Adopt NVX time ABI v1 across KVM, MSHV, and WHP

.gitattributes

@@ -13,5 +13,6 @@ guest/* text eol=lf
 guest/**/* text eol=lf
 Dockerfile text eol=lf
 kernel/config-microvm text eol=lf
+kernel/config-microvm-debug text eol=lf
 
 .github/workflows/*.lock.yml linguist-generated=true

.github/actions/build-guest-artifacts/action.yml

@@ -8,11 +8,24 @@ inputs:
       and cache saves for artifacts that miss the cache
     required: false
     default: "false"
+  debug-kernel:
+    description: Also cache or build the CI debug kernel (build/vmlinux-debug)
+    required: false
+    default: "false"
+  guest-images:
+    description: >-
+      Cache or build the kernel and guest images; "false" with debug-kernel
+      builds only the CI debug kernel, for a job that runs beside this one
+    required: false
+    default: "true"
 
 outputs:
   kernel-cache-key:
     description: Exact cache key for the Linux kernel artifacts
     value: ${{ steps.guest-cache-keys.outputs.kernel }}
+  debug-kernel-cache-key:
+    description: Exact cache key for the Linux debug kernel artifacts
+    value: ${{ steps.guest-cache-keys.outputs.kernel-debug }}
   alpine-cache-key:
     description: Exact cache key for the Alpine disk image artifacts
     value: ${{ steps.guest-cache-keys.outputs.alpine }}
@@ -58,14 +71,16 @@ runs:
         ALPINE_VERSION: ${{ steps.guest-versions.outputs.alpine-version }}
         UBUNTU_VERSION: ${{ steps.guest-versions.outputs.ubuntu-version }}
         AZURELINUX_VERSION: ${{ steps.guest-versions.outputs.azurelinux-version }}
-        KERNEL_INPUT_HASH: ${{ hashFiles('SOURCE-MANIFEST.json', 'kernel/config-microvm', 'kernel/patches/**', 'scripts/nvx_tools/build.py', 'scripts/nvx_tools/build_config.py', 'scripts/nvx_tools/build_constants.py') }}
+        KERNEL_INPUT_HASH: ${{ hashFiles('SOURCE-MANIFEST.json', 'kernel/config-microvm', 'kernel/patches/**', 'docker/Dockerfile', 'scripts/nvx_tools/build.py', 'scripts/nvx_tools/build_config.py', 'scripts/nvx_tools/build_constants.py') }}
+        DEBUG_KERNEL_INPUT_HASH: ${{ hashFiles('SOURCE-MANIFEST.json', 'kernel/config-microvm', 'kernel/config-microvm-debug', 'kernel/patches/**', 'docker/Dockerfile', 'scripts/nvx_tools/build.py', 'scripts/nvx_tools/build_config.py', 'scripts/nvx_tools/build_constants.py') }}
         ALPINE_INPUT_HASH: ${{ hashFiles('SOURCE-MANIFEST.json', 'guest/common/**', 'guest/alpine/**', 'docker/Dockerfile', 'scripts/nvx_tools/build.py', 'scripts/nvx_tools/build_config.py', 'scripts/nvx_tools/build_constants.py', 'scripts/nvx_tools/common.py', 'scripts/nvx_tools/guests.py') }}
         UBUNTU_INPUT_HASH: ${{ hashFiles('SOURCE-MANIFEST.json', 'guest/common/**', 'guest/ubuntu/**', 'ubuntu/**', 'docker/Dockerfile', 'scripts/nvx_tools/build.py', 'scripts/nvx_tools/build_config.py', 'scripts/nvx_tools/build_constants.py', 'scripts/nvx_tools/common.py', 'scripts/nvx_tools/guests.py', 'scripts/nvx_tools/ubuntu.py') }}
         AZURELINUX_INPUT_HASH: ${{ hashFiles('SOURCE-MANIFEST.json', 'guest/common/**', 'azurelinux/**', 'docker/Dockerfile', 'scripts/nvx_tools/azurelinux.py', 'scripts/nvx_tools/build.py', 'scripts/nvx_tools/build_config.py', 'scripts/nvx_tools/build_constants.py', 'scripts/nvx_tools/common.py', 'scripts/nvx_tools/guests.py') }}
       run: |
         set -euo pipefail
         {
           echo "kernel=linux-kernel-v1-${KERNEL_VERSION}-${KERNEL_INPUT_HASH}"
+          echo "kernel-debug=linux-kernel-debug-v1-${KERNEL_VERSION}-${DEBUG_KERNEL_INPUT_HASH}"
           echo "alpine=alpine-image-v1-${ALPINE_VERSION}-${ALPINE_INPUT_HASH}"
           echo "ubuntu=ubuntu-initramfs-v1-${UBUNTU_VERSION}-${UBUNTU_INPUT_HASH}"
           echo "ubuntu-distro=ubuntu-distro-v1-${UBUNTU_VERSION}-${UBUNTU_INPUT_HASH}"
@@ -74,6 +89,7 @@ runs:
 
