGET}... | grep -v -E '.github/'"
-    ) != 0) {
-        return true
-    }
-
-    if (sh(
-        returnStatus: true,
-        script: "git diff --name-only origin/${env.CHANGE_TARGET}... | grep -v '^\\.'"
-    ) != 0) {
-        return true
-    }
-
-    if (sh(
-        returnStatus: true,
-        script: "git diff --name-only origin/${env.CHANGE_TARGET}... | grep -v 'gitlint'"
-    ) != 0) {
-        return true
-    }
-
-    return false
-}

LICENSES/CC-BY-4.0.txt

@@ -1,4 +1,5 @@
-The documentation in this directory is covered by the following license:
+All documentations (e.g. files with extension `.md`) in this repository is
+covered by the following license:
 
 Attribution 4.0 International
 

README.md

@@ -108,7 +108,7 @@ do not wish to use the pre-built binaries.
 ## Booting Linux
 
 Cloud Hypervisor supports direct kernel boot (the x86-64 kernel requires the kernel
-built with PVH support) or booting via a firmware (either [Rust Hypervisor
+built with PVH support or a bzImage) or booting via a firmware (either [Rust Hypervisor
 Firmware](https://github.com/cloud-hypervisor/rust-hypervisor-firmware) or an
 edk2 UEFI firmware called `CLOUDHV` / `CLOUDHV_EFI`.)
 
@@ -175,7 +175,7 @@ $ ./cloud-hypervisor \
 
 #### Building your Kernel
 
-Cloud Hypervisor also supports direct kernel boot. For x86-64, a `vmlinux` ELF kernel (compiled with PVH support) is needed. In order to support development there is a custom branch; however provided the required options are enabled any recent kernel will suffice.
+Cloud Hypervisor also supports direct kernel boot. For x86-64, a `vmlinux` ELF kernel (compiled with PVH support) or a regular bzImage are supported. In order to support development there is a custom branch; however provided the required options are enabled any recent kernel will suffice.
 
 To build the kernel:
 

arch/Cargo.toml

@@ -10,21 +10,19 @@ sev_snp = []
 tdx = []
 
 [dependencies]
-anyhow = "1.0.79"
-byteorder = "1.4.3"
+anyhow = "1.0.81"
+byteorder = "1.5.0"
 hypervisor = { path = "../hypervisor" }
 libc = "0.2.153"
 linux-loader = { version = "0.11.0", features = ["elf", "bzimage", "pe"] }
-log = "0.4.20"
-serde = { version = "1.0.196", features = ["rc", "derive"] }
-thiserror = "1.0.52"
-uuid = "1.3.4"
-versionize = "0.2.0"
-versionize_derive = "0.1.6"
-vm-memory = { version = "0.14.0", features = ["backend-mmap", "backend-bitmap"] }
+log = "0.4.21"
+serde = { version = "1.0.197", features = ["rc", "derive"] }
+thiserror = "1.0.58"
+uuid = "1.8.0"
+vm-memory = { version = "0.14.1", features = ["backend-mmap", "backend-bitmap"] }
 vm-migration = { path = "../vm-migration" }
 vmm-sys-util = { version = "0.12.1", features = ["with-serde"] }
 
 [target.'cfg(target_arch = "aarch64")'.dependencies]
-fdt_parser = { version = "0.1.4", package = "fdt" }
+fdt_parser = { version = "0.1.5", package = "fdt" }
 vm-fdt = { git = "https://github.com/rust-vmm/vm-fdt", branch = "main" }

arch/src/aarch64/mod.rs

@@ -16,7 +16,6 @@ use crate::{DeviceType, GuestMemoryMmap, NumaNodes, PciSpaceInfo, RegionType};
 use hypervisor::arch::aarch64::gic::Vgic;
 use log::{log_enabled, Level};
 use std::collections::HashMap;
-use std::convert::TryInto;
 use std::fmt::Debug;
 use std::sync::{Arc, Mutex};
 use vm_memory::{Address, GuestAddress, GuestMemory, GuestMemoryAtomic};

arch/src/aarch64/uefi.rs

@@ -1,4 +1,6 @@
 // Copyright 2020 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 use std::io::{Read, Seek, SeekFrom};
 use std::os::fd::AsFd;

arch/src/lib.rs

@@ -18,9 +18,6 @@ use std::fmt;
 use std::result;
 use std::sync::Arc;
 use thiserror::Error;
-use versionize::{VersionMap, Versionize, VersionizeError, VersionizeResult};
-use versionize_derive::Versionize;
-use vm_migration::VersionMapped;
 
 type GuestMemoryMmap = vm_memory::GuestMemoryMmap<vm_memory::bitmap::AtomicBitmap>;
 type GuestRegionMmap = vm_memory::GuestRegionMmap<vm_memory::bitmap::AtomicBitmap>;
@@ -48,13 +45,17 @@ pub enum Error {
     ModlistSetup(#[source] vm_memory::GuestMemoryError),
     #[error("RSDP extends past the end of guest memory")]
     RsdpPastRamEnd,
+    #[error("Failed to setup Zero Page for bzImage")]
+    ZeroPageSetup(#[source] vm_memory::GuestMemoryError),
+    #[error("Zero Page for bzImage past RAM end")]
+    ZeroPagePastRamEnd,
 }
 
 /// Type for returning public functions outcome.
 pub type Result<T> = result::Result<T, Error>;
 
 /// Type for memory region types.
-#[derive(Clone, Copy, PartialEq, Eq, Debug, Serialize, Deserialize, Versionize)]
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Serialize, Deserialize)]
 pub enum RegionType {
     /// RAM type
     Ram,
@@ -72,8 +73,6 @@ pub enum RegionType {
     Reserved,
 }
 
-impl VersionMapped for RegionType {}
-
 /// Module for aarch64 related functionality.
 #[cfg(target_arch = "aarch64")]
 pub mod aarch64;

arch/src/x86_64/mod.rs

@@ -17,6 +17,7 @@ use crate::InitramfsConfig;
 use crate::RegionType;
 use hypervisor::arch::x86::{CpuIdEntry, CPUID_FLAG_VALID_INDEX};
 use hypervisor::{CpuVendor, HypervisorCpuError, HypervisorError};
+use linux_loader::loader::bootparam::{boot_params, setup_header};
 use linux_loader::loader::elf::start_info::{
     hvm_memmap_table_entry, hvm_modlist_entry, hvm_start_info,
 };
@@ -63,6 +64,8 @@ pub const _NSIG: i32 = 65;
 pub struct EntryPoint {
     /// Address in guest memory where the guest must start execution
     pub entry_addr: GuestAddress,
+    /// This field is used for bzImage to fill the zero page
+    pub setup_header: Option<setup_header>,
 }
 
 const E820_RAM: u32 = 1;
@@ -180,6 +183,9 @@ pub enum Error {
     /// Error retrieving TDX capabilities through the hypervisor (kvm/mshv) API
     #[cfg(feature = "tdx")]
     TdxCapabilities(HypervisorError),
+
+    /// Failed to configure E820 map for bzImage
+    E820Configuration,
 }
 
 impl From<Error> for super::Error {
@@ -842,8 +848,7 @@ pub fn configure_vcpu(
 
     regs::setup_msrs(vcpu).map_err(Error::MsrsConfiguration)?;
     if let Some((kernel_entry_point, guest_memory)) = boot_setup {
-        regs::setup_regs(vcpu, kernel_entry_point.entry_addr.raw_value())
-            .map_err(Error::RegsConfiguration)?;
+        regs::setup_regs(vcpu, kernel_entry_point).map_err(Error::RegsConfiguration)?;
         regs::setup_fpu(vcpu).map_err(Error::FpuConfiguration)?;
         regs::setup_sregs(&guest_memory.memory(), vcpu).map_err(Error::SregsConfiguration)?;
     }
@@ -892,8 +897,10 @@ pub fn arch_memory_regions() -> Vec<(GuestAddress, usize, RegionType)> {
 pub fn configure_system(
     guest_mem: &GuestMemoryMmap,
     cmdline_addr: GuestAddress,
+    cmdline_size: usize,
     initramfs: &Option<InitramfsConfig>,
     _num_cpus: u8,
+    setup_header: Option<setup_header>,
     rsdp_addr: Option<GuestAddress>,
     sgx_epc_region: Option<SgxEpcRegion>,
     serial_number: Option<&str>,
@@ -921,13 +928,24 @@ pub fn configure_system(
         }
     }
 
-    configure_pvh(
-        guest_mem,
-        cmdline_addr,
-        initramfs,
-        rsdp_addr,
-        sgx_epc_region,
-    )
+    match setup_header {
+        Some(hdr) => configure_32bit_entry(
+            guest_mem,
+            cmdline_addr,
+            cmdline_size,
+            initramfs,
+            hdr,
+            rsdp_addr,
+            sgx_epc_region,
+        ),
+        None => configure_pvh(
+            guest_mem,
+            cmdline_addr,
+            initramfs,
+            rsdp_addr,
+            sgx_epc_region,
+        ),
+    }
 }
 
 type RamRange = (u64, u64);
@@ -1132,6 +1150,113 @@ fn configure_pvh(
     Ok(())
 }
 
+fn configure_32bit_entry(
+    guest_mem: &GuestMemoryMmap,
+    cmdline_addr: GuestAddress,
+    cmdline_size: usize,
+    initramfs: &Option<InitramfsConfig>,
+    setup_hdr: setup_header,
+    rsdp_addr: Option<GuestAddress>,
+    sgx_epc_region: Option<SgxEpcRegion>,
+) -> super::Result<()> {
+    const KERNEL_LOADER_OTHER: u8 = 0xff;
+
+    // Use the provided setup header
+    let mut params = boot_params {
+        hdr: setup_hdr,
+        ..Default::default()
+    };
+
+    // Common bootparams settings
+    if params.hdr.type_of_loader == 0 {
+        params.hdr.type_of_loader = KERNEL_LOADER_OTHER;
+    }
+    params.hdr.cmd_line_ptr = cmdline_addr.raw_value() as u32;
+    params.hdr.cmdline_size = cmdline_size as u32;
+
+    if let Some(initramfs_config) = initramfs {
+        params.hdr.ramdisk_image = initramfs_config.address.raw_value() as u32;
+        params.hdr.ramdisk_size = initramfs_config.size as u32;
+    }
+
+    add_e820_entry(&mut params, 0, layout::EBDA_START.raw_value(), E820_RAM)?;
+
+    let mem_end = guest_mem.last_addr();
+    if mem_end < layout::MEM_32BIT_RESERVED_START {
+        add_e820_entry(
+            &mut params,
+            layout::HIGH_RAM_START.raw_value(),
+            mem_end.unchecked_offset_from(layout::HIGH_RAM_START) + 1,
+            E820_RAM,
+        )?;
+    } else {
+        add_e820_entry(
+            &mut params,
+            layout::HIGH_RAM_START.raw_value(),
+            layout::MEM_32BIT_RESERVED_START.unchecked_offset_from(layout::HIGH_RAM_START),
+            E820_RAM,
+        )?;
+        if mem_end > layout::RAM_64BIT_START {
+            add_e820_entry(
+                &mut params,
+                layout::RAM_64BIT_START.raw_value(),
+                mem_end.unchecked_offset_from(layout::RAM_64BIT_START) + 1,
+                E820_RAM,
+            )?;
+        }
+    }
+
+    add_e820_entry(
+        &mut params,
+        layout::PCI_MMCONFIG_START.0,
+        layout::PCI_MMCONFIG_SIZE,
+        E820_RESERVED,
+    )?;
+
+    if let Some(sgx_epc_region) = sgx_epc_region {
+        add_e820_entry(
+            &mut params,
+            sgx_epc_region.start().raw_value(),
+            sgx_epc_region.size(),
+            E820_RESERVED,
+        )?;
+    }
+
+    if let Some(rsdp_addr) = rsdp_addr {
+        params.acpi_rsdp_addr = rsdp_addr.0;
+    }
+
+    let zero_page_addr = layout::ZERO_PAGE_START;
+    guest_mem
+        .checked_offset(zero_page_addr, mem::size_of::<boot_params>())
+        .ok_or(super::Error::ZeroPagePastRamEnd)?;
+    guest_mem
+        .write_obj(params, zero_page_addr)
+        .map_err(super::Error::ZeroPageSetup)?;
+
+    Ok(())
+}
+
+/// Add an e820 region to the e820 map.
+/// Returns Ok(()) if successful, or an error if there is no space left in the map.
+fn add_e820_entry(
+    params: &mut boot_params,
+    addr: u64,
+    size: u64,
+    mem_type: u32,
+) -> Result<(), Error> {
+    if params.e820_entries >= params.e820_table.len() as u8 {
+        return Err(Error::E820Configuration);
+    }
+
+    params.e820_table[params.e820_entries as usize].addr = addr;
+    params.e820_table[params.e820_entries as usize].size = size;
+    params.e820_table[params.e820_entries as usize].type_ = mem_type;
+    params.e820_entries += 1;
+
+    Ok(())
+}
+
 fn add_memmap_entry(memmap: &mut Vec<hvm_memmap_table_entry>, addr: u64, size: u64, mem_type: u32) {
     // Add the table entry to the vector
     memmap.push(hvm_memmap_table_entry {
@@ -1378,6 +1503,7 @@ fn update_cpuid_sgx(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use linux_loader::loader::bootparam::boot_e820_entry;
 
     #[test]
     fn regions_base_addr() {
@@ -1394,8 +1520,10 @@ mod tests {
         let config_err = configure_system(
             &gm,
             GuestAddress(0),
+            0,
             &None,
             1,
+            None,
             Some(layout::RSDP_POINTER),
             None,
             None,
@@ -1417,6 +1545,7 @@ mod tests {
         configure_system(
             &gm,
             GuestAddress(0),
+            0,
             &None,
             no_vcpus,
             None,
@@ -1425,6 +1554,7 @@ mod tests {
             None,
             None,
             None,
+            None,
         )
         .unwrap();
 
@@ -1445,6 +1575,7 @@ mod tests {
         configure_system(
             &gm,
             GuestAddress(0),
+            0,
             &None,
             no_vcpus,
             None,
@@ -1453,12 +1584,14 @@ mod tests {
             None,
             None,
             None,
+            None,
         )
         .unwrap();
 
         configure_system(
             &gm,
             GuestAddress(0),
+            0,
             &None,
             no_vcpus,
             None,
@@ -1467,10 +1600,51 @@ mod tests {
             None,
             None,
             None,
+            None,
         )
         .unwrap();
     }
 
+    #[test]
+    fn test_add_e820_entry() {
+        let e820_table = [(boot_e820_entry {
+            addr: 0x1,
+            size: 4,
+            type_: 1,
+        }); 128];
+
+        let expected_params = boot_params {
+            e820_table,
+            e820_entries: 1,
+            ..Default::default()
+        };
+
+        let mut params: boot_params = Default::default();
+        add_e820_entry(
+            &mut params,
+            e820_table[0].addr,
+            e820_table[0].size,
+            e820_table[0].type_,
+        )
+        .unwrap();
+        assert_eq!(
+            format!("{:?}", params.e820_table[0]),
+            format!("{:?}", expected_params.e820_table[0])
+        );
+        assert_eq!(params.e820_entries, expected_params.e820_entries);
+
+        // Exercise the scenario where the field storing the length of the e820 entry table is
+        // is bigger than the allocated memory.
+        params.e820_entries = params.e820_table.len() as u8 + 1;
+        assert!(add_e820_entry(
+            &mut params,
+            e820_table[0].addr,
+            e820_table[0].size,
+            e820_table[0].type_
+        )
+        .is_err());
+    }
+
     #[test]
     fn test_add_memmap_entry() {
         let mut memmap: Vec<hvm_memmap_table_entry> = Vec::new();

arch/src/x86_64/mpspec.rs

@@ -1,4 +1,6 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
 

arch/src/x86_64/mptable.rs

@@ -300,8 +300,7 @@ mod tests {
     use super::*;
     use crate::layout::MPTABLE_START;
     use vm_memory::{
-        bitmap::BitmapSlice, GuestAddress, GuestUsize, VolatileMemoryError, VolatileSlice,
-        WriteVolatile,
+        bitmap::BitmapSlice, GuestUsize, VolatileMemoryError, VolatileSlice, WriteVolatile,
     };
 
     fn table_entry_size(type_: u8) -> usize {

arch/src/x86_64/regs.rs

@@ -6,8 +6,10 @@
 // Portions Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
-use crate::layout::{BOOT_GDT_START, BOOT_IDT_START, PVH_INFO_START};
-use crate::GuestMemoryMmap;
+use crate::layout::{
+    BOOT_GDT_START, BOOT_IDT_START, BOOT_STACK_POINTER, PVH_INFO_START, ZERO_PAGE_START,
+};
+use crate::{EntryPoint, GuestMemoryMmap};
 use hypervisor::arch::x86::gdt::{gdt_entry, segment_from_gdt};
 use hypervisor::arch::x86::regs::CR0_PE;
 use hypervisor::arch::x86::{FpuState, SpecialRegisters, StandardRegisters};
@@ -77,13 +79,22 @@ pub fn setup_msrs(vcpu: &Arc<dyn hypervisor::Vcpu>) -> Result<()> {
 /// # Arguments
 ///
 /// * `vcpu` - Structure for the VCPU that holds the VCPU's fd.
-/// * `boot_ip` - Starting instruction pointer.
-pub fn setup_regs(vcpu: &Arc<dyn hypervisor::Vcpu>, boot_ip: u64) -> Result<()> {
-    let regs = StandardRegisters {
-        rflags: 0x0000000000000002u64,
-        rbx: PVH_INFO_START.raw_value(),
-        rip: boot_ip,
-        ..Default::default()
+/// * `entry_point` - Description of the boot entry to set up.
+pub fn setup_regs(vcpu: &Arc<dyn hypervisor::Vcpu>, entry_point: EntryPoint) -> Result<()> {
+    let regs = match entry_point.setup_header {
+        None => StandardRegisters {
+            rflags: 0x0000000000000002u64,
+            rip: entry_point.entry_addr.raw_value(),
+            rbx: PVH_INFO_START.raw_value(),
+            ..Default::default()
+        },
+        Some(_) => StandardRegisters {
+            rflags: 0x0000000000000002u64,
+            rip: entry_point.entry_addr.raw_value(),
+            rsp: BOOT_STACK_POINTER.raw_value(),
+            rsi: ZERO_PAGE_START.raw_value(),
+            ..Default::default()
+        },
     };
     vcpu.set_regs(&regs).map_err(Error::SetBaseRegisters)
 }
@@ -164,7 +175,6 @@ pub fn configure_segments_and_sregs(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::GuestMemoryMmap;
     use vm_memory::GuestAddress;
 
     fn create_guest_mem() -> GuestMemoryMmap {

block/Cargo.toml

@@ -9,19 +9,18 @@ default = []
 io_uring = ["dep:io-uring"]
 
 [dependencies]
-byteorder = "1.4.3"
+byteorder = "1.5.0"
 crc-any = "2.4.4"
-io-uring = { version = "0.6.2", optional = true }
+io-uring = { version = "0.6.3", optional = true }
 libc = "0.2.153"
-log = "0.4.20"
-remain = "0.2.11"
-smallvec = "1.13.1"
-thiserror = "1.0.52"
-uuid = { version = "1.3.4", features = ["v4"] }
-versionize = "0.2.0"
-versionize_derive = "0.1.6"
-virtio-bindings = { version = "0.2.0", features = ["virtio-v5_0_0"] }
+log = "0.4.21"
+remain = "0.2.13"
+serde = { version = "1.0.197", features = ["derive"] }
+smallvec = "1.13.2"
+thiserror = "1.0.58"
+uuid = { version = "1.8.0", features = ["v4"] }
+virtio-bindings = { version = "0.2.2", features = ["virtio-v5_0_0"] }
 virtio-queue = "0.11.0"
-vm-memory = { version = "0.14.0", features = ["backend-mmap", "backend-atomic", "backend-bitmap"] }
+vm-memory = { version = "0.14.1", features = ["backend-mmap", "backend-atomic", "backend-bitmap"] }
 vm-virtio = { path = "../vm-virtio" }
 vmm-sys-util = "0.12.1"

block/src/lib.rs

@@ -37,11 +37,11 @@ use crate::vhdx::{Vhdx, VhdxError};
 #[cfg(feature = "io_uring")]
 use io_uring::{opcode, IoUring, Probe};
 use libc::{ioctl, S_IFBLK, S_IFMT};
+use serde::{Deserialize, Serialize};
 use smallvec::SmallVec;
 use std::alloc::{alloc_zeroed, dealloc, Layout};
 use std::cmp;
 use std::collections::VecDeque;
-use std::convert::TryInto;
 use std::fmt::Debug;
 use std::fs::File;
 use std::io::{self, IoSlice, IoSliceMut, Read, Seek, SeekFrom, Write};
@@ -53,8 +53,6 @@ use std::sync::Arc;
 use std::sync::MutexGuard;
 use std::time::Instant;
 use thiserror::Error;
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use virtio_bindings::virtio_blk::*;
 use virtio_queue::DescriptorChain;
 use vm_memory::{
@@ -545,7 +543,7 @@ impl Request {
     }
 }
 
