Prepare Firecracker v1.5.1

.buildkite/common.py

@@ -110,6 +110,24 @@ def run_all_tests(changed_files):
     )
 
 
+def devtool_test(test_path, devtool_opts=None, pytest_opts=None, binary_dir=None):
+    """Generate a `devtool test` command"""
+    cmds = []
+    parts = ["./tools/devtool -y test"]
+    if devtool_opts:
+        parts.append(devtool_opts)
+    parts.append("--")
+    if pytest_opts:
+        parts.append(pytest_opts)
+    if binary_dir is not None:
+        cmds.append(f'buildkite-agent artifact download "{binary_dir}/$(uname -m)/*" .')
+        cmds.append(f"chmod -v a+x {binary_dir}/**/*")
+        parts.append(f"--binary-dir=../{binary_dir}/$(uname -m)")
+    parts.append(test_path)
+    cmds.append(" ".join(parts))
+    return cmds
+
+
 class DictAction(argparse.Action):
     """An argparse action that can receive a nested dictionary
 
@@ -159,3 +177,10 @@ def __call__(self, parser, namespace, value, option_string=None):
     default={},
     type=str,
 )
+COMMON_PARSER.add_argument(
+    "--binary-dir",
+    help="Use the Firecracker binaries from this path",
+    required=False,
+    default=None,
+    type=str,
+)

.buildkite/pipeline_perf.py

@@ -4,7 +4,7 @@
 
 """Generate Buildkite performance pipelines dynamically"""
 
-from common import COMMON_PARSER, group, overlay_dict, pipeline_to_json
+from common import COMMON_PARSER, devtool_test, group, overlay_dict, pipeline_to_json
 
 perf_test = {
     "block": {
@@ -45,9 +45,11 @@ def build_group(test):
     devtool_opts = test.pop("devtool_opts")
     test_path = test.pop("test_path")
     retries = test.pop("retries")
+    binary_dir = test.pop("binary_dir")
+    pytest_opts = f"-m nonci --reruns {retries} --perf-fail"
     return group(
         label=test.pop("label"),
-        command=f"./tools/devtool -y test {devtool_opts} -- -m nonci --reruns {retries} --perf-fail {test_path}",
+        command=devtool_test(test_path, devtool_opts, pytest_opts, binary_dir),
         artifacts=["./test_results/*"],
         instances=test.pop("instances"),
         platforms=test.pop("platforms"),
@@ -75,6 +77,7 @@ def build_group(test):
     test_data.setdefault("agents", {"ag": 1})
     test_data["retries"] = args.retries
     test_data["timeout_in_minutes"] *= args.retries + 1
+    test_data["binary_dir"] = args.binary_dir
     test_data = overlay_dict(test_data, args.step_param)
     test_data["retry"] = {
         "automatic": [

.buildkite/pipeline_pr.py

@@ -6,6 +6,7 @@
 
 from common import (
     COMMON_PARSER,
+    devtool_test,
     get_changed_files,
     group,
     overlay_dict,
@@ -61,7 +62,10 @@
 
 functional_grp = group(
     "⚙ Functional and security 🔒",
-    "./tools/devtool -y test -- -n 8 --dist worksteal integration_tests/{{functional,security}}",
+    devtool_test(
+        "-n 8 --dist worksteal integration_tests/{{functional,security}}",
+        binary_dir=args.binary_dir,
+    ),
     **defaults,
 )
 
@@ -77,7 +81,7 @@
 
 performance_grp = group(
     "⏱ Performance",
-    "./tools/devtool -y test -- ../tests/integration_tests/performance/",
+    devtool_test("../tests/integration_tests/performance/", binary_dir=args.binary_dir),
     **defaults_for_performance,
 )
 

CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog
 
-## Unreleased
+## [1.5.1]
+
+### Added
+
+- [#4287](https://github.com/firecracker-microvm/firecracker/issues/4287)
+  Document a caveat to the jailer docs when using the `--parent-cgroup` option,
+  which results in it being ignored by the jailer. Refer to the [jailer
+  documentation](./docs/jailer.md#caveats) for a workaround.
 