     - name: Restore Linux kernel (zstd)
       id: cache-linux-kernel-zstd
+      if: inputs.guest-images == 'true'
       uses: actions/cache/restore@v5
       with:
         path: |
@@ -85,6 +101,7 @@ runs:
 
     - name: Restore Alpine disk image (zstd)
       id: cache-alpine-image-zstd
+      if: inputs.guest-images == 'true'
       uses: actions/cache/restore@v5
       with:
         path: |
@@ -96,6 +113,7 @@ runs:
 
     - name: Restore Ubuntu initramfs (zstd)
       id: cache-ubuntu-initramfs-zstd
+      if: inputs.guest-images == 'true'
       uses: actions/cache/restore@v5
       with:
         path: |
@@ -106,6 +124,7 @@ runs:
 
     - name: Restore Ubuntu distro layer (zstd)
       id: cache-ubuntu-distro-zstd
+      if: inputs.guest-images == 'true'
       uses: actions/cache/restore@v5
       with:
         path: |
@@ -116,6 +135,7 @@ runs:
 
     - name: Restore Azure Linux initramfs (zstd)
       id: cache-azurelinux-initramfs-zstd
+      if: inputs.guest-images == 'true'
       uses: actions/cache/restore@v5
       with:
         path: |
@@ -125,7 +145,10 @@ runs:
         enableCrossOsArchive: true
 
     - name: Build Linux kernel (Docker)
-      if: inputs.restore-only != 'true' && steps.cache-linux-kernel-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-linux-kernel-zstd.outputs.cache-hit != 'true'
       shell: bash
       run: >-
         docker build
@@ -135,7 +158,10 @@ runs:
         .
 
     - name: Save Linux kernel (zstd)
-      if: inputs.restore-only != 'true' && steps.cache-linux-kernel-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-linux-kernel-zstd.outputs.cache-hit != 'true'
       uses: actions/cache/save@v5
       with:
         path: |
@@ -145,8 +171,50 @@ runs:
         key: ${{ steps.guest-cache-keys.outputs.kernel }}
         enableCrossOsArchive: true
 