-#[derive(Copy, Clone, Debug, Default, Versionize)]
+#[derive(Copy, Clone, Debug, Default, Serialize, Deserialize)]
 #[repr(C, packed)]
 pub struct VirtioBlockConfig {
     pub capacity: u64,
@@ -568,7 +566,7 @@ pub struct VirtioBlockConfig {
     pub write_zeroes_may_unmap: u8,
     pub unused1: [u8; 3],
 }
-#[derive(Copy, Clone, Debug, Default, Versionize)]
+#[derive(Copy, Clone, Debug, Default, Serialize, Deserialize)]
 #[repr(C, packed)]
 pub struct VirtioBlockGeometry {
     pub cylinders: u16,

block/src/qcow/mod.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 mod qcow_raw_file;
 mod raw_file;
@@ -1822,7 +1824,6 @@ pub fn detect_image_type(file: &mut RawFile) -> Result<ImageType> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io::{Read, Seek, SeekFrom, Write};
     use vmm_sys_util::tempfile::TempFile;
     use vmm_sys_util::write_zeroes::WriteZeroes;
 

block/src/qcow/qcow_raw_file.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use super::RawFile;
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};

block/src/qcow/raw_file.rs

@@ -11,7 +11,6 @@
 use crate::BlockBackend;
 use libc::c_void;
 use std::alloc::{alloc_zeroed, dealloc, Layout};
-use std::convert::TryInto;
 use std::fs::{File, Metadata};
 use std::io::{self, Read, Seek, SeekFrom, Write};
 use std::os::unix::io::{AsRawFd, RawFd};

block/src/qcow/refcount.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use std::fmt::{self, Display};
 use std::io;

block/src/qcow/vec_cache.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use std::collections::hash_map::IterMut;
 use std::collections::HashMap;

block/src/vhd.rs

@@ -3,7 +3,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::{read_aligned_block_size, DiskTopology};
-use std::convert::TryInto;
 use std::fs::File;
 use std::io::{Seek, SeekFrom};
 

block/src/vhdx/vhdx_header.rs

@@ -7,7 +7,6 @@ extern crate log;
 use byteorder::{ByteOrder, LittleEndian, ReadBytesExt};
 use remain::sorted;
 use std::collections::btree_map::BTreeMap;
-use std::convert::TryInto;
 use std::fs::File;
 use std::io::{self, Read, Seek, SeekFrom, Write};
 use std::mem::size_of;
@@ -91,7 +90,7 @@ pub type Result<T> = std::result::Result<T, VhdxHeaderError>;
 
 #[derive(Clone, Debug)]
 pub struct FileTypeIdentifier {
-    pub signature: u64,
+    pub _signature: u64,
 }
 
 impl FileTypeIdentifier {
@@ -99,14 +98,14 @@ impl FileTypeIdentifier {
     pub fn new(f: &mut File) -> Result<FileTypeIdentifier> {
         f.seek(SeekFrom::Start(FILE_START))
             .map_err(VhdxHeaderError::SeekFileTypeIdentifier)?;
-        let signature = f
+        let _signature = f
             .read_u64::<LittleEndian>()
             .map_err(VhdxHeaderError::ReadFileTypeIdentifier)?;
-        if signature != VHDX_SIGN {
+        if _signature != VHDX_SIGN {
             return Err(VhdxHeaderError::InvalidVHDXSign);
         }
 
-        Ok(FileTypeIdentifier { signature })
+        Ok(FileTypeIdentifier { _signature })
     }
 }
 

devices/Cargo.toml

@@ -6,22 +6,21 @@ edition = "2021"
 
 [dependencies]
 acpi_tables = { git = "https://github.com/rust-vmm/acpi_tables", branch = "main"  }
-anyhow = "1.0.79"
+anyhow = "1.0.81"
 arch = { path = "../arch" }
-bitflags = "2.4.1"
-byteorder = "1.4.3"
+bitflags = "2.5.0"
+byteorder = "1.5.0"
 event_monitor = { path = "../event_monitor" }
 hypervisor = { path = "../hypervisor" }
 libc = "0.2.153"
-log = "0.4.20"
+log = "0.4.21"
 pci = { path = "../pci" }
-thiserror = "1.0.52"
+serde = { version = "1.0.197", features = ["derive"] }
+thiserror = "1.0.58"
 tpm = { path = "../tpm" }
-versionize = "0.2.0"
-versionize_derive = "0.1.6"
 vm-allocator = { path = "../vm-allocator" }
 vm-device = { path = "../vm-device" }
-vm-memory = "0.14.0"
+vm-memory = "0.14.1"
 vm-migration = { path = "../vm-migration" }
 vmm-sys-util = "0.12.1"
 

devices/src/ioapic.rs

@@ -11,19 +11,16 @@
 
 use super::interrupt_controller::{Error, InterruptController};
 use byteorder::{ByteOrder, LittleEndian};
+use serde::{Deserialize, Serialize};
 use std::result;
 use std::sync::{Arc, Barrier};
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::interrupt::{
     InterruptIndex, InterruptManager, InterruptSourceConfig, InterruptSourceGroup,
     MsiIrqGroupConfig, MsiIrqSourceConfig,
 };
 use vm_device::BusDevice;
 use vm_memory::GuestAddress;
-use vm_migration::{
-    Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable, VersionMapped,
-};
+use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable};
 use vmm_sys_util::eventfd::EventFd;
 
 type Result<T> = result::Result<T, Error>;
@@ -136,7 +133,7 @@ pub struct Ioapic {
     interrupt_source_group: Arc<dyn InterruptSourceGroup>,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct IoapicState {
     id_reg: u32,
     reg_sel: u32,
@@ -144,7 +141,6 @@ pub struct IoapicState {
     used_entries: [bool; NUM_IOAPIC_PINS],
     apic_address: u64,
 }
-impl VersionMapped for IoapicState {}
 
 impl BusDevice for Ioapic {
     fn read(&mut self, _base: u64, offset: u64, data: &mut [u8]) {
@@ -444,7 +440,7 @@ impl Snapshottable for Ioapic {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }
 

devices/src/legacy/cmos.rs

@@ -1,6 +1,8 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use libc::{clock_gettime, gmtime_r, timespec, tm, CLOCK_REALTIME};
 use std::cmp::min;

devices/src/legacy/gpio_pl061.rs

@@ -8,16 +8,13 @@
 //!
 
 use crate::{read_le_u32, write_le_u32};
+use serde::{Deserialize, Serialize};
 use std::result;
 use std::sync::{Arc, Barrier};
 use std::{fmt, io};
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::interrupt::InterruptSourceGroup;
 use vm_device::BusDevice;
-use vm_migration::{
-    Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable, VersionMapped,
-};
+use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable};
 
 const OFS_DATA: u64 = 0x400; // Data Register
 const GPIODIR: u64 = 0x400; // Direction Register
@@ -89,7 +86,7 @@ pub struct Gpio {
     interrupt: Arc<dyn InterruptSourceGroup>,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct GpioState {
     data: u32,
     old_in_data: u32,
@@ -102,8 +99,6 @@ pub struct GpioState {
     afsel: u32,
 }
 
-impl VersionMapped for GpioState {}
-
 impl Gpio {
     /// Constructs an PL061 GPIO device.
     pub fn new(
@@ -328,7 +323,7 @@ impl Snapshottable for Gpio {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }
 
@@ -339,8 +334,6 @@ impl Migratable for Gpio {}
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::{read_le_u32, write_le_u32};
-    use std::sync::Arc;
     use vm_device::interrupt::{InterruptIndex, InterruptSourceConfig};
     use vmm_sys_util::eventfd::EventFd;
 

devices/src/legacy/i8042.rs

@@ -1,6 +1,8 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use std::sync::{
     atomic::{AtomicBool, Ordering},

devices/src/legacy/rtc_pl031.rs

@@ -329,10 +329,9 @@ impl BusDevice for Rtc {
 mod tests {
     use super::*;
     use crate::{
-        read_be_u16, read_be_u32, read_le_i32, read_le_u16, read_le_u32, read_le_u64, write_be_u16,
-        write_be_u32, write_le_i32, write_le_u16, write_le_u32, write_le_u64,
+        read_be_u16, read_be_u32, read_le_i32, read_le_u16, read_le_u64, write_be_u16,
+        write_be_u32, write_le_i32, write_le_u16, write_le_u64,
     };
-    use std::sync::Arc;
     use vm_device::interrupt::{InterruptIndex, InterruptSourceConfig};
     use vmm_sys_util::eventfd::EventFd;
 

devices/src/legacy/serial.rs

@@ -5,16 +5,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
 
+use serde::{Deserialize, Serialize};
 use std::collections::VecDeque;
 use std::sync::{Arc, Barrier};
 use std::{io, result};
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::interrupt::InterruptSourceGroup;
 use vm_device::BusDevice;
-use vm_migration::{
-    Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable, VersionMapped,
-};
+use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable};
 use vmm_sys_util::errno::Result;
 
 const LOOP_SIZE: usize = 0x40;
@@ -74,7 +71,7 @@ pub struct Serial {
     out: Option<Box<dyn io::Write + Send>>,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct SerialState {
     interrupt_enable: u8,
     interrupt_identification: u8,
@@ -86,7 +83,6 @@ pub struct SerialState {
     baud_divisor: u16,
     in_buffer: Vec<u8>,
 }
-impl VersionMapped for SerialState {}
 
 impl Serial {
     pub fn new(
@@ -334,7 +330,7 @@ impl Snapshottable for Serial {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }
 
@@ -345,8 +341,7 @@ impl Migratable for Serial {}
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io;
-    use std::sync::{Arc, Mutex};
+    use std::sync::Mutex;
     use vm_device::interrupt::{InterruptIndex, InterruptSourceConfig};
     use vmm_sys_util::eventfd::EventFd;
 

devices/src/legacy/uart_pl011.rs

@@ -7,18 +7,15 @@
 //!
 
 use crate::{read_le_u32, write_le_u32};
+use serde::{Deserialize, Serialize};
 use std::collections::VecDeque;
 use std::fmt;
 use std::sync::{Arc, Barrier};
 use std::time::Instant;
 use std::{io, result};
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::interrupt::InterruptSourceGroup;
 use vm_device::BusDevice;
-use vm_migration::{
-    Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable, VersionMapped,
-};
+use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable};
 
 /* Registers */
 const UARTDR: u64 = 0;
@@ -94,7 +91,7 @@ pub struct Pl011 {
     timestamp: std::time::Instant,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct Pl011State {
     flags: u32,
     lcr: u32,
@@ -113,8 +110,6 @@ pub struct Pl011State {
     read_trigger: u32,
 }
 
-impl VersionMapped for Pl011State {}
-
 impl Pl011 {
     /// Constructs an AMBA PL011 UART device.
     pub fn new(
@@ -454,7 +449,7 @@ impl Snapshottable for Pl011 {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }
 
@@ -465,8 +460,7 @@ impl Migratable for Pl011 {}
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io;
-    use std::sync::{Arc, Mutex};
+    use std::sync::Mutex;
     use vm_device::interrupt::{InterruptIndex, InterruptSourceConfig};
     use vmm_sys_util::eventfd::EventFd;
 

devices/src/pvpanic.rs

@@ -9,18 +9,15 @@ use pci::{
     PciClassCode, PciConfiguration, PciDevice, PciDeviceError, PciHeaderType, PciSubclass,
     PCI_CONFIGURATION_ID,
 };
+use serde::{Deserialize, Serialize};
 use std::any::Any;
 use std::result;
 use std::sync::{Arc, Barrier, Mutex};
 use thiserror::Error;
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_allocator::{AddressAllocator, SystemAllocator};
 use vm_device::{BusDevice, Resource};
 use vm_memory::{Address, GuestAddress};
-use vm_migration::{
-    Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable, VersionMapped,
-};
+use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable};
 
 const PVPANIC_VENDOR_ID: u16 = 0x1b36;
 const PVPANIC_DEVICE_ID: u16 = 0x0011;
@@ -60,23 +57,20 @@ pub struct PvPanicDevice {
     bar_regions: Vec<PciBarConfiguration>,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct PvPanicDeviceState {
     events: u8,
 }
 
-impl VersionMapped for PvPanicDeviceState {}
-
 impl PvPanicDevice {
     pub fn new(id: String, snapshot: Option<Snapshot>) -> Result<Self, PvPanicError> {
         let pci_configuration_state =
-            vm_migration::versioned_state_from_id(snapshot.as_ref(), PCI_CONFIGURATION_ID)
-                .map_err(|e| {
-                    PvPanicError::RetrievePciConfigurationState(anyhow!(
-                        "Failed to get PciConfigurationState from Snapshot: {}",
-                        e
-                    ))
-                })?;
+            vm_migration::state_from_id(snapshot.as_ref(), PCI_CONFIGURATION_ID).map_err(|e| {
+                PvPanicError::RetrievePciConfigurationState(anyhow!(
+                    "Failed to get PciConfigurationState from Snapshot: {}",
+                    e
+                ))
+            })?;
 
         let mut configuration = PciConfiguration::new(
             PVPANIC_VENDOR_ID,
@@ -97,7 +91,7 @@ impl PvPanicDevice {
 
         let state: Option<PvPanicDeviceState> = snapshot
             .as_ref()
-            .map(|s| s.to_versioned_state())
+            .map(|s| s.to_state())
             .transpose()
             .map_err(|e| {
                 PvPanicError::CreatePvPanicDevice(anyhow!(
@@ -210,7 +204,7 @@ impl PciDevice for PvPanicDevice {
         }
 
         bars.push(bar);
-        self.bar_regions = bars.clone();
+        self.bar_regions.clone_from(&bars);
 
         Ok(bars)
     }
@@ -259,7 +253,7 @@ impl Snapshottable for PvPanicDevice {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        let mut snapshot = Snapshot::new_from_versioned_state(&self.state())?;
+        let mut snapshot = Snapshot::new_from_state(&self.state())?;
 
         // Snapshot PciConfiguration
         snapshot.add_snapshot(self.configuration.id(), self.configuration.snapshot()?);

docs/api.md

@@ -110,6 +110,7 @@ The Cloud Hypervisor API exposes the following actions through its endpoints:
 | Add vsock device to the VM         | `/vm.add-vsock`         | `/schemas/VsockConfig`          | `/schemas/PciDeviceInfo` | The VM is booted                                       |
 | Remove device from the VM          | `/vm.remove-device`     | `/schemas/VmRemoveDevice`       | N/A                      | The VM is booted                                       |
 | Dump the VM counters               | `/vm.counters`          | N/A                             | `/schemas/VmCounters`    | The VM is booted                                       |
+| Inject an NMI                      | `/vm.nmi`               | N/A                             | N/A                      | The VM is booted                                       |
 | Prepare to receive a migration     | `/vm.receive-migration` | `/schemas/ReceiveMigrationData` | N/A                      | N/A                                                    |
 | Start to send migration to target  | `/vm.send-migration`    | `/schemas/SendMigrationData`    | N/A                      | The VM is booted and (shared mem or hugepages enabled) |
 

docs/custom-image.md

@@ -170,7 +170,7 @@ We usually start from one of the custom cloud image we have previously created
 but we can use a stock cloud image as well.
 
 ```bash
-wget https://cloud-hypervisor.azureedge.net/jammy-server-cloudimg-amd64-custom-20230119-0.raw
+wget https://ch-images.azureedge.net/jammy-server-cloudimg-amd64-custom-20230119-0.raw
 mv jammy-server-cloudimg-amd64-custom-20230119-0.raw jammy-server-cloudimg-amd64-nvidia.raw
 ```
 