 ### Changed
 
@@ -11,6 +18,9 @@
 
 ### Fixed
 
+- [#4277](https://github.com/firecracker-microvm/firecracker/pull/4277): Fixed a
+  bug that ignored the `--show-log-origin` option, preventing it from printing
+  the source code file of the log messages.
 - [#4179](https://github.com/firecracker-microvm/firecracker/pull/4179):
   Fixed a bug reporting a non-zero exit code on successful shutdown when
   starting Firecracker with `--no-api`.

docs/RELEASE_POLICY.md

@@ -86,7 +86,7 @@ also be specifying the supported kernel versions.
 
 | Release | Release Date | Latest Patch | Min. end of support | Official end of Support        |
 |--------:|-------------:|-------------:|--------------------:|:-------------------------------|
-|    v1.5 |   2023-10-09 |       v1.5.0 |          2024-04-09 | Supported                      |
+|    v1.5 |   2023-10-09 |       v1.5.1 |          2024-04-09 | Supported                      |
 |    v1.4 |   2023-07-20 |       v1.4.1 |          2024-01-20 | Supported                      |
 |    v1.3 |   2023-03-02 |       v1.3.3 |          2023-09-02 | 2023-10-09 (v1.5 released)     |
 |    v1.2 |   2022-11-30 |       v1.2.1 |          2023-05-30 | 2023-07-20 (v1.4 released)     |

docs/jailer.md

@@ -286,3 +286,8 @@ Note: default value for `<api-sock>` is `/run/firecracker.socket`.
 - If all the cgroup controllers are bunched up on a single mount point using
   the "all" option, our current program logic will complain it cannot detect
   individual controller mount points.
+
+- [#4287](https://github.com/firecracker-microvm/firecracker/issues/4287) When
+  starting a jailer with `--parent-cgroup` specified but no cgroup flags
+  specified, then the rules in the parent cgroup folder are ignored. To
+  workaround, use a dummy cgroup parameter like `--cgroup=memory.max=max`.

src/api_server/swagger/firecracker.yaml

@@ -5,7 +5,7 @@ info:
     The API is accessible through HTTP calls on specific URLs
     carrying JSON modeled data.
     The transport medium is a Unix Domain Socket.
-  version: 1.5.0
+  version: 1.5.1
   termsOfService: ""
   contact:
     email: "compute-capsule@amazon.com"

src/cpu-template-helper/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cpu-template-helper"
-version = "1.5.0"
+version = "1.5.1"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2021"
 license = "Apache-2.0"

src/firecracker/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "firecracker"
-version = "1.5.0"
+version = "1.5.1"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2021"
 build = "build.rs"

src/firecracker/src/main.rs

@@ -264,6 +264,32 @@
         return Ok(());
     }
 
+    // It's safe to unwrap here because the field's been provided with a default value.
+    let instance_id = arguments.single_value("id").unwrap();
+    validate_instance_id(instance_id.as_str()).expect("Invalid instance ID");
+
+    // Apply the logger configuration.
+    vmm::logger::INSTANCE_ID
+        .set(String::from(instance_id))
+        .unwrap();
+    let log_path = arguments.single_value("log-path").map(PathBuf::from);
+    let level = arguments
+        .single_value("level")
+        .map(|s| vmm::logger::LevelFilter::from_str(s))
+        .transpose()
+        .map_err(MainError::InvalidLogLevel)?;
+    let show_level = arguments.flag_present("show-level").then_some(true);
+    let show_log_origin = arguments.flag_present("show-log-origin").then_some(true);
+    LOGGER
+        .update(LoggerConfig {
+            log_path,
+            level,
+            show_level,
+            show_log_origin,
+        })
+        .map_err(MainError::LoggerInitialization)?;
+    info!("Running Firecracker v{FIRECRACKER_VERSION}");
+
     register_signal_handlers().map_err(MainError::RegisterSignalHandlers)?;
 
     #[cfg(target_arch = "aarch64")]
@@ -287,39 +313,13 @@
     // deprecating one.
     // warn_deprecated_parameters(&arguments);
 
-    // It's safe to unwrap here because the field's been provided with a default value.
-    let instance_id = arguments.single_value("id").unwrap();
-    validate_instance_id(instance_id.as_str()).expect("Invalid instance ID");
-
     let instance_info = InstanceInfo {
         id: instance_id.clone(),
         state: VmState::NotStarted,
         vmm_version: FIRECRACKER_VERSION.to_string(),
         app_name: "Firecracker".to_string(),
     };
 