+    - name: Restore Linux debug kernel (zstd)
+      id: cache-linux-debug-kernel-zstd
+      if: inputs.debug-kernel == 'true'
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          build/vmlinux-debug
+          build/vmlinux-debug.config
+          build/vmlinux-debug.provenance.json
+        key: ${{ steps.guest-cache-keys.outputs.kernel-debug }}
+        enableCrossOsArchive: true
+
+    - name: Build Linux debug kernel (Docker)
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.debug-kernel == 'true' &&
+        steps.cache-linux-debug-kernel-zstd.outputs.cache-hit != 'true'
+      shell: bash
+      run: >-
+        docker build
+        --file docker/Dockerfile
+        --target kernel-debug-artifacts
+        --output type=local,dest=build
+        .
+
+    - name: Save Linux debug kernel (zstd)
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.debug-kernel == 'true' &&
+        steps.cache-linux-debug-kernel-zstd.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v5
+      with:
+        path: |
+          build/vmlinux-debug
+          build/vmlinux-debug.config
+          build/vmlinux-debug.provenance.json
+        key: ${{ steps.guest-cache-keys.outputs.kernel-debug }}
+        enableCrossOsArchive: true
+
     - name: Build Alpine disk image (Docker)
-      if: inputs.restore-only != 'true' && steps.cache-alpine-image-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-alpine-image-zstd.outputs.cache-hit != 'true'
       shell: bash
       run: >-
         docker build
@@ -156,7 +224,10 @@ runs:
         .
 
     - name: Save Alpine disk image (zstd)
-      if: inputs.restore-only != 'true' && steps.cache-alpine-image-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-alpine-image-zstd.outputs.cache-hit != 'true'
       uses: actions/cache/save@v5
       with:
         path: |
@@ -167,7 +238,10 @@ runs:
         enableCrossOsArchive: true
 
     - name: Build Ubuntu initramfs (Docker)
-      if: inputs.restore-only != 'true' && steps.cache-ubuntu-initramfs-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-ubuntu-initramfs-zstd.outputs.cache-hit != 'true'
       shell: bash
       run: >-
         docker build
@@ -180,8 +254,11 @@ runs:
       if: >-
         inputs.restore-only != 'true' &&
         (
-          steps.cache-ubuntu-initramfs-zstd.outputs.cache-hit != 'true' ||
-          steps.cache-ubuntu-distro-zstd.outputs.cache-hit != 'true'
+          inputs.guest-images == 'true' &&
+          (
+            steps.cache-ubuntu-initramfs-zstd.outputs.cache-hit != 'true' ||
+            steps.cache-ubuntu-distro-zstd.outputs.cache-hit != 'true'
+          )
         )
       shell: bash
       run: >-
@@ -191,7 +268,10 @@ runs:
         .
 
     - name: Save Ubuntu initramfs (zstd)
-      if: inputs.restore-only != 'true' && steps.cache-ubuntu-initramfs-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-ubuntu-initramfs-zstd.outputs.cache-hit != 'true'
       uses: actions/cache/save@v5
       with:
         path: |
@@ -201,7 +281,10 @@ runs:
         enableCrossOsArchive: true
 
     - name: Build Azure Linux initramfs (Docker)
-      if: inputs.restore-only != 'true' && steps.cache-azurelinux-initramfs-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-azurelinux-initramfs-zstd.outputs.cache-hit != 'true'
       shell: bash
       env:
         AZURELINUX_IMAGE: ${{ steps.guest-versions.outputs.azurelinux-image }}
@@ -216,7 +299,10 @@ runs:
         .
 
     - name: Save Azure Linux initramfs (zstd)
-      if: inputs.restore-only != 'true' && steps.cache-azurelinux-initramfs-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-azurelinux-initramfs-zstd.outputs.cache-hit != 'true'
       uses: actions/cache/save@v5
       with:
         path: |
@@ -226,7 +312,10 @@ runs:
         enableCrossOsArchive: true
 
     - name: Build Ubuntu distro layer (Docker)
-      if: inputs.restore-only != 'true' && steps.cache-ubuntu-distro-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-ubuntu-distro-zstd.outputs.cache-hit != 'true'
       shell: bash
       run: >-
         docker build
@@ -236,7 +325,10 @@ runs:
         .
 