@@ -326,4 +326,4 @@ VM will be booted with this image.
 
 ```
 sudo cloud-init clean
-```
+```

docs/vfio.md

@@ -122,4 +122,64 @@ $ ls /sys/kernel/iommu_groups/22/devices/
 
 This means these two devices are under the same IOMMU group 22. In such case,
 it is important to bind both devices to VFIO and pass them both through the
-VM, otherwise this could cause some functional and security issues.
+VM, otherwise this could cause some functional and security issues.
+
+### Advanced Configuration Options
+
+When using NVIDIA GPUs in a VFIO passthrough configuration, advanced
+configuration options are supported to enable GPUDirect P2P DMA over
+PCIe. When enabled, loads and stores between GPUs use native PCIe
+peer-to-peer transactions instead of a shared memory buffer. This drastically
+decreases P2P latency between GPUs. This functionality is supported by
+cloud-hypervisor on NVIDIA Turing, Ampere, Hopper, and Lovelace GPUs.
+
+The NVIDIA driver does not enable GPUDirect P2P over PCIe within guests
+by default because hardware support for routing P2P TLP between PCIe root
+ports is optional. PCIe P2P should always be supported between devices
+on the same PCIe switch. The `x_nv_gpudirect_clique` config argument may
+be used to signal support for PCIe P2P traffic between NVIDIA VFIO endpoints.
+The guest driver assumes that P2P traffic is supported between all endpoints
+that are part of the same clique.
+```
+--device path=/sys/bus/pci/devices/0000:01:00.0/,x_nv_gpudirect_clique=0
+```
+
+The following command can be run on the guest to verify that GPUDirect P2P is
+correctly enabled.
+```
+nvidia-smi topo -p2p r
+ 	GPU0	GPU1	GPU2	GPU3	GPU4	GPU5	GPU6	GPU7	
+ GPU0	X	OK	OK	OK	OK	OK	OK	OK	
+ GPU1	OK	X	OK	OK	OK	OK	OK	OK	
+ GPU2	OK	OK	X	OK	OK	OK	OK	OK	
+ GPU3	OK	OK	OK	X	OK	OK	OK	OK	
+ GPU4	OK	OK	OK	OK	X	OK	OK	OK	
+ GPU5	OK	OK	OK	OK	OK	X	OK	OK	
+ GPU6	OK	OK	OK	OK	OK	OK	X	OK	
+ GPU7	OK	OK	OK	OK	OK	OK	OK	X	
+```
+
+Some VFIO devices have a 32-bit mmio BAR. When using many such devices, it is
+possible to exhaust the 32-bit mmio space available on a PCI segment. The
+following example demonstrates an example device with a 16 MiB 32-bit mmio BAR.
+```
+lspci -s 0000:01:00.0  -v
+0000:01:00.0 3D controller: NVIDIA Corporation Device 26b9 (rev a1)
+    [...]
+    Memory at f9000000 (32-bit, non-prefetchable) [size=16M]
+    Memory at 46000000000 (64-bit, prefetchable) [size=64G]
+    Memory at 48040000000 (64-bit, prefetchable) [size=32M]
+    [...]
+```
+
+When using multiple PCI segments, the 32-bit mmio address space available to
+be allocated to VFIO devices is equally split between all PCI segments by
+default. This can be tuned with the `--pci-segment` flag. The following example
+demonstrates a guest with two PCI segments. 2/3 of the 32-bit mmio address
+space is available for use by devices on PCI segment 0 and 1/3 of the 32-bit
+mmio address space is available for use by devices on PCI segment 1.
+```
+--platform num_pci_segments=2
+--pci-segment pci_segment=0,mmio32_aperture_weight=2
+--pci-segment pci_segment=1,mmio32_aperture_weight=1
+```

docs/vsock.md

@@ -1,6 +1,6 @@
 # VSOCK support
 
-VSOCK provides a way for guest and host to communicate through a socket. VSOCK sockets support both stream and datagram types.
+VSOCK provides a way for guest and host to communicate through a socket. `cloud-hypervisor` only supports stream VSOCK sockets.
 
 The `virtio-vsock` is based on the [Firecracker](https://github.com/firecracker-microvm/firecracker/blob/main/docs/vsock.md) implementation, where additional details can be found.
 

event_monitor/Cargo.toml

@@ -5,8 +5,8 @@ authors = ["The Cloud Hypervisor Authors"]
 edition = "2021"
 
 [dependencies]
-flume = "0.10.14"
+flume = "0.11.0"
 libc = "0.2.153"
 once_cell = "1.19.0"
-serde = { version = "1.0.196", features = ["rc", "derive"] }
-serde_json = "1.0.109"
+serde = { version = "1.0.197", features = ["rc", "derive"] }
+serde_json = "1.0.115"

fuzz/Cargo.lock

@@ -5,16 +5,16 @@ version = 3
 [[package]]
 name = "acpi_tables"
 version = "0.1.0"
-source = "git+https://github.com/rust-vmm/acpi_tables?branch=main#1a733bf690ccc10bdfeacad33e3c9f6cce0008fd"
+source = "git+https://github.com/rust-vmm/acpi_tables?branch=main#ca1a473fe73cdd8eb49c1449faad7aaac06f32c2"
 dependencies = [
  "zerocopy",
 ]
 
 [[package]]
 name = "anstream"
-version = "0.6.11"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e1ebcb11de5c03c67de28a7df593d32191b44939c482e97702baaaa6ab6a5"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -60,9 +60,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.79"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "080e9890a082662b09c1ad45f567faeeb47f22b5fb23895fbe1e651e718e25ca"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
 
 [[package]]
 name = "api_client"
@@ -79,9 +79,9 @@ checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
 
 [[package]]
 name = "arc-swap"
-version = "1.6.0"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bddcadddf5e9015d310179a59bb28c4d4b9920ad0f11e8e14dbadf654890c9a6"
+checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
 
 [[package]]
 name = "arch"
@@ -97,8 +97,6 @@ dependencies = [
  "serde",
  "thiserror",
  "uuid",
- "versionize",
- "versionize_derive",
  "vm-fdt",
  "vm-memory",
  "vm-migration",
@@ -107,18 +105,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
 
 [[package]]
 name = "bitflags"
@@ -128,9 +117,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "block"
@@ -142,11 +131,10 @@ dependencies = [
  "libc",
  "log",
  "remain",
+ "serde",
  "smallvec",
  "thiserror",
  "uuid",
- "versionize",
- "versionize_derive",
  "virtio-bindings",
  "virtio-queue",
  "vm-memory",
@@ -156,9 +144,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.14.0"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
@@ -168,9 +156,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+checksum = "2678b2e3449475e95b0aa6f9b506a28e61b3dc8996592b983695e8ebb58a8b41"
 dependencies = [
  "jobserver",
  "libc",
@@ -184,23 +172,23 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.5.0"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80c21025abd42669a92efc996ef13cfb2c5c627858421ea58d5c3b331a6c134f"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.0"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "458bf1f341769dfcf849846f65dffdf9146daa56bcd2a47cb4e1de9915567c99"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim 0.11.0",
+ "strsim 0.11.1",
 ]
 
 [[package]]
@@ -211,7 +199,7 @@ checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "cloud-hypervisor"
-version = "37.0.0"
+version = "38.0.0"
 dependencies = [
  "anyhow",
  "api_client",
@@ -273,17 +261,11 @@ dependencies = [
  "debug-helper",
 ]
 
-[[package]]
-name = "crc64"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2707e3afba5e19b75d582d88bc79237418f2a2a2d673d01cf9b03633b46e98f3"
-
 [[package]]
 name = "darling"
-version = "0.20.5"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc5d6b04b3fd0ba9926f945895de7d806260a2d7431ba82e7edaecb043c4c6b8"
+checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -291,27 +273,27 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.5"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04e48a959bcd5c761246f5d090ebc2fbf7b9cd527a492b07a67510c108f1e7e3"
+checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim 0.10.0",
- "syn 2.0.47",
+ "syn",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.20.5"
+version = "0.20.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d1545d67a2149e1d93b7e5c7752dce5a7426eb5d1357ddcfd89336b94444f77"
+checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.47",
+ "syn",
 ]
 
 [[package]]
@@ -327,17 +309,16 @@ dependencies = [
  "acpi_tables",
  "anyhow",
  "arch",
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "byteorder",
  "event_monitor",
  "hypervisor",
  "libc",
  "log",
  "pci",
+ "serde",
  "thiserror",
  "tpm",
- "versionize",
- "versionize_derive",
  "vm-allocator",
  "vm-device",
  "vm-memory",
@@ -351,7 +332,7 @@ version = "4.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74351c3392ea1ff6cd2628e0042d268ac2371cb613252ff383b6dfa50d22fa79"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "libc",
 ]
 
@@ -374,14 +355,13 @@ checksum = "784a4df722dc6267a04af36895398f59d21d07dce47232adf31ec0ff2fa45e67"
 
 [[package]]
 name = "flume"
-version = "0.10.14"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1657b4441c3403d9f7b3409e47575237dac27b1b5726df654a6ecbf92f0f7577"
+checksum = "55ac459de2512911e4b674ce33cf20befaba382d05b62b008afc1c8b57cbf181"
 dependencies = [
  "futures-core",
  "futures-sink",
  "nanorand",
- "pin-project",
  "spin",
 ]
 
@@ -405,9 +385,9 @@ checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -452,45 +432,46 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "jobserver"
-version = "0.1.28"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
+checksum = "685a7d121ee3f65ae4fddd72b25a04bb36b6af81bc0828f7d5434c0fe60fa3a2"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "kvm-bindings"
-version = "0.7.0"
-source = "git+https://github.com/cloud-hypervisor/kvm-bindings?branch=ch-v0.7.0#2dcf85d4f8aa55befcaa996b699ddb18ec9ed059"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a82e7e8725a39a0015e511a46cc1f7d90cecc180db1610c4d0d4339a9e48bd21"
 dependencies = [
  "serde",
- "serde_derive",
  "vmm-sys-util",
+ "zerocopy",
 ]
 
 [[package]]
 name = "kvm-ioctls"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9002dff009755414f22b962ec6ae6980b07d6d8b06e5297b1062019d72bd6a8c"
+checksum = "bedae2ca4a531bebe311abaf9691f5cc14eaa21475243caa2e39c43bb872947d"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "kvm-bindings",
  "libc",
  "vmm-sys-util",
@@ -534,14 +515,14 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "micro_http"
 version = "0.1.0"
-source = "git+https://github.com/firecracker-microvm/micro-http?branch=main#e75dfa1eeea23b69caa7407bc2c3a76d7b7262fb"
+source = "git+https://github.com/firecracker-microvm/micro-http?branch=main#ef43cef7162a55a6790d528a5e76b4fe2da22de0"
 dependencies = [
  "libc",
  "vmm-sys-util",
@@ -575,8 +556,6 @@ dependencies = [
  "rate_limiter",
  "serde",
  "thiserror",
- "versionize",
- "versionize_derive",
  "virtio-bindings",
  "virtio-queue",
  "vm-memory",
@@ -605,8 +584,6 @@ dependencies = [
  "log",
  "serde",
  "thiserror",
- "versionize",
- "versionize_derive",
  "vfio-bindings",
  "vfio-ioctls",
  "vfio_user",
@@ -617,40 +594,20 @@ dependencies = [
  "vmm-sys-util",
 ]
 
-[[package]]
-name = "pin-project"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0302c4a0442c456bd56f841aee5c3bfd17967563f6fadc9ceb9f9c23cf3807e0"
-dependencies = [
- "pin-project-internal",
-]
-
-[[package]]
-name = "pin-project-internal"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266c042b60c9c76b8d53061e52b2e0d1116abc57cefc8c5cd671619a56ac3690"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.47",
-]
-
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -668,20 +625,20 @@ dependencies = [
 
 [[package]]
 name = "remain"
-version = "0.2.12"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad5e011230cad274d0532460c5ab69828ea47ae75681b42a841663efffaf794"
+checksum = "ad9f2390298a947ee0aa6073d440e221c0726188cfbcdf9604addb6ee393eb4a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.16"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "scopeguard"
@@ -700,29 +657,29 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.196"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.196"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.113"
+version = "1.0.115"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69801b70b1c3dac963ecb03a364ba0ceda9cf60c71cfe475e99864759c8b8a79"
+checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
 dependencies = [
  "itoa",
  "ryu",
@@ -731,24 +688,25 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.4.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64cd236ccc1b7a29e7e2739f27c0b2dd199804abc4290e32f59f3b68d6405c23"
+checksum = "2c85f8e96d1d6857f13768fcbd895fcb06225510022a2774ed8b5150581847b0"
 dependencies = [
  "serde",
+ "serde_derive",
  "serde_with_macros",
 ]
 
 [[package]]
 name = "serde_with_macros"
-version = "3.4.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93634eb5f75a2323b16de4748022ac4297f9e76b6dced2be287a099f41b5e788"
+checksum = "c8b3a576c4eb2924262d5951a3b737ccaf16c931e39a2810c36f9a7e25575557"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
 ]
 
 [[package]]
@@ -767,18 +725,18 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "spin"
@@ -797,26 +755,15 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1726efe18f42ae774cc644f330953a5e7b3c3003d3edcecf18850fe9d4dd9afb"
+checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -825,22 +772,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.56"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.56"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
 ]
 
 [[package]]
@@ -881,44 +828,17 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"
+checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 dependencies = [
  "getrandom",
 ]
 
-[[package]]
-name = "versionize"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62929d59c7f6730b7298fcb363760550f4db6e353fbac4076d447d0e82799d6d"
-dependencies = [
- "bincode",
- "crc64",
- "proc-macro2",
- "quote",
- "serde",
- "serde_derive",
- "syn 1.0.109",
- "versionize_derive",
- "vmm-sys-util",
-]
-
-[[package]]
-name = "versionize_derive"
-version = "0.1.6"
-source = "git+https://github.com/cloud-hypervisor/versionize_derive?branch=ch-0.1.6#7906da996152e2d0ab08f5526440683bf3ca7834"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "vfio-bindings"
 version = "0.4.0"
-source = "git+https://github.com/rust-vmm/vfio?branch=main#0daff4d4c159e842cf18b8b90457a45032b2df5a"
+source = "git+https://github.com/rust-vmm/vfio?branch=main#da8c5b67095fb70f5ef237ca63d316219888f015"
 dependencies = [
  "vmm-sys-util",
 ]
@@ -926,7 +846,7 @@ dependencies = [
 [[package]]
 name = "vfio-ioctls"
 version = "0.2.0"
-source = "git+https://github.com/rust-vmm/vfio?branch=main#0daff4d4c159e842cf18b8b90457a45032b2df5a"
+source = "git+https://github.com/rust-vmm/vfio?branch=main#da8c5b67095fb70f5ef237ca63d316219888f015"
 dependencies = [
  "byteorder",
  "kvm-bindings",
@@ -962,7 +882,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b64e816d0d49769fbfaa1494eb77cc2a3ddc526ead05c7f922cb7d64106286f"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "libc",
  "vm-memory",
  "vmm-sys-util",
@@ -993,10 +913,9 @@ dependencies = [
  "seccompiler",
  "serde",
  "serde_json",
+ "serde_with",
  "serial_buffer",
  "thiserror",
- "versionize",
- "versionize_derive",
  "vhost",
  "virtio-bindings",
  "virtio-queue",
@@ -1044,14 +963,14 @@ dependencies = [
 
 [[package]]
 name = "vm-fdt"
-version = "0.2.0"
-source = "git+https://github.com/rust-vmm/vm-fdt?branch=main#c5a99ab71b130435927d19b50c85fcd5ce904a8c"
+version = "0.3.0"
+source = "git+https://github.com/rust-vmm/vm-fdt?branch=main#982fb8d9c8cd7f53520d7e304b39ff307fa3a641"
 
 [[package]]
 name = "vm-memory"
-version = "0.14.0"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74ffc42216c32c35f858fa4bfdcd9b61017dfd691e0240268fdc85dbf59e5459"
+checksum = "3c3aba5064cc5f6f7740cddc8dae34d2d9a311cac69b60d942af7f3ab8fc49f4"
 dependencies = [
  "arc-swap",
  "libc",
@@ -1067,8 +986,6 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror",
- "versionize",
- "versionize_derive",
  "vm-memory",
 ]
 
@@ -1089,7 +1006,7 @@ dependencies = [
  "anyhow",
  "arc-swap",
  "arch",
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
  "block",
  "cfg-if",
  "clap",
@@ -1115,8 +1032,6 @@ dependencies = [
  "thiserror",
  "tracer",
  "uuid",
- "versionize",
- "versionize_derive",
  "vfio-ioctls",
  "vfio_user",
  "virtio-devices",
@@ -1150,9 +1065,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1160,24 +1075,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1185,22 +1100,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "winapi"
@@ -1235,9 +1150,9 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
 dependencies = [
  "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
@@ -1250,45 +1165,45 @@ dependencies = [
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.0"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "zerocopy"
@@ -1308,5 +1223,5 @@ checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.47",
+ "syn",
 ]

fuzz/Cargo.toml

@@ -14,8 +14,8 @@ igvm = []
 [dependencies]
 block = { path = "../block" }
 devices = { path = "../devices" }
-epoll = "4.3.1"
-libc = "0.2.152"
+epoll = "4.3.3"
+libc = "0.2.153"
 libfuzzer-sys = "0.4.7"
 linux-loader = { version = "0.11.0", features = ["elf", "bzimage", "pe"] }
 micro_http = { git = "https://github.com/firecracker-microvm/micro-http", branch = "main" }
@@ -26,7 +26,7 @@ virtio-devices = { path = "../virtio-devices" }
 virtio-queue = "0.11.0"
 vmm = { path = "../vmm" }
 vmm-sys-util = "0.12.1"
-vm-memory = "0.14.0"
+vm-memory = "0.14.1"
 vm-migration = { path = "../vm-migration" }
 vm-device = { path = "../vm-device" }
 vm-virtio = { path = "../vm-virtio" }
@@ -34,10 +34,6 @@ vm-virtio = { path = "../vm-virtio" }
 [dependencies.cloud-hypervisor]
 path = ".."
 
-[patch.crates-io]
-kvm-bindings = { git = "https://github.com/cloud-hypervisor/kvm-bindings", branch = "ch-v0.7.0" }
-versionize_derive = { git = "https://github.com/cloud-hypervisor/versionize_derive", branch = "ch-0.1.6" }
-
 # Prevent this from interfering with workspaces
 [workspace]
 members = ["."]

fuzz/fuzz_targets/http_api.rs

@@ -187,6 +187,7 @@ impl RequestHandler for StubApiRequestHandler {
                 watchdog: false,
                 #[cfg(feature = "guest_debug")]
                 gdb: false,
+                pci_segments: None,
                 platform: None,
                 tpm: None,
                 preserved_fds: None,
@@ -273,6 +274,10 @@ impl RequestHandler for StubApiRequestHandler {
     fn vm_send_migration(&mut self, _: VmSendMigrationData) -> Result<(), MigratableError> {
         Ok(())
     }
+
+    fn vm_nmi(&mut self) -> Result<(), VmError> {
+        Ok(())
+    }
 }
 
 fn http_receiver_stub(exit_evt: EventFd, api_evt: EventFd, api_receiver: Receiver<ApiRequest>) {

fuzz/fuzz_targets/qcow.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 #![no_main]
 use libfuzzer_sys::fuzz_target;

hypervisor/Cargo.toml

@@ -12,28 +12,28 @@ sev_snp = ["igvm_parser", "igvm_defs"]
 tdx = []
 
 [dependencies]
-anyhow = "1.0.79"
-byteorder = "1.4.3"
+anyhow = "1.0.81"
+byteorder = "1.5.0"
 igvm_defs = { git = "https://github.com/microsoft/igvm", branch = "main", package = "igvm_defs", optional  = true }
 igvm_parser = { git = "https://github.com/microsoft/igvm", branch = "main", package = "igvm", optional  = true }
 libc = "0.2.153"
-log = "0.4.20"
-kvm-ioctls = { version = "0.16.0", optional = true }
-kvm-bindings = { git = "https://github.com/cloud-hypervisor/kvm-bindings", branch = "ch-v0.7.0", features = ["with-serde", "fam-wrappers"], optional  = true }
+log = "0.4.21"
+kvm-bindings = { version = "0.8.1", optional = true, features = ["serde"] }
+kvm-ioctls = { version = "0.17.0", optional = true }
 mshv-bindings = { git = "https://github.com/rust-vmm/mshv", branch = "main", features = ["with-serde", "fam-wrappers"], optional  = true }
 mshv-ioctls = { git = "https://github.com/rust-vmm/mshv", branch = "main", optional  = true}
-serde = { version = "1.0.196", features = ["rc", "derive"] }
-serde_with = { version = "3.4.0", default-features = false, features = ["macros"] }
+serde = { version = "1.0.197", features = ["rc", "derive"] }
+serde_with = { version = "3.7.0", default-features = false, features = ["macros"] }
 vfio-ioctls = { git = "https://github.com/rust-vmm/vfio", branch = "main", default-features = false }
-vm-memory = { version = "0.14.0", features = ["backend-mmap", "backend-atomic"] }
+vm-memory = { version = "0.14.1", features = ["backend-mmap", "backend-atomic"] }
 vmm-sys-util = { version = "0.12.1", features = ["with-serde"] }
-thiserror = "1.0.52"
+thiserror = "1.0.58"
 
 [target.'cfg(target_arch = "x86_64")'.dependencies.iced-x86]