-    let id = arguments.single_value("id").map(|s| s.as_str()).unwrap();
-    vmm::logger::INSTANCE_ID.set(String::from(id)).unwrap();
-    info!("Running Firecracker v{FIRECRACKER_VERSION}");
-
-    // Apply the logger configuration.
-    let log_path = arguments.single_value("log-path").map(PathBuf::from);
-    let level = arguments
-        .single_value("level")
-        .map(|s| vmm::logger::LevelFilter::from_str(s))
-        .transpose()
-        .map_err(MainError::InvalidLogLevel)?;
-    let show_level = arguments.flag_present("show-level").then_some(true);
-    let show_log_origin = arguments.flag_present("show-level").then_some(true);
-    LOGGER
-        .update(LoggerConfig {
-            log_path,
-            level,
-            show_level,
-            show_log_origin,
-        })
-        .map_err(MainError::LoggerInitialization)?;
-
     if let Some(metrics_path) = arguments.single_value("metrics-path") {
         let metrics_config = MetricsConfig {
             metrics_path: PathBuf::from(metrics_path),

src/jailer/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "jailer"
-version = "1.5.0"
+version = "1.5.1"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2021"
 description = "Process for starting Firecracker in production scenarios; applies a cgroup/namespace isolation barrier and then drops privileges."

src/rebase-snap/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rebase-snap"
-version = "1.5.0"
+version = "1.5.1"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2021"
 license = "Apache-2.0"

src/seccompiler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "seccompiler"
-version = "1.5.0"
+version = "1.5.1"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2021"
 description = "Program that compiles multi-threaded seccomp-bpf filters expressed as JSON into raw BPF programs, serializing them and outputting them to a file."

src/snapshot-editor/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "snapshot-editor"
-version = "1.5.0"
+version = "1.5.1"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2021"
 license = "Apache-2.0"

src/vmm/src/logger/logging.rs

@@ -22,8 +22,6 @@ pub const DEFAULT_LEVEL: log::LevelFilter = log::LevelFilter::Info;
 pub const DEFAULT_INSTANCE_ID: &str = "anonymous-instance";
 /// Instance id.
 pub static INSTANCE_ID: OnceLock<String> = OnceLock::new();
-/// Semver version of Firecracker.
-const FIRECRACKER_VERSION: &str = env!("CARGO_PKG_VERSION");
 
 /// The logger.
 ///
@@ -62,7 +60,7 @@ impl Logger {
                 .unwrap_or(DEFAULT_LEVEL),
         );
 
-        let target_changed = if let Some(log_path) = config.log_path {
+        if let Some(log_path) = config.log_path {
             let file = std::fs::OpenOptions::new()
                 .custom_flags(libc::O_NONBLOCK)
                 .read(true)
@@ -71,9 +69,6 @@ impl Logger {
                 .map_err(LoggerUpdateError)?;
 
             guard.target = Some(file);
-            true
-        } else {
-            false
         };
 
         if let Some(show_level) = config.show_level {
@@ -87,11 +82,6 @@ impl Logger {
         // Ensure we drop the guard before attempting to log, otherwise this
         // would deadlock.
         drop(guard);
-        if target_changed {
-            // We log this when a target is changed so it is always the 1st line logged, this
-            // maintains some previous behavior to minimize a breaking change.
-            log::info!("Running Firecracker v{FIRECRACKER_VERSION}");
-        }
 
         Ok(())
     }

tests/conftest.py

@@ -288,6 +288,8 @@ def microvm_factory(fc_tmp_path, bin_cloner_path, request):
     if binary_dir := request.config.getoption("--binary-dir"):
         fc_binary_path = Path(binary_dir) / "firecracker"
         jailer_binary_path = Path(binary_dir) / "jailer"
+        if not fc_binary_path.exists():
+            raise RuntimeError("Firecracker binary does not exist")
     else:
         fc_binary_path, jailer_binary_path = build_tools.get_firecracker_binaries()
 

tests/framework/microvm.py

@@ -450,6 +450,8 @@ def spawn(
         self,
         log_file="fc.log",
         log_level="Debug",
+        log_show_level=False,
+        log_show_origin=False,
         metrics_path="fc.ndjson",
     ):
         """Start a microVM as a daemon or in a screen session."""
@@ -461,10 +463,14 @@ def spawn(
             self.log_file = Path(self.path) / log_file
             self.log_file.touch()
             self.create_jailed_resource(self.log_file)
-            # The default value for `level`, when configuring the
-            # logger via cmd line, is `Warning`. We set the level
-            # to `Debug` to also have the boot time printed in fifo.
+            # The default value for `level`, when configuring the logger via cmd
+            # line, is `Info`. We set the level to `Debug` to also have the boot
+            # time printed in the log.
             self.jailer.extra_args.update({"log-path": log_file, "level": log_level})
+            if log_show_level:
+                self.jailer.extra_args["show-level"] = None
+            if log_show_origin:
+                self.jailer.extra_args["show-log-origin"] = None
 
         if metrics_path is not None:
             self.metrics_file = Path(self.path) / metrics_path