Merge branch 'microsoft:main' into vtl0-iommu-posted-interrupt-relay

Author: balajimc55

.cargo/config.toml

@@ -112,3 +112,10 @@ rustflags = [
   # Treat warnings as errors in CI.
 ### ENABLE_IN_CI "-Dwarnings",
 ]
+
+# Specify a common set of rustdocflags for all targets.
+[build]
+rustdocflags = [
+  # Treat warnings as errors in CI.
+### ENABLE_IN_CI "-Dwarnings",
+]

.config/nextest.toml

@@ -36,7 +36,7 @@ filter = 'package(~vmm_tests)'
 # Allow VMM tests longer timeouts.
 # Important Note: Petri's watchdogs need to know this value too.
 # If you change it here then change it there!
-slow-timeout = { period = "2m", terminate-after = 2 }
+slow-timeout = { period = "3m", terminate-after = 2 }
 
 # Add retries for known flaky tests.
 # TODO: Fix these tests and remove the retries.

.github/CODEOWNERS

@@ -7,9 +7,17 @@
 /ci/ @microsoft/openvmm-ci-reviewers
 /.github/ @microsoft/openvmm-ci-reviewers
 
+# Areas with specific maintainers. In some cases, general maintainers can also approve.
+
 # VTL2 settings is an API consumed by various partner teams. VTL2 Settings
 # approvers evaluate for consistency and to help ensure no breaking changes
 /vm/devices/get/underhill_config/* @microsoft/openvmm-vtl2-settings-approvers
 
+# Vmbus
+/vm/devices/vmbus/ @microsoft/openvmm-maintain @microsoft/openvmm-vmbus
+
+# Storage
+/vm/devices/storage @microsoft/openvmm-maintain @microsoft/openvmm-storage
+
 # Cargo dependencies
 /Cargo.lock @microsoft/openvmm-dependency-reviewers

.github/scripts/add_unsafe_reviewers/add-unsafe-reviewers.py

@@ -8,7 +8,7 @@
 @click.argument('target_branch', required=True)
 @click.option('--token', default=None)
 @click.option('--pull-request', default=None)
-@click.option('--team', default='openvmm-unsafe-approvers')
+@click.option('--team', default='@microsoft/openvmm-unsafe-approvers')
 def main(repo_path: str, target_branch: str, token: str, pull_request: str, team: str):
     def contains_unsafe(change) -> bool:
         if change.change_type not in ['A', 'M'] or not change.a_path.endswith('.rs'):

.github/workflows/openvmm-ci.yaml

@@ -8,7 +8,7 @@ on:
 permissions:
   id-token: write
   contents: read
-  pull-requests: read
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
@@ -20,11 +20,33 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged != true && github.event.action != 'closed'
     steps:
-      - name: Checkout actions
+      # NOTE: We're checking out both repos to avoid a security vulnerability
+      # Any code that runs in this workflow should be using the checked out base repo to avoid
+      # running code from a potentially malicious PR
+      # https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
+      # https://nathandavison.com/blog/github-actions-and-the-threat-of-malicious-pull-requests
+      - name: Checkout base repo
         uses: actions/checkout@v4
         with:
+          path: base
           fetch-depth: 0
+      - name: Checkout head repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          path: head-repo
+
+      - name: Get merge base commit
+        id: merge-base
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          git merge-base HEAD origin/${{ github.base_ref }} > merge-base.txt
+          echo "MERGE_BASE=$(cat merge-base.txt)" >> $GITHUB_ENV
+        working-directory: head-repo
 
       - name: Run unsafe code review script
-        run: pip3 install -r .github/scripts/add_unsafe_reviewers/requirements.txt && python3 .github/scripts/add_unsafe_reviewers/add-unsafe-reviewers.py . "origin/${{ github.base_ref }}" --token "${{ secrets.ONEBLUE_GH_PAT }}" --pull-request "${{ github.event.number }}"
+        run: pip3 install -r ./base/.github/scripts/add_unsafe_reviewers/requirements.txt && python3 ./base/.github/scripts/add_unsafe_reviewers/add-unsafe-reviewers.py ./head-repo "${{ env.MERGE_BASE }}" --token "${{ secrets.GITHUB_TOKEN }}" --pull-request "${{ github.event.number }}"
         shell: bash

.github/workflows/openvmm-pr.yaml

@@ -9,6 +9,9 @@
 *.img
 *.iso
 *.vmgs
+*.dbhd
+*.dbhd-shm
+*.dbhd-wal
 
 # macOS files
 .DS_Store

.github/workflows/unsafe-reviewers.yml

@@ -1,15 +1,28 @@
 By participating in this project, you agree to abide by the [CODE OF CONDUCT](./CODE_OF_CONDUCT.md).
 
-OpenVMM uses the “fork-and-pull” development model. See [GitHub forks](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks) for more information on forks. Please follow these steps to merge your changes to OpenVMM:
+OpenVMM uses the “fork-and-pull” development model. 
+See [GitHub forks](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks) 
+for more information on forks. Please follow these steps to merge your changes to OpenVMM:
 1. [Fork and clone](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo#forking-a-repository) the OpenVMM repo.
 2. Create a branch for your changes, develop your code and push your changes.
-3. Create a PR against the main branch of the OpenVMM repository [from your fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork).
+3. Create a PR against the main branch of the OpenVMM repository 
+[from your fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork).
 4. Go through the PR review process. 
 
-Following our [coding conventions](.\guide\src\dev_guide\contrib\code.md) and writing a descriptive commit message will increase the chance that a PR is accepted.
+Following our [coding conventions](.\guide\src\dev_guide\contrib\code.md) and 
+writing a descriptive commit message will increase the chance that a PR is accepted.
 
-We strongly suggest asking for feedback before starting to work on a new feature, functionality, etc. so that we can provide feedback and discuss how we can collaborate on this and support contributors. 
+We strongly suggest asking for feedback before starting to work on a new feature, 
+functionality, etc. so that we can provide feedback and discuss how we can 
+collaborate on this and support contributors. 
 
-To engage with project maintainers, contributors can reach out on Zulip (link coming soon) and then start drafting a [GitHub issue](https://github.com/microsoft/openvmm/issues/new?template=Blank+issue) after getting some preliminary feedback on Zulip, or they can open a GitHub issue to get preliminary feedback on GitHub and then reach out to us on Zulip to get some more synchronous support. 
+To engage with project maintainers, contributors can reach out on 
+[Zulip](https://openvmm.zulipchat.com/) and then start drafting a 
+[GitHub issue](https://github.com/microsoft/openvmm/issues/new?template=Blank+issue) 
+after getting some preliminary feedback on Zulip, or they can open a GitHub issue 
+to get preliminary feedback on GitHub and then reach out to us on Zulip to get 
+some more synchronous support. 
 
-We normally use Zulip for more informal conversations and GitHub Issues for more formal, auditable, public discussion and progress tracking. We encourage contributors to use both in either order based on preference.
+We normally use Zulip for more informal conversations and GitHub Issues for more 
+formal, auditable, public discussion and progress tracking. We encourage contributors 
+to use both in either order based on preference.