 optional = true
-version = "1.20.0"
+version = "1.21.0"
 default-features = false
 features = ["std", "decoder", "op_code_info", "instr_info", "fast_fmt"]
 
 [dev-dependencies]
-env_logger = "0.10.1"
+env_logger = "0.11.3"

hypervisor/src/arch/aarch64/gic.rs

@@ -1,4 +1,6 @@
 // Copyright 2022 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 use crate::{CpuState, GicState, HypervisorDeviceError, HypervisorVmError};
 use std::any::Any;

hypervisor/src/arch/aarch64/mod.rs

@@ -1,3 +1,5 @@
 // Copyright 2022 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 pub mod gic;

hypervisor/src/arch/x86/emulator/instructions/cmp.rs

@@ -10,10 +10,8 @@
 // CMP-Compare Two Operands
 //
 
-use crate::arch::emulator::{EmulationError, PlatformEmulator};
 use crate::arch::x86::emulator::instructions::*;
 use crate::arch::x86::regs::*;
-use crate::arch::x86::Exception;
 
 // CMP affects OF, SF, ZF, AF, PF and CF
 const FLAGS_MASK: u64 = CF | PF | AF | ZF | SF | OF;
@@ -211,8 +209,6 @@ impl<T: CpuStateManager> InstructionHandler<T> for Cmp_rm64_imm8 {
 
 #[cfg(test)]
 mod tests {
-    #![allow(unused_mut)]
-
     use super::*;
     use crate::arch::x86::emulator::mock_vmm::*;
 

hypervisor/src/arch/x86/emulator/instructions/mov.rs

@@ -12,9 +12,7 @@
 //   Copies the second operand (source operand) to the first operand (destination operand).
 //
 
-use crate::arch::emulator::{EmulationError, PlatformEmulator};
 use crate::arch::x86::emulator::instructions::*;
-use crate::arch::x86::Exception;
 
 macro_rules! mov_rm_r {
     ($bound:ty) => {
@@ -271,7 +269,6 @@ impl<T: CpuStateManager> InstructionHandler<T> for Mov_RAX_moffs64 {
 
 #[cfg(test)]
 mod tests {
-    #![allow(unused_mut)]
     use super::*;
     use crate::arch::x86::emulator::mock_vmm::*;
 

hypervisor/src/arch/x86/emulator/instructions/movs.rs

@@ -10,10 +10,8 @@
 // MOVS - Move Data from String to String
 //
 
-use crate::arch::emulator::{EmulationError, PlatformEmulator};
 use crate::arch::x86::emulator::instructions::*;
 use crate::arch::x86::regs::DF;
-use crate::arch::x86::Exception;
 
 macro_rules! movs {
     ($bound:ty) => {
@@ -102,7 +100,6 @@ impl<T: CpuStateManager> InstructionHandler<T> for Movsb_m8_m8 {
 
 #[cfg(test)]
 mod tests {
-    #![allow(unused_mut)]
     use super::*;
     use crate::arch::x86::emulator::mock_vmm::*;
 

hypervisor/src/arch/x86/emulator/instructions/or.rs

@@ -10,9 +10,7 @@
 // OR - Logical inclusive OR
 //
 
-use crate::arch::emulator::{EmulationError, PlatformEmulator};
 use crate::arch::x86::emulator::instructions::*;
-use crate::arch::x86::Exception;
 
 macro_rules! or_rm_r {
     ($bound:ty) => {
@@ -52,7 +50,6 @@ impl<T: CpuStateManager> InstructionHandler<T> for Or_rm8_r8 {
 
 #[cfg(test)]
 mod tests {
-    #![allow(unused_mut)]
     use super::*;
 
     use crate::arch::x86::emulator::mock_vmm::*;

hypervisor/src/arch/x86/emulator/mod.rs

@@ -648,13 +648,9 @@ impl<'a, T: CpuStateManager> Emulator<'a, T> {
 
 #[cfg(test)]
 mod mock_vmm {
-    #![allow(unused_mut)]
-
     use super::*;
-    use crate::arch::emulator::{EmulationError, PlatformEmulator};
-    use crate::arch::x86::emulator::{Emulator, EmulatorCpuState as CpuState};
+    use crate::arch::x86::emulator::EmulatorCpuState as CpuState;
     use crate::arch::x86::gdt::{gdt_entry, segment_from_gdt};
-    use crate::arch::x86::Exception;
     use std::sync::{Arc, Mutex};
 
     #[derive(Debug, Clone)]
@@ -772,7 +768,6 @@ mod mock_vmm {
 
 #[cfg(test)]
 mod tests {
-    #![allow(unused_mut)]
     use super::*;
     use crate::arch::x86::emulator::mock_vmm::*;
 

hypervisor/src/arch/x86/msr_index.rs

@@ -1,4 +1,6 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
 

hypervisor/src/cpu.rs

@@ -107,14 +107,28 @@ pub enum HypervisorCpuError {
     ///
     /// Setting Saved Processor Extended States error
     ///
+    #[cfg(feature = "kvm")]
     #[error("Failed to set Saved Processor Extended States: {0}")]
     SetXsaveState(#[source] anyhow::Error),
     ///
     /// Getting Saved Processor Extended States error
     ///
+    #[cfg(feature = "kvm")]
     #[error("Failed to get Saved Processor Extended States: {0}")]
     GetXsaveState(#[source] anyhow::Error),
     ///
+    /// Getting the VP state components error
+    ///
+    #[cfg(feature = "mshv")]
+    #[error("Failed to get VP State Components: {0}")]
+    GetAllVpStateComponents(#[source] anyhow::Error),
+    ///
+    /// Setting the VP state components error
+    ///
+    #[cfg(feature = "mshv")]
+    #[error("Failed to set VP State Components: {0}")]
+    SetAllVpStateComponents(#[source] anyhow::Error),
+    ///
     /// Setting Extended Control Registers error
     ///
     #[error("Failed to set Extended Control Registers: {0}")]
@@ -278,18 +292,17 @@ pub enum HypervisorCpuError {
     #[cfg(feature = "sev_snp")]
     #[error("Failed to set sev control register: {0}")]
     SetSevControlRegister(#[source] anyhow::Error),
+
+    /// Error injecting NMI
+    ///
+    #[error("Failed to inject NMI")]
+    Nmi(#[source] anyhow::Error),
 }
 
 #[derive(Debug)]
-pub enum VmExit<'a> {
-    #[cfg(target_arch = "x86_64")]
-    IoOut(u16 /* port */, &'a [u8] /* data */),
-    #[cfg(target_arch = "x86_64")]
-    IoIn(u16 /* port */, &'a mut [u8] /* data */),
+pub enum VmExit {
     #[cfg(target_arch = "x86_64")]
     IoapicEoi(u8 /* vector */),
-    MmioRead(u64 /* address */, &'a mut [u8]),
-    MmioWrite(u64 /* address */, &'a [u8]),
     Ignore,
     Reset,
     Shutdown,
@@ -505,4 +518,10 @@ pub trait Vcpu: Send + Sync {
     fn set_sev_control_register(&self, _reg: u64) -> Result<()> {
         unimplemented!()
     }
+
+    #[cfg(target_arch = "x86_64")]
+    ///
+    /// Trigger NMI interrupt
+    ///
+    fn nmi(&self) -> Result<()>;
 }

hypervisor/src/hypervisor.rs

@@ -21,8 +21,6 @@ use std::sync::Arc;
 use thiserror::Error;
 
 #[derive(Error, Debug)]
-///
-///
 pub enum HypervisorError {
     ///
     /// Hypervisor availability check error

hypervisor/src/kvm/aarch64/gic/mod.rs

@@ -1,4 +1,6 @@
 // Copyright 2022 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 mod dist_regs;
 mod icc_regs;
@@ -6,7 +8,7 @@ mod redist_regs;
 
 use crate::arch::aarch64::gic::{Error, Result, Vgic, VgicConfig};
 use crate::device::HypervisorDeviceError;
-use crate::kvm::{kvm_bindings, KvmVm};
+use crate::kvm::KvmVm;
 use crate::{CpuState, Vm};
 use dist_regs::{get_dist_regs, read_ctlr, set_dist_regs, write_ctlr};
 use icc_regs::{get_icc_regs, set_icc_regs};
@@ -14,7 +16,6 @@ use kvm_ioctls::DeviceFd;
 use redist_regs::{construct_gicr_typers, get_redist_regs, set_redist_regs};
 use serde::{Deserialize, Serialize};
 use std::any::Any;
-use std::convert::TryInto;
 
 const GITS_CTLR: u32 = 0x0000;
 const GITS_IIDR: u32 = 0x0004;

hypervisor/src/kvm/mod.rs

@@ -27,8 +27,6 @@ use crate::{arm64_core_reg_id, offset_of};
 use kvm_ioctls::{NoDatamatch, VcpuFd, VmFd};
 use std::any::Any;
 use std::collections::HashMap;
-#[cfg(target_arch = "aarch64")]
-use std::convert::TryInto;
 #[cfg(target_arch = "x86_64")]
 use std::fs::File;
 #[cfg(target_arch = "x86_64")]
@@ -38,7 +36,6 @@ use std::os::unix::io::RawFd;
 use std::result;
 #[cfg(target_arch = "x86_64")]
 use std::sync::atomic::{AtomicBool, Ordering};
-#[cfg(target_arch = "aarch64")]
 use std::sync::Mutex;
 use std::sync::{Arc, RwLock};
 use vmm_sys_util::eventfd::EventFd;
@@ -105,6 +102,15 @@ pub use {
 #[cfg(target_arch = "x86_64")]
 const KVM_CAP_SGX_ATTRIBUTE: u32 = 196;
 
+#[cfg(target_arch = "x86_64")]
+use vmm_sys_util::ioctl_io_nr;
+
+#[cfg(all(not(feature = "tdx"), target_arch = "x86_64"))]
+use vmm_sys_util::ioctl_ioc_nr;
+
+#[cfg(target_arch = "x86_64")]
+ioctl_io_nr!(KVM_NMI, kvm_bindings::KVMIO, 0x9a);
+
 #[cfg(feature = "tdx")]
 const KVM_EXIT_TDX: u32 = 50;
 #[cfg(feature = "tdx")]
@@ -448,12 +454,12 @@ impl vm::Vm for KvmVm {
         id: u8,
         vm_ops: Option<Arc<dyn VmOps>>,
     ) -> vm::Result<Arc<dyn cpu::Vcpu>> {
-        let vc = self
+        let fd = self
             .fd
             .create_vcpu(id as u64)
             .map_err(|e| vm::HypervisorVmError::CreateVcpu(e.into()))?;
         let vcpu = KvmVcpu {
-            fd: vc,
+            fd: Arc::new(Mutex::new(fd)),
             #[cfg(target_arch = "x86_64")]
             msrs: self.msrs.clone(),
             vm_ops,
@@ -1163,7 +1169,7 @@ impl hypervisor::Hypervisor for KvmHypervisor {
 
 /// Vcpu struct for KVM
 pub struct KvmVcpu {
-    fd: VcpuFd,
+    fd: Arc<Mutex<VcpuFd>>,
     #[cfg(target_arch = "x86_64")]
     msrs: Vec<MsrEntry>,
     vm_ops: Option<Arc<dyn vm::VmOps>>,
@@ -1191,6 +1197,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn get_regs(&self) -> cpu::Result<StandardRegisters> {
         Ok(self
             .fd
+            .lock()
+            .unwrap()
             .get_regs()
             .map_err(|e| cpu::HypervisorCpuError::GetStandardRegs(e.into()))?
             .into())
@@ -1212,6 +1220,8 @@ impl cpu::Vcpu for KvmVcpu {
         for i in 0..31 {
             let mut bytes = [0_u8; 8];
             self.fd
+                .lock()
+                .unwrap()
                 .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
                 .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
             state.regs.regs[i] = u64::from_le_bytes(bytes);
@@ -1223,6 +1233,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(user_pt_regs, sp);
         let mut bytes = [0_u8; 8];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.regs.sp = u64::from_le_bytes(bytes);
@@ -1231,6 +1243,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(user_pt_regs, pc);
         let mut bytes = [0_u8; 8];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.regs.pc = u64::from_le_bytes(bytes);
@@ -1239,6 +1253,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(user_pt_regs, pstate);
         let mut bytes = [0_u8; 8];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.regs.pstate = u64::from_le_bytes(bytes);
@@ -1247,6 +1263,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(kvm_regs, sp_el1);
         let mut bytes = [0_u8; 8];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.sp_el1 = u64::from_le_bytes(bytes);
@@ -1256,6 +1274,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(kvm_regs, elr_el1);
         let mut bytes = [0_u8; 8];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.elr_el1 = u64::from_le_bytes(bytes);
@@ -1265,6 +1285,8 @@ impl cpu::Vcpu for KvmVcpu {
         for i in 0..KVM_NR_SPSR as usize {
             let mut bytes = [0_u8; 8];
             self.fd
+                .lock()
+                .unwrap()
                 .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U64, off), &mut bytes)
                 .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
             state.spsr[i] = u64::from_le_bytes(bytes);
@@ -1277,6 +1299,8 @@ impl cpu::Vcpu for KvmVcpu {
         for i in 0..32 {
             let mut bytes = [0_u8; 16];
             self.fd
+                .lock()
+                .unwrap()
                 .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U128, off), &mut bytes)
                 .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
             state.fp_regs.vregs[i] = u128::from_le_bytes(bytes);
@@ -1287,6 +1311,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(kvm_regs, fp_regs) + offset_of!(user_fpsimd_state, fpsr);
         let mut bytes = [0_u8; 4];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U32, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.fp_regs.fpsr = u32::from_le_bytes(bytes);
@@ -1295,6 +1321,8 @@ impl cpu::Vcpu for KvmVcpu {
         let off = offset_of!(kvm_regs, fp_regs) + offset_of!(user_fpsimd_state, fpcr);
         let mut bytes = [0_u8; 4];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(arm64_core_reg_id!(KVM_REG_SIZE_U32, off), &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetCoreRegister(e.into()))?;
         state.fp_regs.fpcr = u32::from_le_bytes(bytes);
@@ -1308,6 +1336,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn set_regs(&self, regs: &StandardRegisters) -> cpu::Result<()> {
         let regs = (*regs).into();
         self.fd
+            .lock()
+            .unwrap()
             .set_regs(&regs)
             .map_err(|e| cpu::HypervisorCpuError::SetStandardRegs(e.into()))
     }
@@ -1324,6 +1354,8 @@ impl cpu::Vcpu for KvmVcpu {
         let mut off = offset_of!(user_pt_regs, regs);
         for i in 0..31 {
             self.fd
+                .lock()
+                .unwrap()
                 .set_one_reg(
                     arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                     &state.regs.regs[i].to_le_bytes(),
@@ -1334,6 +1366,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(user_pt_regs, sp);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                 &state.regs.sp.to_le_bytes(),
@@ -1342,6 +1376,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(user_pt_regs, pc);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                 &state.regs.pc.to_le_bytes(),
@@ -1350,6 +1386,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(user_pt_regs, pstate);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                 &state.regs.pstate.to_le_bytes(),
@@ -1358,6 +1396,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(kvm_regs, sp_el1);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                 &state.sp_el1.to_le_bytes(),
@@ -1366,6 +1406,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(kvm_regs, elr_el1);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                 &state.elr_el1.to_le_bytes(),
@@ -1375,6 +1417,8 @@ impl cpu::Vcpu for KvmVcpu {
         let mut off = offset_of!(kvm_regs, spsr);
         for i in 0..KVM_NR_SPSR as usize {
             self.fd
+                .lock()
+                .unwrap()
                 .set_one_reg(
                     arm64_core_reg_id!(KVM_REG_SIZE_U64, off),
                     &state.spsr[i].to_le_bytes(),
@@ -1386,6 +1430,8 @@ impl cpu::Vcpu for KvmVcpu {
         let mut off = offset_of!(kvm_regs, fp_regs) + offset_of!(user_fpsimd_state, vregs);
         for i in 0..32 {
             self.fd
+                .lock()
+                .unwrap()
                 .set_one_reg(
                     arm64_core_reg_id!(KVM_REG_SIZE_U128, off),
                     &state.fp_regs.vregs[i].to_le_bytes(),
@@ -1396,6 +1442,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(kvm_regs, fp_regs) + offset_of!(user_fpsimd_state, fpsr);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U32, off),
                 &state.fp_regs.fpsr.to_le_bytes(),
@@ -1404,6 +1452,8 @@ impl cpu::Vcpu for KvmVcpu {
 
         let off = offset_of!(kvm_regs, fp_regs) + offset_of!(user_fpsimd_state, fpcr);
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U32, off),
                 &state.fp_regs.fpcr.to_le_bytes(),
@@ -1419,6 +1469,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn get_sregs(&self) -> cpu::Result<SpecialRegisters> {
         Ok(self
             .fd
+            .lock()
+            .unwrap()
             .get_sregs()
             .map_err(|e| cpu::HypervisorCpuError::GetSpecialRegs(e.into()))?
             .into())
@@ -1431,6 +1483,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn set_sregs(&self, sregs: &SpecialRegisters) -> cpu::Result<()> {
         let sregs = (*sregs).into();
         self.fd
+            .lock()
+            .unwrap()
             .set_sregs(&sregs)
             .map_err(|e| cpu::HypervisorCpuError::SetSpecialRegs(e.into()))
     }
@@ -1442,6 +1496,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn get_fpu(&self) -> cpu::Result<FpuState> {
         Ok(self
             .fd
+            .lock()
+            .unwrap()
             .get_fpu()
             .map_err(|e| cpu::HypervisorCpuError::GetFloatingPointRegs(e.into()))?
             .into())
@@ -1454,6 +1510,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn set_fpu(&self, fpu: &FpuState) -> cpu::Result<()> {
         let fpu: kvm_bindings::kvm_fpu = (*fpu).clone().into();
         self.fd
+            .lock()
+            .unwrap()
             .set_fpu(&fpu)
             .map_err(|e| cpu::HypervisorCpuError::SetFloatingPointRegs(e.into()))
     }
@@ -1469,6 +1527,8 @@ impl cpu::Vcpu for KvmVcpu {
             .map_err(|_| cpu::HypervisorCpuError::SetCpuid(anyhow!("failed to create CpuId")))?;
 
         self.fd
+            .lock()
+            .unwrap()
             .set_cpuid2(&kvm_cpuid)
             .map_err(|e| cpu::HypervisorCpuError::SetCpuid(e.into()))
     }
@@ -1487,6 +1547,8 @@ impl cpu::Vcpu for KvmVcpu {
             ..Default::default()
         };
         self.fd
+            .lock()
+            .unwrap()
             .enable_cap(&cap)
             .map_err(|e| cpu::HypervisorCpuError::EnableHyperVSyncIc(e.into()))
     }
@@ -1498,6 +1560,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn get_cpuid2(&self, num_entries: usize) -> cpu::Result<Vec<CpuIdEntry>> {
         let kvm_cpuid = self
             .fd
+            .lock()
+            .unwrap()
             .get_cpuid2(num_entries)
             .map_err(|e| cpu::HypervisorCpuError::GetCpuid(e.into()))?;
 
@@ -1513,6 +1577,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn get_lapic(&self) -> cpu::Result<LapicState> {
         Ok(self
             .fd
+            .lock()
+            .unwrap()
             .get_lapic()
             .map_err(|e| cpu::HypervisorCpuError::GetlapicState(e.into()))?
             .into())
@@ -1525,6 +1591,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn set_lapic(&self, klapic: &LapicState) -> cpu::Result<()> {
         let klapic: kvm_bindings::kvm_lapic_state = (*klapic).clone().into();
         self.fd
+            .lock()
+            .unwrap()
             .set_lapic(&klapic)
             .map_err(|e| cpu::HypervisorCpuError::SetLapicState(e.into()))
     }
@@ -1538,6 +1606,8 @@ impl cpu::Vcpu for KvmVcpu {
         let mut kvm_msrs = MsrEntries::from_entries(&kvm_msrs).unwrap();
         let succ = self
             .fd
+            .lock()
+            .unwrap()
             .get_msrs(&mut kvm_msrs)
             .map_err(|e| cpu::HypervisorCpuError::GetMsrEntries(e.into()))?;
 
@@ -1560,6 +1630,8 @@ impl cpu::Vcpu for KvmVcpu {
         let kvm_msrs: Vec<kvm_msr_entry> = msrs.iter().map(|e| (*e).into()).collect();
         let kvm_msrs = MsrEntries::from_entries(&kvm_msrs).unwrap();
         self.fd
+            .lock()
+            .unwrap()
             .set_msrs(&kvm_msrs)
             .map_err(|e| cpu::HypervisorCpuError::SetMsrEntries(e.into()))
     }
@@ -1570,6 +1642,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn get_mp_state(&self) -> cpu::Result<MpState> {
         Ok(self
             .fd
+            .lock()
+            .unwrap()
             .get_mp_state()
             .map_err(|e| cpu::HypervisorCpuError::GetMpState(e.into()))?
             .into())
@@ -1580,6 +1654,8 @@ impl cpu::Vcpu for KvmVcpu {
     ///
     fn set_mp_state(&self, mp_state: MpState) -> cpu::Result<()> {
         self.fd
+            .lock()
+            .unwrap()
             .set_mp_state(mp_state.into())
             .map_err(|e| cpu::HypervisorCpuError::SetMpState(e.into()))
     }
@@ -1591,6 +1667,8 @@ impl cpu::Vcpu for KvmVcpu {
     fn translate_gva(&self, gva: u64, _flags: u64) -> cpu::Result<(u64, u32)> {
         let tr = self
             .fd
+            .lock()
+            .unwrap()
             .translate_gva(gva)
             .map_err(|e| cpu::HypervisorCpuError::TranslateVirtualAddress(e.into()))?;
         // tr.valid is set if the GVA is mapped to valid GPA.
@@ -1607,7 +1685,7 @@ impl cpu::Vcpu for KvmVcpu {
     /// Triggers the running of the current virtual CPU returning an exit reason.
     ///
     fn run(&self) -> std::result::Result<cpu::VmExit, cpu::HypervisorCpuError> {
-        match self.fd.run() {
+        match self.fd.lock().unwrap().run() {
             Ok(run) => match run {
                 #[cfg(target_arch = "x86_64")]
                 VcpuExit::IoIn(addr, data) => {
@@ -1618,7 +1696,7 @@ impl cpu::Vcpu for KvmVcpu {
                             .map_err(|e| cpu::HypervisorCpuError::RunVcpu(e.into()));
                     }
 
-                    Ok(cpu::VmExit::IoIn(addr, data))
+                    Ok(cpu::VmExit::Ignore)
                 }
                 #[cfg(target_arch = "x86_64")]
                 VcpuExit::IoOut(addr, data) => {
@@ -1629,7 +1707,7 @@ impl cpu::Vcpu for KvmVcpu {
                             .map_err(|e| cpu::HypervisorCpuError::RunVcpu(e.into()));
                     }
 
-                    Ok(cpu::VmExit::IoOut(addr, data))
+                    Ok(cpu::VmExit::Ignore)
                 }
                 #[cfg(target_arch = "x86_64")]
                 VcpuExit::IoapicEoi(vector) => Ok(cpu::VmExit::IoapicEoi(vector)),
@@ -1662,7 +1740,7 @@ impl cpu::Vcpu for KvmVcpu {
                             .map_err(|e| cpu::HypervisorCpuError::RunVcpu(e.into()));
                     }
 
-                    Ok(cpu::VmExit::MmioRead(addr, data))
+                    Ok(cpu::VmExit::Ignore)
                 }
                 VcpuExit::MmioWrite(addr, data) => {
                     if let Some(vm_ops) = &self.vm_ops {
@@ -1672,7 +1750,7 @@ impl cpu::Vcpu for KvmVcpu {
                             .map_err(|e| cpu::HypervisorCpuError::RunVcpu(e.into()));
                     }
 
-                    Ok(cpu::VmExit::MmioWrite(addr, data))
+                    Ok(cpu::VmExit::Ignore)
                 }
                 VcpuExit::Hyperv => Ok(cpu::VmExit::Hyperv),
                 #[cfg(feature = "tdx")]
@@ -1701,7 +1779,7 @@ impl cpu::Vcpu for KvmVcpu {
     /// potential soft lockups when being resumed.
     ///
     fn notify_guest_clock_paused(&self) -> cpu::Result<()> {
-        if let Err(e) = self.fd.kvmclock_ctrl() {
+        if let Err(e) = self.fd.lock().unwrap().kvmclock_ctrl() {
             // Linux kernel returns -EINVAL if the PV clock isn't yet initialised
             // which could be because we're still in firmware or the guest doesn't
             // use KVM clock.
@@ -1763,6 +1841,8 @@ impl cpu::Vcpu for KvmVcpu {
             }
         }
         self.fd
+            .lock()
+            .unwrap()
             .set_guest_debug(&dbg)
             .map_err(|e| cpu::HypervisorCpuError::SetDebugRegs(e.into()))
     }
@@ -1770,6 +1850,8 @@ impl cpu::Vcpu for KvmVcpu {
     #[cfg(target_arch = "aarch64")]
     fn vcpu_init(&self, kvi: &VcpuInit) -> cpu::Result<()> {
         self.fd
+            .lock()
+            .unwrap()
             .vcpu_init(kvi)
             .map_err(|e| cpu::HypervisorCpuError::VcpuInit(e.into()))
     }
@@ -1781,6 +1863,8 @@ impl cpu::Vcpu for KvmVcpu {
     #[cfg(target_arch = "aarch64")]
     fn get_reg_list(&self, reg_list: &mut RegList) -> cpu::Result<()> {
         self.fd
+            .lock()
+            .unwrap()
             .get_reg_list(reg_list)
             .map_err(|e| cpu::HypervisorCpuError::GetRegList(e.into()))
     }
@@ -1813,6 +1897,8 @@ impl cpu::Vcpu for KvmVcpu {
                     | KVM_REG_ARM64_SYSREG_OP2_MASK)) as u64);
         let mut bytes = [0_u8; 8];
         self.fd
+            .lock()
+            .unwrap()
             .get_one_reg(id, &mut bytes)
             .map_err(|e| cpu::HypervisorCpuError::GetSysRegister(e.into()))?;
         Ok(u64::from_le_bytes(bytes))
@@ -1840,6 +1926,8 @@ impl cpu::Vcpu for KvmVcpu {
         // Get the register index of the PSTATE (Processor State) register.
         let pstate = offset_of!(user_pt_regs, pstate) + kreg_off;
         self.fd
+            .lock()
+            .unwrap()
             .set_one_reg(
                 arm64_core_reg_id!(KVM_REG_SIZE_U64, pstate),
                 &PSTATE_FAULT_BITS_64.to_le_bytes(),
@@ -1851,6 +1939,8 @@ impl cpu::Vcpu for KvmVcpu {
             // Setting the PC (Processor Counter) to the current program address (kernel address).
             let pc = offset_of!(user_pt_regs, pc) + kreg_off;
             self.fd
+                .lock()
+                .unwrap()
                 .set_one_reg(
                     arm64_core_reg_id!(KVM_REG_SIZE_U64, pc),
                     &boot_ip.to_le_bytes(),
@@ -1863,6 +1953,8 @@ impl cpu::Vcpu for KvmVcpu {
             // We are choosing to place it the end of DRAM. See `get_fdt_addr`.
             let regs0 = offset_of!(user_pt_regs, regs) + kreg_off;
             self.fd
+                .lock()
+                .unwrap()
                 .set_one_reg(
                     arm64_core_reg_id!(KVM_REG_SIZE_U64, regs0),
                     &fdt_start.to_le_bytes(),
@@ -2014,6 +2106,8 @@ impl cpu::Vcpu for KvmVcpu {
         let mut sys_regs: Vec<Register> = Vec::new();
         let mut reg_list = RegList::new(500).unwrap();
         self.fd
+            .lock()
+            .unwrap()
             .get_reg_list(&mut reg_list)
             .map_err(|e| cpu::HypervisorCpuError::GetRegList(e.into()))?;
 
@@ -2032,6 +2126,8 @@ impl cpu::Vcpu for KvmVcpu {
         for index in indices.iter() {
             let mut bytes = [0_u8; 8];
             self.fd
+                .lock()
+                .unwrap()
                 .get_one_reg(*index, &mut bytes)
                 .map_err(|e| cpu::HypervisorCpuError::GetSysRegister(e.into()))?;
             sys_regs.push(kvm_bindings::kvm_one_reg {
@@ -2146,6 +2242,8 @@ impl cpu::Vcpu for KvmVcpu {
         // Set system registers
         for reg in &state.sys_regs {
             self.fd
+                .lock()
+                .unwrap()
                 .set_one_reg(reg.id, &reg.addr.to_le_bytes())
                 .map_err(|e| cpu::HypervisorCpuError::SetSysRegister(e.into()))?;
         }
@@ -2160,15 +2258,20 @@ impl cpu::Vcpu for KvmVcpu {
     ///
     #[cfg(feature = "tdx")]
     fn tdx_init(&self, hob_address: u64) -> cpu::Result<()> {
-        tdx_command(&self.fd.as_raw_fd(), TdxCommand::InitVcpu, 0, hob_address)
-            .map_err(cpu::HypervisorCpuError::InitializeTdx)
+        tdx_command(
+            &self.fd.lock().unwrap().as_raw_fd(),
+            TdxCommand::InitVcpu,
+            0,
+            hob_address,
+        )
+        .map_err(cpu::HypervisorCpuError::InitializeTdx)
     }
 
     ///
     /// Set the "immediate_exit" state
     ///
     fn set_immediate_exit(&self, exit: bool) {
-        self.fd.set_kvm_immediate_exit(exit.into());
+        self.fd.lock().unwrap().set_kvm_immediate_exit(exit.into());
     }
 
     ///
@@ -2176,7 +2279,8 @@ impl cpu::Vcpu for KvmVcpu {
     ///
     #[cfg(feature = "tdx")]
     fn get_tdx_exit_details(&mut self) -> cpu::Result<TdxExitDetails> {
-        let kvm_run = self.fd.get_kvm_run();
+        let mut fd = self.fd.as_ref().lock().unwrap();
+        let kvm_run = fd.get_kvm_run();
         // SAFETY: accessing a union field in a valid structure
         let tdx_vmcall = unsafe {
             &mut (*((&mut kvm_run.__bindgen_anon_1) as *mut kvm_run__bindgen_ty_1
@@ -2205,7 +2309,8 @@ impl cpu::Vcpu for KvmVcpu {
     ///
     #[cfg(feature = "tdx")]
     fn set_tdx_status(&mut self, status: TdxExitStatus) {
-        let kvm_run = self.fd.get_kvm_run();
+        let mut fd = self.fd.as_ref().lock().unwrap();
+        let kvm_run = fd.get_kvm_run();
         // SAFETY: accessing a union field in a valid structure
         let tdx_vmcall = unsafe {
             &mut (*((&mut kvm_run.__bindgen_anon_1) as *mut kvm_run__bindgen_ty_1
@@ -2254,7 +2359,7 @@ impl cpu::Vcpu for KvmVcpu {
             addr: 0x0,
             flags: 0,
         };
-        self.fd.has_device_attr(&cpu_attr).is_ok()
+        self.fd.lock().unwrap().has_device_attr(&cpu_attr).is_ok()
     }
 
     #[cfg(target_arch = "aarch64")]
@@ -2272,9 +2377,13 @@ impl cpu::Vcpu for KvmVcpu {
             flags: 0,
         };
         self.fd
+            .lock()
+            .unwrap()
             .set_device_attr(&cpu_attr_irq)
             .map_err(|_| cpu::HypervisorCpuError::InitializePmu)?;
         self.fd
+            .lock()
+            .unwrap()
             .set_device_attr(&cpu_attr)
             .map_err(|_| cpu::HypervisorCpuError::InitializePmu)
     }
@@ -2284,7 +2393,7 @@ impl cpu::Vcpu for KvmVcpu {
     /// Get the frequency of the TSC if available
     ///
     fn tsc_khz(&self) -> cpu::Result<Option<u32>> {
-        match self.fd.get_tsc_khz() {
+        match self.fd.lock().unwrap().get_tsc_khz() {
             Err(e) => {
                 if e.errno() == libc::EIO {
                     Ok(None)
@@ -2301,7 +2410,7 @@ impl cpu::Vcpu for KvmVcpu {
     /// Set the frequency of the TSC if available
     ///
     fn set_tsc_khz(&self, freq: u32) -> cpu::Result<()> {
-        match self.fd.set_tsc_khz(freq) {
+        match self.fd.lock().unwrap().set_tsc_khz(freq) {
             Err(e) => {
                 if e.errno() == libc::EIO {
                     Ok(())
@@ -2312,6 +2421,23 @@ impl cpu::Vcpu for KvmVcpu {
             Ok(_) => Ok(()),
         }
     }
+
+    #[cfg(target_arch = "x86_64")]
+    ///
+    /// Trigger NMI interrupt
+    ///
+    fn nmi(&self) -> cpu::Result<()> {
+        match self.fd.lock().unwrap().nmi() {
+            Err(e) => {
+                if e.errno() == libc::EIO {
+                    Ok(())
+                } else {
+                    Err(cpu::HypervisorCpuError::Nmi(e.into()))
+                }
+            }
+            Ok(_) => Ok(()),
+        }
+    }
 }
 
 impl KvmVcpu {
@@ -2322,6 +2448,8 @@ impl KvmVcpu {
     fn get_xsave(&self) -> cpu::Result<XsaveState> {
         Ok(self
             .fd
+            .lock()
+            .unwrap()
             .get_xsave()
             .map_err(|e| cpu::HypervisorCpuError::GetXsaveState(e.into()))?
             .into())
@@ -2334,6 +2462,8 @@ impl KvmVcpu {
     fn set_xsave(&self, xsave: &XsaveState) -> cpu::Result<()> {
         let xsave: kvm_bindings::kvm_xsave = (*xsave).clone().into();
         self.fd
+            .lock()
+            .unwrap()
             .set_xsave(&xsave)
             .map_err(|e| cpu::HypervisorCpuError::SetXsaveState(e.into()))
     }
@@ -2344,6 +2474,8 @@ impl KvmVcpu {
     ///
     fn get_xcrs(&self) -> cpu::Result<ExtendedControlRegisters> {
         self.fd
+            .lock()
+            .unwrap()
             .get_xcrs()
             .map_err(|e| cpu::HypervisorCpuError::GetXcsr(e.into()))
     }
@@ -2354,6 +2486,8 @@ impl KvmVcpu {
     ///
     fn set_xcrs(&self, xcrs: &ExtendedControlRegisters) -> cpu::Result<()> {
         self.fd
+            .lock()
+            .unwrap()
             .set_xcrs(xcrs)
             .map_err(|e| cpu::HypervisorCpuError::SetXcsr(e.into()))
     }
@@ -2365,6 +2499,8 @@ impl KvmVcpu {
     ///
     fn get_vcpu_events(&self) -> cpu::Result<VcpuEvents> {
         self.fd
+            .lock()
+            .unwrap()
             .get_vcpu_events()
             .map_err(|e| cpu::HypervisorCpuError::GetVcpuEvents(e.into()))
     }
@@ -2376,6 +2512,8 @@ impl KvmVcpu {
     ///
     fn set_vcpu_events(&self, events: &VcpuEvents) -> cpu::Result<()> {
         self.fd
+            .lock()
+            .unwrap()
             .set_vcpu_events(events)
             .map_err(|e| cpu::HypervisorCpuError::SetVcpuEvents(e.into()))
     }

hypervisor/src/lib.rs

@@ -20,7 +20,7 @@
 
 #[macro_use]
 extern crate anyhow;
-#[cfg(target_arch = "x86_64")]
+#[allow(unused_imports)]
 #[macro_use]
 extern crate log;
 

hypervisor/src/mshv/mod.rs

@@ -13,8 +13,8 @@ use crate::hypervisor;
 use crate::vec_with_array_field;
 use crate::vm::{self, InterruptSourceConfig, VmOps};
 use crate::HypervisorType;
-pub use mshv_bindings::*;
-use mshv_ioctls::{set_registers_64, Mshv, NoDatamatch, VcpuFd, VmFd, VmType};
+use mshv_bindings::*;
+use mshv_ioctls::{set_registers_64, InterruptRequest, Mshv, NoDatamatch, VcpuFd, VmFd, VmType};
 use std::any::Any;
 use std::collections::HashMap;
 use std::sync::{Arc, RwLock};
@@ -29,8 +29,11 @@ pub mod x86_64;
 #[cfg(feature = "sev_snp")]
 use snp_constants::*;
 
+#[cfg(target_arch = "x86_64")]
+use crate::ClockData;
+
 use crate::{
-    ClockData, CpuState, IoEventAddress, IrqRoutingEntry, MpState, UserMemoryRegion,
+    CpuState, IoEventAddress, IrqRoutingEntry, MpState, UserMemoryRegion,
     USER_MEMORY_REGION_ADJUSTABLE, USER_MEMORY_REGION_EXECUTE, USER_MEMORY_REGION_READ,
     USER_MEMORY_REGION_WRITE,
 };
@@ -288,27 +291,39 @@ impl hypervisor::Hypervisor for MshvHypervisor {
         )
         .map_err(|e| hypervisor::HypervisorError::SetPartitionProperty(e.into()))?;
 
-        let msr_list = self.get_msr_list()?;
-        let num_msrs = msr_list.as_fam_struct_ref().nmsrs as usize;
-        let mut msrs: Vec<MsrEntry> = vec![
-            MsrEntry {
-                ..Default::default()
-            };
-            num_msrs
-        ];
-        let indices = msr_list.as_slice();
-        for (pos, index) in indices.iter().enumerate() {
-            msrs[pos].index = *index;
-        }
         let vm_fd = Arc::new(fd);
 
-        Ok(Arc::new(MshvVm {
-            fd: vm_fd,
-            msrs,
-            dirty_log_slots: Arc::new(RwLock::new(HashMap::new())),
-            #[cfg(feature = "sev_snp")]
-            sev_snp_enabled: mshv_vm_type == VmType::Snp,
-        }))
+        #[cfg(target_arch = "x86_64")]
+        {
+            let msr_list = self.get_msr_list()?;
+            let num_msrs = msr_list.as_fam_struct_ref().nmsrs as usize;
+            let mut msrs: Vec<MsrEntry> = vec![
+                MsrEntry {
+                    ..Default::default()
+                };
+                num_msrs
+            ];
+            let indices = msr_list.as_slice();
+            for (pos, index) in indices.iter().enumerate() {
+                msrs[pos].index = *index;
+            }
+
+            Ok(Arc::new(MshvVm {
+                fd: vm_fd,
+                msrs,
+                dirty_log_slots: Arc::new(RwLock::new(HashMap::new())),
+                #[cfg(feature = "sev_snp")]
+                sev_snp_enabled: mshv_vm_type == VmType::Snp,
+            }))
+        }
+
+        #[cfg(target_arch = "aarch64")]
+        {
+            Ok(Arc::new(MshvVm {
+                fd: vm_fd,
+                dirty_log_slots: Arc::new(RwLock::new(HashMap::new())),
+            }))
+        }
     }
 
     /// Create a mshv vm object and return the object as Vm trait object
@@ -326,6 +341,7 @@ impl hypervisor::Hypervisor for MshvHypervisor {
         let vm_type = 0;
         self.create_vm_with_type(vm_type)
     }
+    #[cfg(target_arch = "x86_64")]
     ///
     /// Get the supported CpuID
     ///
@@ -345,10 +361,11 @@ impl hypervisor::Hypervisor for MshvHypervisor {
 pub struct MshvVcpu {
     fd: VcpuFd,
     vp_index: u8,
+    #[cfg(target_arch = "x86_64")]
     cpuid: Vec<CpuIdEntry>,
+    #[cfg(target_arch = "x86_64")]
     msrs: Vec<MsrEntry>,
     vm_ops: Option<Arc<dyn vm::VmOps>>,
-    #[cfg(feature = "sev_snp")]
     vm_fd: Arc<VmFd>,
 }
 
@@ -491,6 +508,7 @@ impl cpu::Vcpu for MshvVcpu {
                     warn!("TRIPLE FAULT");
                     Ok(cpu::VmExit::Shutdown)
                 }
+                #[cfg(target_arch = "x86_64")]
                 hv_message_type_HVMSG_X64_IO_PORT_INTERCEPT => {
                     let info = x.to_ioport_info().unwrap();
                     let access_info = info.access_info;
@@ -581,6 +599,7 @@ impl cpu::Vcpu for MshvVcpu {
                         .map_err(|e| cpu::HypervisorCpuError::SetRegister(e.into()))?;
                     Ok(cpu::VmExit::Ignore)
                 }
+                #[cfg(target_arch = "x86_64")]
                 hv_message_type_HVMSG_UNMAPPED_GPA => {
                     let info = x.to_memory_info().unwrap();
                     let insn_len = info.instruction_byte_count as usize;
@@ -606,6 +625,59 @@ impl cpu::Vcpu for MshvVcpu {
 
                     Ok(cpu::VmExit::Ignore)
                 }
+                #[cfg(feature = "sev_snp")]
+                hv_message_type_HVMSG_GPA_ATTRIBUTE_INTERCEPT => {
+                    let info = x.to_gpa_attribute_info().unwrap();
+                    let host_vis = info.__bindgen_anon_1.host_visibility();
+                    if host_vis >= HV_MAP_GPA_READABLE | HV_MAP_GPA_WRITABLE {
+                        warn!("Ignored attribute intercept with full host visibility");
+                        return Ok(cpu::VmExit::Ignore);
+                    }
+
+                    let num_ranges = info.__bindgen_anon_1.range_count();
+                    assert!(num_ranges >= 1);
+                    if num_ranges > 1 {
+                        return Err(cpu::HypervisorCpuError::RunVcpu(anyhow!(
+                            "Unhandled VCPU exit(GPA_ATTRIBUTE_INTERCEPT): Expected num_ranges to be 1 but found num_ranges {:?}",
+                            num_ranges
+                        )));
+                    }
+
+                    // TODO: we could also deny the request with HvCallCompleteIntercept
+                    let mut gpas = Vec::new();
+                    let ranges = info.ranges;
+                    let (gfn_start, gfn_count) = snp::parse_gpa_range(ranges[0]).unwrap();
+                    debug!(
+                        "Releasing pages: gfn_start: {:x?}, gfn_count: {:?}",
+                        gfn_start, gfn_count
+                    );
+                    let gpa_start = gfn_start * HV_PAGE_SIZE as u64;
+                    for i in 0..gfn_count {
+                        gpas.push(gpa_start + i * HV_PAGE_SIZE as u64);
+                    }
+
+                    let mut gpa_list =
+                        vec_with_array_field::<mshv_modify_gpa_host_access, u64>(gpas.len());
+                    gpa_list[0].gpa_list_size = gpas.len() as u64;
+                    gpa_list[0].host_access = host_vis;
+                    gpa_list[0].acquire = 0;
+                    gpa_list[0].flags = 0;
+
+                    // SAFETY: gpa_list initialized with gpas.len() and now it is being turned into
+                    // gpas_slice with gpas.len() again. It is guaranteed to be large enough to hold
+                    // everything from gpas.
+                    unsafe {
+                        let gpas_slice: &mut [u64] = gpa_list[0].gpa_list.as_mut_slice(gpas.len());
+                        gpas_slice.copy_from_slice(gpas.as_slice());
+                    }
+
+                    self.vm_fd
+                        .modify_gpa_host_access(&gpa_list[0])
+                        .map_err(|e| cpu::HypervisorCpuError::RunVcpu(anyhow!(
+                            "Unhandled VCPU exit: attribute intercept - couldn't modify host access {}", e
+                        )))?;
+                    Ok(cpu::VmExit::Ignore)
+                }
                 hv_message_type_HVMSG_UNACCEPTED_GPA => {
                     let info = x.to_memory_info().unwrap();
                     let gva = info.guest_virtual_address;
@@ -637,6 +709,7 @@ impl cpu::Vcpu for MshvVcpu {
                     debug!("Exception Info {:?}", { info.exception_vector });
                     Ok(cpu::VmExit::Ignore)
                 }
+                #[cfg(target_arch = "x86_64")]
                 hv_message_type_HVMSG_X64_APIC_EOI => {
                     let info = x.to_apic_eoi_info().unwrap();
                     // The kernel should dispatch the EOI to the correct thread.
@@ -1050,13 +1123,14 @@ impl cpu::Vcpu for MshvVcpu {
                                         .sev_snp_ap_create(&mshv_ap_create_req)
                                         .map_err(|e| cpu::HypervisorCpuError::RunVcpu(e.into()))?;
 
-                                    let mut swei2_rw_gpa_arg = mshv_bindings::mshv_read_write_gpa {
-                                        base_gpa: ghcb_gpa + GHCB_SW_EXITINFO2_OFFSET,
+                                    let mut swei1_rw_gpa_arg = mshv_bindings::mshv_read_write_gpa {
+                                        base_gpa: ghcb_gpa + GHCB_SW_EXITINFO1_OFFSET,
                                         byte_count: std::mem::size_of::<u64>() as u32,
                                         ..Default::default()
                                     };
+
                                     self.fd
-                                        .gpa_write(&mut swei2_rw_gpa_arg)
+                                        .gpa_write(&mut swei1_rw_gpa_arg)
                                         .map_err(|e| cpu::HypervisorCpuError::GpaWrite(e.into()))?;
                                 }
                                 _ => panic!(
@@ -1086,6 +1160,46 @@ impl cpu::Vcpu for MshvVcpu {
         }
     }
 
+    #[cfg(target_arch = "aarch64")]
+    fn init_pmu(&self, irq: u32) -> cpu::Result<()> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn has_pmu_support(&self) -> bool {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn setup_regs(&self, cpu_id: u8, boot_ip: u64, fdt_start: u64) -> cpu::Result<()> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn get_sys_reg(&self, sys_reg: u32) -> cpu::Result<u64> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn get_reg_list(&self, reg_list: &mut RegList) -> cpu::Result<()> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn vcpu_init(&self, kvi: &VcpuInit) -> cpu::Result<()> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn set_regs(&self, regs: &StandardRegisters) -> cpu::Result<()> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn get_regs(&self) -> cpu::Result<StandardRegisters> {
+        unimplemented!()
+    }
+
     #[cfg(target_arch = "x86_64")]
     ///
     /// X86 specific call to setup the CPUID registers.
@@ -1161,19 +1275,18 @@ impl cpu::Vcpu for MshvVcpu {
         Ok(())
     }
 
+    #[cfg(target_arch = "x86_64")]
     ///
-    /// Set CPU state
+    /// Set CPU state for x86_64 guest.
     ///
     fn set_state(&self, state: &CpuState) -> cpu::Result<()> {
-        let state: VcpuMshvState = state.clone().into();
+        let mut state: VcpuMshvState = state.clone().into();
         self.set_msrs(&state.msrs)?;
         self.set_vcpu_events(&state.vcpu_events)?;
         self.set_regs(&state.regs.into())?;
         self.set_sregs(&state.sregs.into())?;
         self.set_fpu(&state.fpu)?;
         self.set_xcrs(&state.xcrs)?;
-        self.set_lapic(&state.lapic)?;
-        self.set_xsave(&state.xsave)?;
         // These registers are global and needed to be set only for first VCPU
         // as Microsoft Hypervisor allows setting this regsier for only one VCPU
         if self.vp_index == 0 {
@@ -1184,11 +1297,23 @@ impl cpu::Vcpu for MshvVcpu {
         self.fd
             .set_debug_regs(&state.dbg)
             .map_err(|e| cpu::HypervisorCpuError::SetDebugRegs(e.into()))?;
+        self.fd
+            .set_all_vp_state_components(&mut state.vp_states)
+            .map_err(|e| cpu::HypervisorCpuError::SetAllVpStateComponents(e.into()))?;
         Ok(())
     }
 
+    #[cfg(target_arch = "aarch64")]
     ///
-    /// Get CPU State
+    /// Set CPU state for aarch64 guest.
+    ///
+    fn set_state(&self, state: &CpuState) -> cpu::Result<()> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "x86_64")]
+    ///
+    /// Get CPU State for x86_64 guest
     ///
     fn state(&self) -> cpu::Result<CpuState> {
         let regs = self.get_regs()?;
@@ -1198,8 +1323,6 @@ impl cpu::Vcpu for MshvVcpu {
         let vcpu_events = self.get_vcpu_events()?;
         let mut msrs = self.msrs.clone();
         self.get_msrs(&mut msrs)?;
-        let lapic = self.get_lapic()?;
-        let xsave = self.get_xsave()?;
         let misc = self
             .fd
             .get_misc_regs()
@@ -1208,6 +1331,10 @@ impl cpu::Vcpu for MshvVcpu {
             .fd
             .get_debug_regs()
             .map_err(|e| cpu::HypervisorCpuError::GetDebugRegs(e.into()))?;
+        let vp_states = self
+            .fd
+            .get_all_vp_state_components()
+            .map_err(|e| cpu::HypervisorCpuError::GetAllVpStateComponents(e.into()))?;
 
         Ok(VcpuMshvState {
             msrs,
@@ -1216,14 +1343,21 @@ impl cpu::Vcpu for MshvVcpu {
             sregs: sregs.into(),
             fpu,
             xcrs,
-            lapic,
             dbg,
-            xsave,
             misc,
+            vp_states,
         }
         .into())
     }
 
+    #[cfg(target_arch = "aarch64")]
+    ///
+    /// Get CPU state for aarch64 guest.
+    ///
+    fn state(&self) -> cpu::Result<CpuState> {
+        unimplemented!()
+    }
+
     #[cfg(target_arch = "x86_64")]
     ///
     /// Translate guest virtual address to guest physical address
@@ -1273,29 +1407,26 @@ impl cpu::Vcpu for MshvVcpu {
             .set_sev_control_register(sev_control_reg)
             .map_err(|e| cpu::HypervisorCpuError::SetSevControlRegister(e.into()))
     }
+    #[cfg(target_arch = "x86_64")]
+    ///
+    /// Trigger NMI interrupt
+    ///
+    fn nmi(&self) -> cpu::Result<()> {
+        let cfg = InterruptRequest {
+            interrupt_type: hv_interrupt_type_HV_X64_INTERRUPT_TYPE_NMI,
+            apic_id: self.vp_index as u64,
+            level_triggered: false,
+            vector: 0,
+            logical_destination_mode: false,
+            long_mode: false,
+        };
+        self.vm_fd
+            .request_virtual_interrupt(&cfg)
+            .map_err(|e| cpu::HypervisorCpuError::Nmi(e.into()))
+    }
 }
 
 impl MshvVcpu {
-    #[cfg(target_arch = "x86_64")]
-    ///
-    /// X86 specific call that returns the vcpu's current "xsave struct".
-    ///
-    fn get_xsave(&self) -> cpu::Result<Xsave> {
-        self.fd
-            .get_xsave()
-            .map_err(|e| cpu::HypervisorCpuError::GetXsaveState(e.into()))
-    }
-
-    #[cfg(target_arch = "x86_64")]
-    ///
-    /// X86 specific call that sets the vcpu's current "xsave struct".
-    ///
-    fn set_xsave(&self, xsave: &Xsave) -> cpu::Result<()> {
-        self.fd
-            .set_xsave(xsave)
-            .map_err(|e| cpu::HypervisorCpuError::SetXsaveState(e.into()))
-    }
-
     #[cfg(target_arch = "x86_64")]
     ///
     /// X86 specific call that returns the vcpu's current "xcrs".
@@ -1339,11 +1470,13 @@ impl MshvVcpu {
     }
 }
 
+#[cfg(target_arch = "x86_64")]
 struct MshvEmulatorContext<'a> {
     vcpu: &'a MshvVcpu,
     map: (u64, u64), // Initial GVA to GPA mapping provided by the hypervisor
 }
 
+#[cfg(target_arch = "x86_64")]
 impl<'a> MshvEmulatorContext<'a> {
     // Do the actual gva -> gpa translation
     #[allow(non_upper_case_globals)]
@@ -1367,6 +1500,7 @@ impl<'a> MshvEmulatorContext<'a> {
     }
 }
 
+#[cfg(target_arch = "x86_64")]
 /// Platform emulation for Hyper-V
 impl<'a> PlatformEmulator for MshvEmulatorContext<'a> {
     type CpuState = EmulatorCpuState;
@@ -1467,6 +1601,7 @@ impl<'a> PlatformEmulator for MshvEmulatorContext<'a> {
 /// Wrapper over Mshv VM ioctls.
 pub struct MshvVm {
     fd: Arc<VmFd>,
+    #[cfg(target_arch = "x86_64")]
     msrs: Vec<MsrEntry>,
     dirty_log_slots: Arc<RwLock<HashMap<u64, MshvDirtyLogSlot>>>,
     #[cfg(feature = "sev_snp")]
@@ -1565,10 +1700,11 @@ impl vm::Vm for MshvVm {
         let vcpu = MshvVcpu {
             fd: vcpu_fd,
             vp_index: id,
+            #[cfg(target_arch = "x86_64")]
             cpuid: Vec::new(),
+            #[cfg(target_arch = "x86_64")]
             msrs: self.msrs.clone(),
             vm_ops,
-            #[cfg(feature = "sev_snp")]
             vm_fd: self.fd.clone(),
         };
         Ok(Arc::new(vcpu))
@@ -1622,6 +1758,11 @@ impl vm::Vm for MshvVm {
 
     /// Unregister an event from a certain address it has been previously registered to.
     fn unregister_ioevent(&self, fd: &EventFd, addr: &IoEventAddress) -> vm::Result<()> {
+        #[cfg(feature = "sev_snp")]
+        if self.sev_snp_enabled {
+            return Ok(());
+        }
+
         let addr = &mshv_ioctls::IoEventAddress::from(*addr);
         debug!("unregister_ioevent fd {} addr {:x?}", fd.as_raw_fd(), addr);
 
@@ -1896,4 +2037,14 @@ impl vm::Vm for MshvVm {
             .complete_isolated_import(&data)
             .map_err(|e| vm::HypervisorVmError::CompleteIsolatedImport(e.into()))
     }
+
+    #[cfg(target_arch = "aarch64")]
+    fn create_vgic(&self, config: VgicConfig) -> vm::Result<Arc<Mutex<dyn Vgic>>> {
+        unimplemented!()
+    }
+
+    #[cfg(target_arch = "aarch64")]
+    fn get_preferred_target(&self, kvi: &mut VcpuInit) -> vm::Result<()> {
+        unimplemented!()
+    }
 }

hypervisor/src/mshv/x86_64/mod.rs

@@ -19,10 +19,10 @@ use std::fmt;
 ///
 pub use {
     mshv_bindings::hv_cpuid_entry, mshv_bindings::mshv_user_mem_region as MemoryRegion,
-    mshv_bindings::msr_entry, mshv_bindings::CpuId, mshv_bindings::DebugRegisters,
-    mshv_bindings::FloatingPointUnit, mshv_bindings::LapicState as MshvLapicState,
-    mshv_bindings::MiscRegs as MiscRegisters, mshv_bindings::MsrList,
-    mshv_bindings::Msrs as MsrEntries, mshv_bindings::Msrs,
+    mshv_bindings::msr_entry, mshv_bindings::AllVpStateComponents, mshv_bindings::CpuId,
+    mshv_bindings::DebugRegisters, mshv_bindings::FloatingPointUnit,
+    mshv_bindings::LapicState as MshvLapicState, mshv_bindings::MiscRegs as MiscRegisters,
+    mshv_bindings::MsrList, mshv_bindings::Msrs as MsrEntries, mshv_bindings::Msrs,
     mshv_bindings::SegmentRegister as MshvSegmentRegister,
     mshv_bindings::SpecialRegisters as MshvSpecialRegisters,
     mshv_bindings::StandardRegisters as MshvStandardRegisters, mshv_bindings::SuspendRegisters,
@@ -38,10 +38,9 @@ pub struct VcpuMshvState {
     pub sregs: MshvSpecialRegisters,
     pub fpu: FpuState,
     pub xcrs: ExtendedControlRegisters,
-    pub lapic: LapicState,
     pub dbg: DebugRegisters,
-    pub xsave: Xsave,
     pub misc: MiscRegisters,
+    pub vp_states: AllVpStateComponents,
 }
 
 impl fmt::Display for VcpuMshvState {
@@ -53,7 +52,7 @@ impl fmt::Display for VcpuMshvState {
             msr_entries[i][1] = entry.data;
             msr_entries[i][0] = entry.index as u64;
         }
-        write!(f, "Number of MSRs: {}: MSRs: {:#010X?}, -- VCPU Events: {:?} -- Standard registers: {:?} Special Registers: {:?} ---- Floating Point Unit: {:?} --- Extended Control Register: {:?} --- Local APIC: {:?} --- DBG: {:?} --- Xsave: {:?}",
+        write!(f, "Number of MSRs: {}: MSRs: {:#010X?}, -- VCPU Events: {:?} -- Standard registers: {:?} Special Registers: {:?} ---- Floating Point Unit: {:?} --- Extended Control Register: {:?} --- DBG: {:?} --- VP States: {:?}",
                 msr_entries.len(),
                 msr_entries,
                 self.vcpu_events,
@@ -61,9 +60,8 @@ impl fmt::Display for VcpuMshvState {
                 self.sregs,
                 self.fpu,
                 self.xcrs,
-                self.lapic,
                 self.dbg,
-                self.xsave,
+                self.vp_states,
         )
     }
 }

net_gen/src/lib.rs

@@ -1,6 +1,8 @@
 // Copyright TUNTAP, 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the THIRD-PARTY file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 #![allow(non_upper_case_globals)]
 #![allow(non_camel_case_types)]

net_util/Cargo.toml

@@ -6,18 +6,16 @@ edition = "2021"
 
 [dependencies]
 epoll = "4.3.3"
-getrandom = "0.2.11"
+getrandom = "0.2.13"
 libc = "0.2.153"
-log = "0.4.20"
+log = "0.4.21"
 net_gen = { path = "../net_gen" }
 rate_limiter = { path = "../rate_limiter" }
-serde = "1.0.196"
-thiserror = "1.0.52"
-versionize = "0.2.0"
-versionize_derive = "0.1.6"
-virtio-bindings = "0.2.0"
+serde = "1.0.197"
+thiserror = "1.0.58"
+virtio-bindings = "0.2.2"
 virtio-queue = "0.11.0"
-vm-memory = { version = "0.14.0", features = ["backend-mmap", "backend-atomic", "backend-bitmap"] }
+vm-memory = { version = "0.14.1", features = ["backend-mmap", "backend-atomic", "backend-bitmap"] }
 vm-virtio = { path = "../vm-virtio" }
 vmm-sys-util = "0.12.1"
 
@@ -25,4 +23,4 @@ vmm-sys-util = "0.12.1"
 once_cell = "1.19.0"
 pnet = "0.34.0"
 pnet_datalink = "0.34.0"
-serde_json = "1.0.109"
+serde_json = "1.0.115"

net_util/src/lib.rs

@@ -14,13 +14,13 @@ mod open_tap;
 mod queue_pair;
 mod tap;
 
+use serde::{Deserialize, Serialize};
 use std::io::Error as IoError;
 use std::os::raw::c_uint;
 use std::os::unix::io::{FromRawFd, RawFd};
 use std::{io, mem, net};
 use thiserror::Error;
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
+
 use virtio_bindings::virtio_net::{
     virtio_net_hdr_v1, VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX, VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN,
     VIRTIO_NET_F_GUEST_CSUM, VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_TSO4,
@@ -45,7 +45,7 @@ pub enum Error {
 pub type Result<T> = std::result::Result<T, Error>;
 
 #[repr(C, packed)]
-#[derive(Copy, Clone, Debug, Default, Versionize)]
+#[derive(Copy, Clone, Debug, Default, Serialize, Deserialize)]
 pub struct VirtioNetConfig {
     pub mac: [u8; 6],
     pub status: u16,

net_util/src/mac.rs

@@ -7,7 +7,6 @@
 
 use std::fmt;
 use std::io;
-use std::result::Result;
 use std::str::FromStr;
 
 use serde::de::{Deserialize, Deserializer, Error};

pci/Cargo.toml

@@ -10,8 +10,8 @@ kvm = ["vfio-ioctls/kvm"]
 mshv = ["vfio-ioctls/mshv"]
 
 [dependencies]
-anyhow = "1.0.79"
-byteorder = "1.4.3"
+anyhow = "1.0.81"
+byteorder = "1.5.0"
 hypervisor = { path = "../hypervisor" }
 vfio-bindings = { git = "https://github.com/rust-vmm/vfio", branch = "main", features = ["fam-wrappers"] }
 vfio-ioctls = { git = "https://github.com/rust-vmm/vfio", branch = "main", default-features = false }
@@ -19,12 +19,10 @@ vfio_user = { git = "https://github.com/rust-vmm/vfio-user", branch = "main" }
 
 vmm-sys-util = "0.12.1"
 libc = "0.2.153"
-log = "0.4.20"
-serde = { version = "1.0.196", features = ["derive"] }
-thiserror = "1.0.52"
-versionize = "0.2.0"
-versionize_derive = "0.1.6"
+log = "0.4.21"
+serde = { version = "1.0.197", features = ["derive"] }
+thiserror = "1.0.58"
 vm-allocator = { path = "../vm-allocator" }
 vm-device = { path = "../vm-device" }
-vm-memory = { version = "0.14.0", features = ["backend-mmap", "backend-atomic", "backend-bitmap"] }
+vm-memory = { version = "0.14.1", features = ["backend-mmap", "backend-atomic", "backend-bitmap"] }
 vm-migration = { path = "../vm-migration" }

pci/src/bus.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use crate::configuration::{
     PciBarRegionType, PciBridgeSubclass, PciClassCode, PciConfiguration, PciHeaderType,

pci/src/configuration.rs

@@ -1,16 +1,17 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use crate::device::BarReprogrammingParams;
 use crate::{MsixConfig, PciInterruptPin};
 use byteorder::{ByteOrder, LittleEndian};
+use serde::{Deserialize, Serialize};
 use std::fmt::{self, Display};
 use std::sync::{Arc, Mutex};
-use versionize::{VersionMap, Versionize, VersionizeError, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::PciBarType;
-use vm_migration::{MigratableError, Pausable, Snapshot, Snapshottable, VersionMapped};
+use vm_migration::{MigratableError, Pausable, Snapshot, Snapshottable};
 
 // The number of 32bit registers in the config space, 4096 bytes.
 const NUM_CONFIGURATION_REGISTERS: usize = 1024;
@@ -396,7 +397,7 @@ fn decode_64_bits_bar_size(bar_size_hi: u32, bar_size_lo: u32) -> Option<u64> {
     None
 }
 
-#[derive(Debug, Default, Clone, Copy, Versionize)]
+#[derive(Debug, Default, Clone, Copy, Serialize, Deserialize)]
 struct PciBar {
     addr: u32,
     size: u32,
@@ -404,7 +405,7 @@ struct PciBar {
     r#type: Option<PciBarRegionType>,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct PciConfigurationState {
     registers: Vec<u32>,
     writable_bits: Vec<u32>,
@@ -416,8 +417,6 @@ pub struct PciConfigurationState {
     msix_cap_reg_idx: Option<usize>,
 }
 
-impl VersionMapped for PciConfigurationState {}
-
 /// Contains the configuration space of a PCI node.
 /// See the [specification](https://en.wikipedia.org/wiki/PCI_configuration_space).
 /// The configuration space is accessed with DWORD reads and writes from the guest.
@@ -435,7 +434,7 @@ pub struct PciConfiguration {
 }
 
 /// See pci_regs.h in kernel
-#[derive(Copy, Clone, PartialEq, Eq, Versionize, Debug)]
+#[derive(Copy, Clone, PartialEq, Eq, Serialize, Deserialize, Debug)]
 pub enum PciBarRegionType {
     Memory32BitRegion = 0,
     IoRegion = 0x01,
@@ -1070,7 +1069,7 @@ impl Snapshottable for PciConfiguration {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }
 

pci/src/device.rs

@@ -1,13 +1,15 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use crate::configuration::{self, PciBarRegionType};
 use crate::PciBarConfiguration;
 use std::any::Any;
 use std::fmt::{self, Display};
 use std::sync::{Arc, Barrier, Mutex};
-use std::{self, io, result};
+use std::{io, result};
 use vm_allocator::{AddressAllocator, SystemAllocator};
 use vm_device::{BusDevice, Resource};
 

pci/src/lib.rs

@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 //! Implements pci devices and busses.
 #[macro_use]
@@ -26,7 +28,7 @@ pub use self::device::{
 };
 pub use self::msi::{msi_num_enabled_vectors, MsiCap, MsiConfig};
 pub use self::msix::{MsixCap, MsixConfig, MsixTableEntry, MSIX_CONFIG_ID, MSIX_TABLE_ENTRY_SIZE};
-pub use self::vfio::{VfioPciDevice, VfioPciError};
+pub use self::vfio::{MmioRegion, VfioDmaMapping, VfioPciDevice, VfioPciError};
 pub use self::vfio_user::{VfioUserDmaMapping, VfioUserPciDevice, VfioUserPciDeviceError};
 use serde::de::Visitor;
 use std::fmt::{self, Display};

pci/src/msi.rs

@@ -4,15 +4,14 @@
 //
 
 use byteorder::{ByteOrder, LittleEndian};
+use serde::{Deserialize, Serialize};
 use std::io;
 use std::sync::Arc;
 use thiserror::Error;
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::interrupt::{
     InterruptIndex, InterruptSourceConfig, InterruptSourceGroup, MsiIrqSourceConfig,
 };
-use vm_migration::{MigratableError, Pausable, Snapshot, Snapshottable, VersionMapped};
+use vm_migration::{MigratableError, Pausable, Snapshot, Snapshottable};
 
 // MSI control masks
 const MSI_CTL_ENABLE: u16 = 0x1;
@@ -47,7 +46,7 @@ pub enum Error {
 
 pub const MSI_CONFIG_ID: &str = "msi_config";
 
-#[derive(Clone, Copy, Default, Versionize)]
+#[derive(Clone, Copy, Default, Serialize, Deserialize)]
 pub struct MsiCap {
     // Message Control Register
     //   0:     MSI enable.
@@ -172,13 +171,11 @@ impl MsiCap {
     }
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct MsiConfigState {
     cap: MsiCap,
 }
 
-impl VersionMapped for MsiConfigState {}
-
 pub struct MsiConfig {
     pub cap: MsiCap,
     interrupt_source_group: Arc<dyn InterruptSourceGroup>,
@@ -294,6 +291,6 @@ impl Snapshottable for MsiConfig {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }

pci/src/msix.rs

@@ -5,16 +5,16 @@
 
 use crate::{PciCapability, PciCapabilityId};
 use byteorder::{ByteOrder, LittleEndian};
+use serde::Deserialize;
+use serde::Serialize;
 use std::io;
 use std::result;
 use std::sync::Arc;
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vm_device::interrupt::{
     InterruptIndex, InterruptSourceConfig, InterruptSourceGroup, MsiIrqSourceConfig,
 };
 use vm_memory::ByteValued;
-use vm_migration::{MigratableError, Pausable, Snapshot, Snapshottable, VersionMapped};
+use vm_migration::{MigratableError, Pausable, Snapshot, Snapshottable};
 
 const MAX_MSIX_VECTORS_PER_DEVICE: u16 = 2048;
 const MSIX_TABLE_ENTRIES_MODULO: u64 = 16;
@@ -35,7 +35,7 @@ pub enum Error {
     UpdateInterruptRoute(io::Error),
 }
 
-#[derive(Debug, Clone, Versionize, Eq, PartialEq)]
+#[derive(Debug, Clone, Serialize, Deserialize, Eq, PartialEq)]
 pub struct MsixTableEntry {
     pub msg_addr_lo: u32,
     pub msg_addr_hi: u32,
@@ -60,7 +60,7 @@ impl Default for MsixTableEntry {
     }
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 pub struct MsixConfigState {
     table_entries: Vec<MsixTableEntry>,
     pba_entries: Vec<u64>,
@@ -68,8 +68,6 @@ pub struct MsixConfigState {
     enabled: bool,
 }
 
-impl VersionMapped for MsixConfigState {}
-
 pub struct MsixConfig {
     pub table_entries: Vec<MsixTableEntry>,
     pub pba_entries: Vec<u64>,
@@ -436,13 +434,13 @@ impl Snapshottable for MsixConfig {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        Snapshot::new_from_versioned_state(&self.state())
+        Snapshot::new_from_state(&self.state())
     }
 }
 
 #[allow(dead_code)]
 #[repr(packed)]
-#[derive(Clone, Copy, Default, Versionize)]
+#[derive(Clone, Copy, Default, Serialize, Deserialize)]
 pub struct MsixCap {
     // Message Control Register
     //   10-0:  MSI-X Table size

pci/src/vfio.rs

@@ -15,6 +15,7 @@ use anyhow::anyhow;
 use byteorder::{ByteOrder, LittleEndian};
 use hypervisor::HypervisorVmError;
 use libc::{sysconf, _SC_PAGESIZE};
+use serde::{Deserialize, Serialize};
 use std::any::Any;
 use std::collections::{BTreeMap, HashMap};
 use std::io;
@@ -22,8 +23,6 @@ use std::os::unix::io::AsRawFd;
 use std::ptr::null_mut;
 use std::sync::{Arc, Barrier, Mutex};
 use thiserror::Error;
-use versionize::{VersionMap, Versionize, VersionizeResult};
-use versionize_derive::Versionize;
 use vfio_bindings::bindings::vfio::*;
 use vfio_ioctls::{
     VfioContainer, VfioDevice, VfioIrq, VfioRegionInfoCap, VfioRegionSparseMmapArea,
@@ -32,14 +31,13 @@ use vm_allocator::page_size::{
     align_page_size_down, align_page_size_up, is_4k_aligned, is_4k_multiple, is_page_size_aligned,
 };
 use vm_allocator::{AddressAllocator, SystemAllocator};
+use vm_device::dma_mapping::ExternalDmaMapping;
 use vm_device::interrupt::{
     InterruptIndex, InterruptManager, InterruptSourceGroup, MsiIrqGroupConfig,
 };
 use vm_device::{BusDevice, Resource};
-use vm_memory::{Address, GuestAddress, GuestUsize};
-use vm_migration::{
-    Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable, VersionMapped,
-};
+use vm_memory::{Address, GuestAddress, GuestAddressSpace, GuestMemory, GuestUsize};
+use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable};
 use vmm_sys_util::eventfd::EventFd;
 
 pub(crate) const VFIO_COMMON_ID: &str = "vfio_common";
@@ -94,7 +92,7 @@ enum InterruptUpdateAction {
     DisableMsix,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 struct IntxState {
     enabled: bool,
 }
@@ -104,7 +102,7 @@ pub(crate) struct VfioIntx {
     enabled: bool,
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 struct MsiState {
     cap: MsiCap,
     cap_offset: u32,
@@ -136,7 +134,7 @@ impl VfioMsi {
     }
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 struct MsixState {
     cap: MsixCap,
     cap_offset: u32,
@@ -274,6 +272,48 @@ pub struct MmioRegion {
     pub(crate) index: u32,
     pub(crate) user_memory_regions: Vec<UserMemoryRegion>,
 }
+
+trait MmioRegionRange {
+    fn check_range(&self, guest_addr: u64, size: u64) -> bool;
+    fn find_user_address(&self, guest_addr: u64) -> Result<u64, io::Error>;
+}
+
+impl MmioRegionRange for Vec<MmioRegion> {
+    // Check if a guest address is within the range of mmio regions
+    fn check_range(&self, guest_addr: u64, size: u64) -> bool {
+        for region in self.iter() {
+            let Some(guest_addr_end) = guest_addr.checked_add(size) else {
+                return false;
+            };
+            let Some(region_end) = region.start.raw_value().checked_add(region.length) else {
+                return false;
+            };
+            if guest_addr >= region.start.raw_value() && guest_addr_end <= region_end {
+                return true;
+            }
+        }
+        false
+    }
+
+    // Locate the user region address for a guest address within all mmio regions
+    fn find_user_address(&self, guest_addr: u64) -> Result<u64, io::Error> {
+        for region in self.iter() {
+            for user_region in region.user_memory_regions.iter() {
+                if guest_addr >= user_region.start
+                    && guest_addr < user_region.start + user_region.size
+                {
+                    return Ok(user_region.host_addr + (guest_addr - user_region.start));
+                }
+            }
+        }
+
+        Err(io::Error::new(
+            io::ErrorKind::Other,
+            format!("unable to find user address: 0x{guest_addr:x}"),
+        ))
+    }
+}
+
 #[derive(Debug, Error)]
 pub enum VfioError {
     #[error("Kernel VFIO error: {0}")]
@@ -397,15 +437,13 @@ impl Vfio for VfioDeviceWrapper {
     }
 }
 
-#[derive(Versionize)]
+#[derive(Serialize, Deserialize)]
 struct VfioCommonState {
     intx_state: Option<IntxState>,
     msi_state: Option<MsiState>,
     msix_state: Option<MsixState>,
 }
 
-impl VersionMapped for VfioCommonState {}
-
 pub(crate) struct ConfigPatch {
     mask: u32,
     patch: u32,
@@ -419,6 +457,7 @@ pub(crate) struct VfioCommon {
     pub(crate) legacy_interrupt_group: Option<Arc<dyn InterruptSourceGroup>>,
     pub(crate) vfio_wrapper: Arc<dyn Vfio>,
     pub(crate) patches: HashMap<usize, ConfigPatch>,
+    x_nv_gpudirect_clique: Option<u8>,
 }
 
 impl VfioCommon {
@@ -429,15 +468,15 @@ impl VfioCommon {
         subclass: &dyn PciSubclass,
         bdf: PciBdf,
         snapshot: Option<Snapshot>,
+        x_nv_gpudirect_clique: Option<u8>,
     ) -> Result<Self, VfioPciError> {
         let pci_configuration_state =
-            vm_migration::versioned_state_from_id(snapshot.as_ref(), PCI_CONFIGURATION_ID)
-                .map_err(|e| {
-                    VfioPciError::RetrievePciConfigurationState(anyhow!(
-                        "Failed to get PciConfigurationState from Snapshot: {}",
-                        e
-                    ))
-                })?;
+            vm_migration::state_from_id(snapshot.as_ref(), PCI_CONFIGURATION_ID).map_err(|e| {
+                VfioPciError::RetrievePciConfigurationState(anyhow!(
+                    "Failed to get PciConfigurationState from Snapshot: {}",
+                    e
+                ))
+            })?;
 
         let configuration = PciConfiguration::new(
             0,
@@ -465,11 +504,12 @@ impl VfioCommon {
             legacy_interrupt_group,
             vfio_wrapper,
             patches: HashMap::new(),
+            x_nv_gpudirect_clique,
         };
 
         let state: Option<VfioCommonState> = snapshot
             .as_ref()
-            .map(|s| s.to_versioned_state())
+            .map(|s| s.to_state())
             .transpose()
             .map_err(|e| {
                 VfioPciError::RetrieveVfioCommonState(anyhow!(
@@ -477,20 +517,20 @@ impl VfioCommon {
                     e
                 ))
             })?;
-        let msi_state = vm_migration::versioned_state_from_id(snapshot.as_ref(), MSI_CONFIG_ID)
-            .map_err(|e| {
+        let msi_state =
+            vm_migration::state_from_id(snapshot.as_ref(), MSI_CONFIG_ID).map_err(|e| {
                 VfioPciError::RetrieveMsiConfigState(anyhow!(
                     "Failed to get MsiConfigState from Snapshot: {}",
                     e
                 ))
             })?;
-        let msix_state = vm_migration::versioned_state_from_id(snapshot.as_ref(), MSIX_CONFIG_ID)
-            .map_err(|e| {
-            VfioPciError::RetrieveMsixConfigState(anyhow!(
-                "Failed to get MsixConfigState from Snapshot: {}",
-                e
-            ))
-        })?;
+        let msix_state =
+            vm_migration::state_from_id(snapshot.as_ref(), MSIX_CONFIG_ID).map_err(|e| {
+                VfioPciError::RetrieveMsixConfigState(anyhow!(
+                    "Failed to get MsixConfigState from Snapshot: {}",
+                    e
+                ))
+            })?;
 
         if let Some(state) = state.as_ref() {
             vfio_common.set_state(state, msi_state, msix_state)?;
@@ -859,15 +899,15 @@ impl VfioCommon {
     }
 
     pub(crate) fn parse_capabilities(&mut self, bdf: PciBdf) {
-        let mut cap_next = self
+        let mut cap_iter = self
             .vfio_wrapper
             .read_config_byte(PCI_CONFIG_CAPABILITY_OFFSET);
 
         let mut pci_express_cap_found = false;
         let mut power_management_cap_found = false;
 
-        while cap_next != 0 {
-            let cap_id = self.vfio_wrapper.read_config_byte(cap_next.into());
+        while cap_iter != 0 {
+            let cap_id = self.vfio_wrapper.read_config_byte(cap_iter.into());
 
             match PciCapabilityId::from(cap_id) {
                 PciCapabilityId::MessageSignalledInterrupts => {
@@ -875,8 +915,8 @@ impl VfioCommon {
                         if irq_info.count > 0 {
                             // Parse capability only if the VFIO device
                             // supports MSI.
-                            let msg_ctl = self.parse_msi_capabilities(cap_next);
-                            self.initialize_msi(msg_ctl, cap_next as u32, None);
+                            let msg_ctl = self.parse_msi_capabilities(cap_iter);
+                            self.initialize_msi(msg_ctl, cap_iter as u32, None);
                         }
                     }
                 }
@@ -886,8 +926,8 @@ impl VfioCommon {
                         if irq_info.count > 0 {
                             // Parse capability only if the VFIO device
                             // supports MSI-X.
-                            let msix_cap = self.parse_msix_capabilities(cap_next);
-                            self.initialize_msix(msix_cap, cap_next as u32, bdf, None);
+                            let msix_cap = self.parse_msix_capabilities(cap_iter);
+                            self.initialize_msix(msix_cap, cap_iter as u32, bdf, None);
                         }
                     }
                 }
@@ -896,7 +936,16 @@ impl VfioCommon {
                 _ => {}
             };
 
-            cap_next = self.vfio_wrapper.read_config_byte((cap_next + 1).into());
+            let cap_next = self.vfio_wrapper.read_config_byte((cap_iter + 1).into());
+            if cap_next == 0 {
+                break;
+            }
+
+            cap_iter = cap_next;
+        }
+
+        if let Some(clique_id) = self.x_nv_gpudirect_clique {
+            self.add_nv_gpudirect_clique_cap(cap_iter, clique_id);
         }
 
         if pci_express_cap_found && power_management_cap_found {
@@ -904,6 +953,37 @@ impl VfioCommon {
         }
     }
 
+    fn add_nv_gpudirect_clique_cap(&mut self, cap_iter: u8, clique_id: u8) {
+        // Turing, Ampere, Hopper, and Lovelace GPUs have dedicated space
+        // at 0xD4 for this capability.
+        let cap_offset = 0xd4u32;
+
+        let reg_idx = (cap_iter / 4) as usize;
+        self.patches.insert(
+            reg_idx,
+            ConfigPatch {
+                mask: 0x0000_ff00,
+                patch: cap_offset << 8,
+            },
+        );
+
+        let reg_idx = (cap_offset / 4) as usize;
+        self.patches.insert(
+            reg_idx,
+            ConfigPatch {
+                mask: 0xffff_ffff,
+                patch: 0x50080009u32,
+            },
+        );
+        self.patches.insert(
+            reg_idx + 1,
+            ConfigPatch {
+                mask: 0xffff_ffff,
+                patch: u32::from(clique_id) << 19 | 0x5032,
+            },
+        );
+    }
+
     fn parse_extended_capabilities(&mut self) {
         let mut current_offset = PCI_CONFIG_EXTENDED_CAPABILITY_OFFSET;
 
@@ -1302,7 +1382,7 @@ impl Snapshottable for VfioCommon {
     }
 
     fn snapshot(&mut self) -> std::result::Result<Snapshot, MigratableError> {
-        let mut vfio_common_snapshot = Snapshot::new_from_versioned_state(&self.state())?;
+        let mut vfio_common_snapshot = Snapshot::new_from_state(&self.state())?;
 
         // Snapshot PciConfiguration
         vfio_common_snapshot.add_snapshot(self.configuration.id(), self.configuration.snapshot()?);
@@ -1351,6 +1431,7 @@ impl VfioPciDevice {
         bdf: PciBdf,
         memory_slot: Arc<dyn Fn() -> u32 + Send + Sync>,
         snapshot: Option<Snapshot>,
+        x_nv_gpudirect_clique: Option<u8>,
     ) -> Result<Self, VfioPciError> {
         let device = Arc::new(device);
         device.reset();
@@ -1364,6 +1445,7 @@ impl VfioPciDevice {
             &PciVfioSubclass::VfioSubclass,
             bdf,
             vm_migration::snapshot_from_id(snapshot.as_ref(), VFIO_COMMON_ID),
+            x_nv_gpudirect_clique,
         )?;
 
         let vfio_pci_device = VfioPciDevice {
@@ -1840,3 +1922,80 @@ impl Snapshottable for VfioPciDevice {
 }
 impl Transportable for VfioPciDevice {}
 impl Migratable for VfioPciDevice {}
+
+/// This structure implements the ExternalDmaMapping trait. It is meant to
+/// be used when the caller tries to provide a way to update the mappings
+/// associated with a specific VFIO container.
+pub struct VfioDmaMapping<M: GuestAddressSpace> {
+    container: Arc<VfioContainer>,
+    memory: Arc<M>,
+    mmio_regions: Arc<Mutex<Vec<MmioRegion>>>,
+}
+
+impl<M: GuestAddressSpace> VfioDmaMapping<M> {
+    /// Create a DmaMapping object.
+    /// # Parameters
+    /// * `container`: VFIO container object.
+    /// * `memory`: guest memory to mmap.
+    /// * `mmio_regions`: mmio_regions to mmap.
+    pub fn new(
+        container: Arc<VfioContainer>,
+        memory: Arc<M>,
+        mmio_regions: Arc<Mutex<Vec<MmioRegion>>>,
+    ) -> Self {
+        VfioDmaMapping {
+            container,
+            memory,
+            mmio_regions,
+        }
+    }
+}
+
+impl<M: GuestAddressSpace + Sync + Send> ExternalDmaMapping for VfioDmaMapping<M> {
+    fn map(&self, iova: u64, gpa: u64, size: u64) -> std::result::Result<(), io::Error> {
+        let mem = self.memory.memory();
+        let guest_addr = GuestAddress(gpa);
+        let user_addr = if mem.check_range(guest_addr, size as usize) {
+            match mem.get_host_address(guest_addr) {
+                Ok(t) => t as u64,
+                Err(e) => {
+                    return Err(io::Error::new(
+                        io::ErrorKind::Other,
+                        format!("unable to retrieve user address for gpa 0x{gpa:x} from guest memory region: {e}")
+                    ));
+                }
+            }
+        } else if self.mmio_regions.lock().unwrap().check_range(gpa, size) {
+            self.mmio_regions.lock().unwrap().find_user_address(gpa)?
+        } else {
+            return Err(io::Error::new(
+                io::ErrorKind::Other,
+                format!("failed to locate guest address 0x{gpa:x} in guest memory"),
+            ));
+        };
+
+        self.container
+            .vfio_dma_map(iova, size, user_addr)
+            .map_err(|e| {
+                io::Error::new(
+                    io::ErrorKind::Other,
+                    format!(
+                        "failed to map memory for VFIO container, \
+                         iova 0x{iova:x}, gpa 0x{gpa:x}, size 0x{size:x}: {e:?}"
+                    ),
+                )
+            })
+    }
+
+    fn unmap(&self, iova: u64, size: u64) -> std::result::Result<(), io::Error> {
+        self.container.vfio_dma_unmap(iova, size).map_err(|e| {
+            io::Error::new(
+                io::ErrorKind::Other,
+                format!(
+                    "failed to unmap memory for VFIO container, \
+                     iova 0x{iova:x}, size 0x{size:x}: {e:?}"
+                ),
+            )
+        })
+    }
+}

pci/src/vfio_user.rs

@@ -94,6 +94,7 @@ impl VfioUserPciDevice {
             &PciVfioUserSubclass::VfioUserSubclass,
             bdf,
             vm_migration::snapshot_from_id(snapshot.as_ref(), VFIO_COMMON_ID),
+            None,
         )
         .map_err(VfioUserPciDeviceError::CreateVfioCommon)?;
 

performance-metrics/Cargo.toml

@@ -6,10 +6,10 @@ edition = "2021"
 build = "../build.rs"
 
 [dependencies]
-clap = { version = "4.4.7", features = ["wrap_help"] }
-dirs = "5.0.0"
-serde = { version = "1.0.196", features = ["rc", "derive"] }
-serde_json = "1.0.109"
+clap = { version = "4.5.4", features = ["wrap_help"] }
+dirs = "5.0.1"
+serde = { version = "1.0.197", features = ["rc", "derive"] }
+serde_json = "1.0.115"
 test_infra = { path = "../test_infra" }
-thiserror = "1.0.52"
+thiserror = "1.0.58"
 wait-timeout = "0.2.0"

performance-metrics/src/performance_tests.rs

@@ -8,7 +8,6 @@
 use crate::{mean, PerformanceTestControl};
 use std::fs;
 use std::path::PathBuf;
-use std::string::String;
 use std::thread;
 use std::time::Duration;
 use test_infra::Error as InfraError;

rate_limiter/Cargo.toml

@@ -6,6 +6,6 @@ edition = "2021"
 [dependencies]
 epoll = "4.3.3"
 libc = "0.2.153"
-log = "0.4.20"
-thiserror = "1.0.40"
+log = "0.4.21"
+thiserror = "1.0.58"
 vmm-sys-util = "0.12.1"

rate_limiter/src/lib.rs

@@ -522,7 +522,6 @@ pub(crate) mod tests {
     use super::*;
     use std::fmt;
     use std::thread;
-    use std::time::Duration;
 
     impl TokenBucket {
         // Resets the token bucket: budget set to max capacity and last-updated set to now.

release-notes.md

@@ -1,3 +1,10 @@
+- [v39.0](#v390)
+    - [Variable Sizing of PCI Apertures for Segments](#variable-sizing-of-pci-apertures-for-segments)
+    - [Direct Booting with bzImages](#direct-booting-with-bzimages)
+    - [Support for NVIDIA GPUDirect P2P Support](#support-for-nvidia-gpudirect-p2p-support)
+    - [Guest NMI Injection Support](#guest-nmi-injection-support)
+    - [Notable Bug Fixes](#notable-bug-fixes)
+    - [Contributors](#contributors)
 - [v38.0](#v380)
     - [Group Rate Limiter on Block Devices](#group-rate-limiter-on-block-devices)
     - [CPU Pinning Support for Block Device Worker Thread](#cpu-pinning-support-for-block-device-worker-thread)
@@ -5,16 +12,16 @@
     - [New 'debug-console' Device](#new-debug-console-device)
     - [Improved VFIO Device Support](#improved-vfio-device-support)
     - [Extended CPU Affinity Support](#extended-cpu-affinity-support)
-    - [Notable Bug Fixes](#notable-bug-fixes)
-    - [Contributors](#contributors)
+    - [Notable Bug Fixes](#notable-bug-fixes-1)
+    - [Contributors](#contributors-1)
 - [v37.0](#v370)
     - [Long Term Support (LTS) Release](#long-term-support-lts-release)
     - [Multiple PCI segments Support for 32-bit VFIO devices](#multiple-pci-segments-support-for-32-bit-vfio-devices)
     - [Configurable Named TAP Devices](#configurable-named-tap-devices)
     - [TTY Output from Both Serial Device and Virtio Console](#tty-output-from-both-serial-device-and-virtio-console)
     - [Faster VM Restoration from Snapshots](#faster-vm-restoration-from-snapshots)
-    - [Notable Bug Fixes](#notable-bug-fixes-1)
-    - [Contributors](#contributors-1)
+    - [Notable Bug Fixes](#notable-bug-fixes-2)
+    - [Contributors](#contributors-2)
 - [v36.0](#v360)
     - [Command Line Changes](#command-line-changes)
     - [Enabled Features Reported via API Endpoint and CLI](#enabled-features-reported-via-api-endpoint-and-cli)
@@ -23,31 +30,31 @@
     - [Unix Socket Backend for Serial Port](#unix-socket-backend-for-serial-port)
     - [AIO Backend for Block Devices](#aio-backend-for-block-devices)
     - [Documentation Improvements](#documentation-improvements)
-    - [Notable Bug Fixes](#notable-bug-fixes-2)
-    - [Contributors](#contributors-2)
+    - [Notable Bug Fixes](#notable-bug-fixes-3)
+    - [Contributors](#contributors-3)
 - [v35.0](#v350)
     - [`virtio-vsock` Support for Linux Guest Kernel v6.3+](#virtio-vsock-support-for-linux-guest-kernel-v63)
     - [User Specified Serial Number for `virtio-block`](#user-specified-serial-number-for-virtio-block)
     - [vCPU TSC Frequency Included in Migration State](#vcpu-tsc-frequency-included-in-migration-state)
-    - [Notable Bug Fixes](#notable-bug-fixes-3)
-    - [Contributors](#contributors-3)
+    - [Notable Bug Fixes](#notable-bug-fixes-4)
+    - [Contributors](#contributors-4)
 - [v34.0](#v340)
     - [Paravirtualised Panic Device Support](#paravirtualised-panic-device-support)
     - [Improvements to VM Core Dump](#improvements-to-vm-core-dump)
     - [QCOW2 Support for Backing Files](#qcow2-support-for-backing-files)
     - [Minimum Host Kernel Bump](#minimum-host-kernel-bump)
-    - [Notable Bug Fixes](#notable-bug-fixes-4)
-    - [Contributors](#contributors-4)
+    - [Notable Bug Fixes](#notable-bug-fixes-5)
+    - [Contributors](#contributors-5)
 - [v33.0](#v330)
     - [D-Bus based API](#d-bus-based-api)
     - [Expose Host CPU Cache Details for AArch64](#expose-host-cpu-cache-details-for-aarch64)
-    - [Notable Bug Fixes](#notable-bug-fixes-5)
-    - [Contributors](#contributors-5)
+    - [Notable Bug Fixes](#notable-bug-fixes-6)
+    - [Contributors](#contributors-6)
 - [v32.0](#v320)
     - [Increased PCI Segment Limit](#increased-pci-segment-limit)
     - [API Changes](#api-changes)
-    - [Notable Bug Fixes](#notable-bug-fixes-6)
-    - [Contributors](#contributors-6)
+    - [Notable Bug Fixes](#notable-bug-fixes-7)
+    - [Contributors](#contributors-7)
 - [v31.1](#v311)
 - [v31.0](#v310)
     - [Update to Latest `acpi_tables`](#update-to-latest-acpi_tables)
@@ -55,15 +62,15 @@
     - [Improvements on Console `SIGWINCH` Handler](#improvements-on-console-sigwinch-handler)
     - [Remove Directory Support from `MemoryZoneConfig::file`](#remove-directory-support-from-memoryzoneconfigfile)
     - [Documentation Improvements](#documentation-improvements-1)
-    - [Notable Bug Fixes](#notable-bug-fixes-7)
-    - [Contributors](#contributors-7)
+    - [Notable Bug Fixes](#notable-bug-fixes-8)
+    - [Contributors](#contributors-8)
 - [v30.0](#v300)
     - [Command Line Changes for Reduced Binary Size](#command-line-changes-for-reduced-binary-size)
     - [Basic vfio-user Server Support](#basic-vfio-user-server-support)
     - [Heap Profiling Support](#heap-profiling-support)
     - [Documentation Improvements](#documentation-improvements-2)
-    - [Notable Bug Fixes](#notable-bug-fixes-8)
-    - [Contributors](#contributors-8)
+    - [Notable Bug Fixes](#notable-bug-fixes-9)
+    - [Contributors](#contributors-9)
 - [v28.2](#v282)
 - [v29.0](#v290)
     - [Release Binary Supports Both MSHV and KVM](#release-binary-supports-both-mshv-and-kvm)
@@ -73,10 +80,10 @@
     - [`AArch64` Documentation Integration](#aarch64-documentation-integration)
     - [`virtio-block` Counters Enhancement](#virtio-block-counters-enhancement)
     - [TCP Offload Control](#tcp-offload-control)
-    - [Notable Bug Fixes](#notable-bug-fixes-9)
+    - [Notable Bug Fixes](#notable-bug-fixes-10)
     - [Removals](#removals)
     - [Deprecations](#deprecations)
-    - [Contributors](#contributors-9)
+    - [Contributors](#contributors-10)
 - [v28.1](#v281)
 - [v28.0](#v280)
     - [Community Engagement (Reminder)](#community-engagement-reminder)
@@ -84,9 +91,9 @@
     - [Virtualised TPM Support](#virtualised-tpm-support)
     - [Transparent Huge Page Support](#transparent-huge-page-support)
     - [README Quick Start Improved](#readme-quick-start-improved)
-    - [Notable Bug Fixes](#notable-bug-fixes-10)
+    - [Notable Bug Fixes](#notable-bug-fixes-11)
     - [Removals](#removals-1)
-    - [Contributors](#contributors-10)
+    - [Contributors](#contributors-11)
 - [v27.0](#v270)
     - [Community Engagement](#community-engagement)
     - [Prebuilt Packages](#prebuilt-packages)
@@ -95,41 +102,41 @@
     - [Simplified Build Feature Flags](#simplified-build-feature-flags)
     - [Asynchronous Kernel Loading](#asynchronous-kernel-loading)
     - [GDB Support for AArch64](#gdb-support-for-aarch64)
-    - [Notable Bug Fixes](#notable-bug-fixes-11)
+    - [Notable Bug Fixes](#notable-bug-fixes-12)
     - [Deprecations](#deprecations-1)
-    - [Contributors](#contributors-11)
+    - [Contributors](#contributors-12)
 - [v26.0](#v260)
     - [SMBIOS Improvements via `--platform`](#smbios-improvements-via---platform)
     - [Unified Binary MSHV and KVM Support](#unified-binary-mshv-and-kvm-support)
-    - [Notable Bug Fixes](#notable-bug-fixes-12)
+    - [Notable Bug Fixes](#notable-bug-fixes-13)
     - [Deprecations](#deprecations-2)
     - [Removals](#removals-2)
-    - [Contributors](#contributors-12)
+    - [Contributors](#contributors-13)
 - [v25.0](#v250)
     - [`ch-remote` Improvements](#ch-remote-improvements-1)
     - [VM "Coredump" Support](#vm-coredump-support)
-    - [Notable Bug Fixes](#notable-bug-fixes-13)
+    - [Notable Bug Fixes](#notable-bug-fixes-14)
     - [Removals](#removals-3)
-    - [Contributors](#contributors-13)
+    - [Contributors](#contributors-14)
 - [v24.0](#v240)
     - [Bypass Mode for `virtio-iommu`](#bypass-mode-for-virtio-iommu)
     - [Ensure Identifiers Uniqueness](#ensure-identifiers-uniqueness)
     - [Sparse Mmap support](#sparse-mmap-support)
     - [Expose Platform Serial Number](#expose-platform-serial-number)
-    - [Notable Bug Fixes](#notable-bug-fixes-14)
+    - [Notable Bug Fixes](#notable-bug-fixes-15)
     - [Notable Improvements](#notable-improvements)
     - [Deprecations](#deprecations-3)
     - [New on the Website](#new-on-the-website)
-    - [Contributors](#contributors-14)
+    - [Contributors](#contributors-15)
 - [v23.1](#v231)
 - [v23.0](#v230)
     - [vDPA Support](#vdpa-support)
     - [Updated OS Support list](#updated-os-support-list)
     - [`AArch64` Memory Map Improvements](#aarch64-memory-map-improvements)
     - [`AMX` Support](#amx-support)
-    - [Notable Bug Fixes](#notable-bug-fixes-15)
+    - [Notable Bug Fixes](#notable-bug-fixes-16)
     - [Deprecations](#deprecations-4)
-    - [Contributors](#contributors-15)
+    - [Contributors](#contributors-16)
 - [v22.1](#v221)
 - [v22.0](#v220)
     - [GDB Debug Stub Support](#gdb-debug-stub-support)
@@ -140,13 +147,13 @@
     - [PMU Support for AArch64](#pmu-support-for-aarch64)
     - [Documentation Under CC-BY-4.0 License](#documentation-under-cc-by-40-license)
     - [Deprecation of "Classic" `virtiofsd`](#deprecation-of-classic-virtiofsd)
-    - [Notable Bug Fixes](#notable-bug-fixes-16)
-    - [Contributors](#contributors-16)
+    - [Notable Bug Fixes](#notable-bug-fixes-17)
+    - [Contributors](#contributors-17)
 - [v21.0](#v210)
     - [Efficient Local Live Migration (for Live Upgrade)](#efficient-local-live-migration-for-live-upgrade)
     - [Recommended Kernel is Now 5.15](#recommended-kernel-is-now-515)
-    - [Notable Bug fixes](#notable-bug-fixes-17)
-    - [Contributors](#contributors-17)
+    - [Notable Bug fixes](#notable-bug-fixes-18)
+    - [Contributors](#contributors-18)
 - [v20.2](#v202)
 - [v20.1](#v201)
 - [v20.0](#v200)
@@ -155,8 +162,8 @@
     - [Improved VFIO support](#improved-vfio-support)
     - [Safer code](#safer-code)
     - [Extended documentation](#extended-documentation)
-    - [Notable bug fixes](#notable-bug-fixes-18)
-    - [Contributors](#contributors-18)
+    - [Notable bug fixes](#notable-bug-fixes-19)
+    - [Contributors](#contributors-19)
 - [v19.0](#v190)
     - [Improved PTY handling for serial and `virtio-console`](#improved-pty-handling-for-serial-and-virtio-console)
     - [PCI boot time optimisations](#pci-boot-time-optimisations)
@@ -164,8 +171,8 @@
     - [Live migration enhancements](#live-migration-enhancements)
     - [`virtio-mem` support with `vfio-user`](#virtio-mem-support-with-vfio-user)
     - [AArch64 for `virtio-iommu`](#aarch64-for-virtio-iommu)
-    - [Notable bug fixes](#notable-bug-fixes-19)
-    - [Contributors](#contributors-19)
+    - [Notable bug fixes](#notable-bug-fixes-20)
+    - [Contributors](#contributors-20)
 - [v18.0](#v180)
     - [Experimental User Device (`vfio-user`) support](#experimental-user-device-vfio-user-support)
     - [Migration support for `vhost-user` devices](#migration-support-for-vhost-user-devices)
@@ -175,23 +182,23 @@
     - [Live migration on MSHV hypervisor](#live-migration-on-mshv-hypervisor)
     - [AArch64 CPU topology support](#aarch64-cpu-topology-support)
     - [Power button support on AArch64](#power-button-support-on-aarch64)
-    - [Notable bug fixes](#notable-bug-fixes-20)
-    - [Contributors](#contributors-20)
+    - [Notable bug fixes](#notable-bug-fixes-21)
+    - [Contributors](#contributors-21)
 - [v17.0](#v170)
     - [ARM64 NUMA support using ACPI](#arm64-numa-support-using-acpi)
     - [`Seccomp` support for MSHV backend](#seccomp-support-for-mshv-backend)
     - [Hotplug of `macvtap` devices](#hotplug-of-macvtap-devices)
     - [Improved SGX support](#improved-sgx-support)
     - [Inflight tracking for `vhost-user` devices](#inflight-tracking-for-vhost-user-devices)
-    - [Notable bug fixes](#notable-bug-fixes-21)
-    - [Contributors](#contributors-21)
+    - [Notable bug fixes](#notable-bug-fixes-22)
+    - [Contributors](#contributors-22)
 - [v16.0](#v160)
     - [Improved live migration support](#improved-live-migration-support)
     - [Improved `vhost-user` support](#improved-vhost-user-support)
     - [ARM64 ACPI and UEFI support](#arm64-acpi-and-uefi-support)
-    - [Notable bug fixes](#notable-bug-fixes-22)
+    - [Notable bug fixes](#notable-bug-fixes-23)
     - [Removed functionality](#removed-functionality)
-    - [Contributors](#contributors-22)
+    - [Contributors](#contributors-23)
 - [v15.0](#v150)
     - [Version numbering and stability guarantees](#version-numbering-and-stability-guarantees)
     - [Network device rate limiting](#network-device-rate-limiting)
@@ -199,7 +206,7 @@
     - [`--api-socket` supports file descriptor parameter](#--api-socket-supports-file-descriptor-parameter)
     - [Bug fixes](#bug-fixes)
     - [Deprecations](#deprecations-5)
-    - [Contributors](#contributors-23)
+    - [Contributors](#contributors-24)
 - [v0.14.1](#v0141)
 - [v0.14.0](#v0140)
     - [Structured event monitoring](#structured-event-monitoring)
@@ -209,7 +216,7 @@
     - [PTY control for serial and `virtio-console`](#pty-control-for-serial-and-virtio-console)
     - [Block device rate limiting](#block-device-rate-limiting)
     - [Deprecations](#deprecations-6)
-    - [Contributors](#contributors-24)
+    - [Contributors](#contributors-25)
 - [v0.13.0](#v0130)
     - [Wider VFIO device support](#wider-vfio-device-support)
     - [Improved huge page support](#improved-huge-page-support)
@@ -217,13 +224,13 @@
     - [VHD disk image support](#vhd-disk-image-support)
     - [Improved Virtio device threading](#improved-virtio-device-threading)
     - [Clean shutdown support via synthetic power button](#clean-shutdown-support-via-synthetic-power-button)
-    - [Contributors](#contributors-25)
+    - [Contributors](#contributors-26)
 - [v0.12.0](#v0120)
     - [ARM64 enhancements](#arm64-enhancements)
     - [Removal of `vhost-user-net` and `vhost-user-block` self spawning](#removal-of-vhost-user-net-and-vhost-user-block-self-spawning)
     - [Migration of `vhost-user-fs` backend](#migration-of-vhost-user-fs-backend)
     - [Enhanced "info" API](#enhanced-info-api)
-    - [Contributors](#contributors-26)
+    - [Contributors](#contributors-27)
 - [v0.11.0](#v0110)
     - [`io_uring` support by default for `virtio-block`](#io_uring-support-by-default-for-virtio-block)
     - [Windows Guest Support](#windows-guest-support)
@@ -235,15 +242,15 @@
     - [Default Log Level Changed](#default-log-level-changed)
     - [New `--balloon` Parameter Added](#new---balloon-parameter-added)
     - [Experimental `virtio-watchdog` Support](#experimental-virtio-watchdog-support)
-    - [Notable Bug Fixes](#notable-bug-fixes-23)
-    - [Contributors](#contributors-27)
+    - [Notable Bug Fixes](#notable-bug-fixes-24)
+    - [Contributors](#contributors-28)
 - [v0.10.0](#v0100)
     - [`virtio-block` Support for Multiple Descriptors](#virtio-block-support-for-multiple-descriptors)
     - [Memory Zones](#memory-zones)
     - [`Seccomp` Sandbox Improvements](#seccomp-sandbox-improvements)
     - [Preliminary KVM HyperV Emulation Control](#preliminary-kvm-hyperv-emulation-control)
-    - [Notable Bug Fixes](#notable-bug-fixes-24)
-    - [Contributors](#contributors-28)
+    - [Notable Bug Fixes](#notable-bug-fixes-25)
+    - [Contributors](#contributors-29)
 - [v0.9.0](#v090)
     - [`io_uring` Based Block Device Support](#io_uring-based-block-device-support)
     - [Block and Network Device Statistics](#block-and-network-device-statistics)
@@ -256,17 +263,17 @@
     - [Enhancements to ARM64 Support](#enhancements-to-arm64-support)
     - [Intel SGX Support](#intel-sgx-support)
     - [`Seccomp` Sandbox Improvements](#seccomp-sandbox-improvements-1)
-    - [Notable Bug Fixes](#notable-bug-fixes-25)
-    - [Contributors](#contributors-29)
+    - [Notable Bug Fixes](#notable-bug-fixes-26)
+    - [Contributors](#contributors-30)
 - [v0.8.0](#v080)
     - [Experimental Snapshot and Restore Support](#experimental-snapshot-and-restore-support)
     - [Experimental ARM64 Support](#experimental-arm64-support)
     - [Support for Using 5-level Paging in Guests](#support-for-using-5-level-paging-in-guests)
     - [Virtio Device Interrupt Suppression for Network Devices](#virtio-device-interrupt-suppression-for-network-devices)
     - [`vhost_user_fs` Improvements](#vhost_user_fs-improvements)
-    - [Notable Bug Fixes](#notable-bug-fixes-26)
+    - [Notable Bug Fixes](#notable-bug-fixes-27)
     - [Command Line and API Changes](#command-line-and-api-changes)
-    - [Contributors](#contributors-30)
+    - [Contributors](#contributors-31)
 - [v0.7.0](#v070)
     - [Block, Network, Persistent Memory (PMEM), VirtioFS and Vsock hotplug](#block-network-persistent-memory-pmem-virtiofs-and-vsock-hotplug)
     - [Alternative `libc` Support](#alternative-libc-support)
@@ -276,14 +283,14 @@
     - [`Seccomp` Sandboxing](#seccomp-sandboxing)
     - [Updated Distribution Support](#updated-distribution-support)
     - [Command Line and API Changes](#command-line-and-api-changes-1)
-    - [Contributors](#contributors-31)
+    - [Contributors](#contributors-32)
 - [v0.6.0](#v060)
     - [Directly Assigned Devices Hotplug](#directly-assigned-devices-hotplug)
     - [Shared Filesystem Improvements](#shared-filesystem-improvements)
     - [Block and Networking IO Self Offloading](#block-and-networking-io-self-offloading)
     - [Command Line Interface](#command-line-interface)
     - [PVH Boot](#pvh-boot)
-    - [Contributors](#contributors-32)
+    - [Contributors](#contributors-33)
 - [v0.5.1](#v051)
 - [v0.5.0](#v050)
     - [Virtual Machine Dynamic Resizing](#virtual-machine-dynamic-resizing)
@@ -291,7 +298,7 @@
     - [New Interrupt Management Framework](#new-interrupt-management-framework)
     - [Development Tools](#development-tools)
     - [Kata Containers Integration](#kata-containers-integration)
-    - [Contributors](#contributors-33)
+    - [Contributors](#contributors-34)
 - [v0.4.0](#v040)
     - [Dynamic virtual CPUs addition](#dynamic-virtual-cpus-addition)
     - [Programmatic firmware tables generation](#programmatic-firmware-tables-generation)
@@ -300,7 +307,7 @@
     - [Userspace IOAPIC by default](#userspace-ioapic-by-default)
     - [PCI BAR reprogramming](#pci-bar-reprogramming)
     - [New `cloud-hypervisor` organization](#new-cloud-hypervisor-organization)
-    - [Contributors](#contributors-34)
+    - [Contributors](#contributors-35)
 - [v0.3.0](#v030)
     - [Block device offloading](#block-device-offloading)
     - [Network device backend](#network-device-backend)
@@ -327,6 +334,77 @@
     - [Unit testing](#unit-testing)
     - [Integration tests parallelization](#integration-tests-parallelization)
 
+# v39.0
+
+This release has been tracked in our [roadmap
+project](https://github.com/orgs/cloud-hypervisor/projects/6) as iteration
+v39.0. The following user visible changes have been made:
+
+### Variable Sizing of PCI Apertures for Segments
+
+It is now possible to use `--pci-segment` to adjust the aperture size that
+devices 32-bit and 64-bit PCI device BARs will be allocated from. Previously
+the address space was equally distributed across all the segments which may
+leave insufficient space for devices that require a large 32-bit space. With
+this change the weighting per segment can be adjusted. (#6387)
+
+### Direct Booting with bzImages
+
+Support for directly booting Linux from bzImages has been added.(#6200)
+
+### Support for NVIDIA GPUDirect P2P Support
+
+The `x_nv_gpudirect_clique` option was added to `--device` to allow the
+configuration of device P2P support with NVIDIA GPUs. (#6235)
+
+### Guest NMI Injection Support
+
+A new API endpoint and `ch-remote` option added for injecting an NMI into the
+guest. (#6047)
+
+### Notable Bug Fixes
+
+* Workaround for kernel bug affecting guest IRQ masking on AMD (#6353)
+* Correctly cleanup `sigwinch_listener` process (#6208)
+* Graceful shutdown of HTTP API thread (#6248, #6247)
+* Fix `queue_affinity` option in OpenAPI metadata (#6268)
+* Fix documentation to indicate only stream mode is supported by `virtio-vsock`
+  (#6306)
+* Fix `virtio-fs` tag validation (#6358, #6359)
+* Add missing `pvpanic` device to OpenAPI metadata (#6372)
+* Fixes for nested virtualization with VFIO devices (#6110, #6298, #6297,
+  #6319)
+* Fix for backing file for `virtio-mem` regions with snapshot/restore (#6337,
+  #6338)
+* Explicitly mark FDs used for network devices as invalid across
+  snapshot/restore (#6332, #6286)
+* Improve `event-monitor` events around reboot (#6277, #6274)
+* Fix potential deadlock around paused devices during live migration (#6293)
+* Fix panic when running `ch-remote` with no subcommand (#6230)
+* Fix hotplug of `virtio` devices after snapshot/restore and live migration
+  (#6326, #6265)
+  
+### Contributors
+
+Many thanks to everyone who has contributed to our release:  
+
+* Alexandru Matei <alexandru.matei@uipath.com>
+* Andrew Carp <acarp@crusoeenergy.com>
+* Bo Chen <chen.bo@intel.com>
+* Bouke van der Bijl <i@bou.ke>
+* Chris Webb <chris@arachsys.com>
+* Jinank Jain <jinankjain@microsoft.com>
+* Lucas Jacques <contact@lucasjacques.com>
+* Muminul Islam <muislam@microsoft.com>
+* Nuno Das Neves <nudasnev@microsoft.com>
+* Ravi kumar Veeramally <ravikumar.veeramally@intel.com>
+* Rob Bradford <rbradford@rivosinc.com>
+* Ruslan Mstoi <ruslan.mstoi@intel.com>
+* Stefan Nuernberger <stefan.nuernberger@cyberus-technology.de>
+* Thomas Barrett <tbarrett@crusoeenergy.com>
+* Wei Liu <liuwe@microsoft.com>
+* Yi Wang <foxywang@tencent.com>
+
 # v38.0
 
 This release has been tracked in our [roadmap

resources/Dockerfile

@@ -1,3 +1,5 @@
+# Copyright © 2024 Intel Corporation
+#
 # SPDX-License-Identifier: Apache-2.0
 #
 # When changing this file don't forget to update the tag name in the
@@ -6,7 +8,7 @@
 FROM ubuntu:22.04 as dev
 
 ARG TARGETARCH
-ARG RUST_TOOLCHAIN="1.70.0"
+ARG RUST_TOOLCHAIN="1.74.1"
 ARG CLH_SRC_DIR="/cloud-hypervisor"
 ARG CLH_BUILD_DIR="$CLH_SRC_DIR/build"
 ARG CARGO_REGISTRY_DIR="$CLH_BUILD_DIR/cargo_registry"

scripts/dev_cli.sh

@@ -7,7 +7,9 @@
 CLI_NAME="Cloud Hypervisor"
 
 CTR_IMAGE_TAG="ghcr.io/cloud-hypervisor/cloud-hypervisor"
-CTR_IMAGE_VERSION="20231220-0"
+
+# Needs to match explicit version in docker-image.yaml workflow
+CTR_IMAGE_VERSION="20240407-0"
 : "${CTR_IMAGE:=${CTR_IMAGE_TAG}:${CTR_IMAGE_VERSION}}"
 
 DOCKER_RUNTIME="docker"
@@ -221,7 +223,7 @@ cmd_build() {
     build="debug"
     libc="gnu"
     hypervisor="kvm"
-    features_build=""
+    features_build=()
     exported_device="/dev/kvm"
     while [ $# -gt 0 ]; do
         case "$1" in
@@ -252,7 +254,7 @@ cmd_build() {
             ;;
         "--features")
             shift
-            features_build="--features $1"
+            features_build=(--features "$1")
             ;;
         "--") {
             shift
@@ -298,7 +300,7 @@ cmd_build() {
         --env RUSTFLAGS="$rustflags" \
         --env TARGET_CC="$target_cc" \
         "$CTR_IMAGE" \
-        cargo build --all "$features_build" \
+        cargo build --all "${features_build[@]}" \
         --target-dir "$CTR_CLH_CARGO_TARGET" \
         "${cargo_args[@]}" && say "Binaries placed under $CLH_CARGO_TARGET/$target/$build"
 }

scripts/gitlint/rules.py

@@ -42,11 +42,11 @@ class TitleStartsWithComponent(LineRule):
             'gitignore',
             'gitlint',
             'hypervisor',
-            'Jenkinsfile',
             'main',
             'misc',
             'net_gen',
             'net_util',
+            'openapi',
             'option_parser',
             'pci',
             'performance-metrics',

scripts/prepare_vdpa.sh

@@ -6,12 +6,14 @@ sudo sed -i -- 's/# deb-src/deb-src/g' /etc/apt/sources.list
 sudo apt update
 apt-get source linux-image-unsigned-"$(uname -r)"
 pushd linux-azure*/drivers/vdpa/vdpa_sim/ || exit
+# REUSE-IgnoreStart
 cat <<'EOF' >Makefile
 # SPDX-License-Identifier: GPL-2.0
 obj-m += vdpa_sim.o
 obj-m += vdpa_sim_net.o
 obj-m += vdpa_sim_blk.o
 EOF
+# REUSE-IgnoreEnd
 make -C /lib/modules/"$(uname -r)"/build M="$PWD"
 sudo make -C /lib/modules/"$(uname -r)"/build M="$PWD" modules_install
 popd || exit