     - name: Save Ubuntu distro layer (zstd)
-      if: inputs.restore-only != 'true' && steps.cache-ubuntu-distro-zstd.outputs.cache-hit != 'true'
+      if: >-
+        inputs.restore-only != 'true' &&
+        inputs.guest-images == 'true' &&
+        steps.cache-ubuntu-distro-zstd.outputs.cache-hit != 'true'
       uses: actions/cache/save@v5
       with:
         path: |
@@ -246,6 +338,7 @@ runs:
         enableCrossOsArchive: true
 
     - name: Prepare Ubuntu sandbox scratch template
+      if: inputs.guest-images == 'true'
       shell: bash
       run: |
         set -euo pipefail

.github/actions/check-quality/action.yml

@@ -33,7 +33,7 @@ runs:
         python -m compileall -q .github/specula
         ${SHELLCHECK} --shell=sh \
           guest/common/init guest/alpine/nvx-container-enter \
-          guest/alpine/nvx-container-launch guest/common/nvx-exit \
+          guest/alpine/nvx-container-launch \
           guest/common/nvx-hostmount guest/common/nvx-identity-probe \
           guest/common/nvx-init-agent \
           guest/common/nvx-container-enter-azurelinux \
@@ -49,7 +49,7 @@ runs:
         python -m ruff format --check scripts .github/specula
         ${SHFMT} -d -ln posix -i 4 -ci \
           guest/common/init guest/alpine/nvx-container-enter \
-          guest/alpine/nvx-container-launch guest/common/nvx-exit \
+          guest/alpine/nvx-container-launch \
           guest/common/nvx-hostmount guest/common/nvx-identity-probe \
           guest/common/nvx-init-agent \
           guest/common/nvx-container-enter-azurelinux \

.github/actions/run-benchmark/action.yml

@@ -1,5 +1,7 @@
 name: Run benchmark
-description: Run and publish an OpenVMM performance series
+description: >-
+  Run and publish an OpenVMM performance series; the caller downloads the
+  guest artifacts and OpenVMM into their build paths
 
 inputs:
   backend:
@@ -35,37 +37,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Download guest artifacts
-      uses: actions/download-artifact@v8
-      with:
-        name: guest-artifacts
-        path: build
-
-    - name: Check Linux counting-LAPIC timers
-      if: runner.os != 'Windows'
-      shell: bash
-      run: |
-        set -euo pipefail
-        python3 scripts/nvx.py test-microvm \
-          --backend "${{ inputs.backend }}" \
-          --scenario smp-lapic \
-          --processors 1 2 4 8 \
-          --timeout "${{ inputs.marker-timeout }}" \
-          --output-dir "data/runs/${{ inputs.platform }}/lapic-correctness"
-
-    - name: Check Windows counting-LAPIC timers
-      if: runner.os == 'Windows'
-      shell: powershell
-      run: |
-        $ErrorActionPreference = "Stop"
-        python scripts\nvx.py test-microvm `
-          --backend "${{ inputs.backend }}" `
-          --scenario smp-lapic `
-          --processors 1 2 4 8 `
-          --timeout "${{ inputs.marker-timeout }}" `
-          --output-dir "data/runs/${{ inputs.platform }}/lapic-correctness"
-        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
     - name: Run Linux acceptance test
       if: runner.os != 'Windows'
       shell: bash

.github/actions/validate-nvx/action.yml

@@ -10,7 +10,7 @@ runs:
       run: |
         set -euo pipefail
         python3 -m compileall -q scripts
-        python3 -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_egress_policy.py scripts/test_control_session.py scripts/test_managed_agent.py -v
+        python3 -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_egress_policy.py scripts/test_control_session.py scripts/test_managed_agent.py scripts/test_guest_time.py scripts/test_time_abi.py -v
         python3 scripts/test_adversarial.py -v
         python3 .github/skills/nvx-host-connect/scripts/test_hosts.py -v
         python3 scripts/nvx.py --help
@@ -20,6 +20,7 @@ runs:
         python3 scripts/nvx.py test-aci-edge-sandboxes --help
         python3 scripts/nvx.py test-adversarial --help
         python3 scripts/nvx.py benchmark --help
+        python3 scripts/nvx.py doctor --help
 
     - name: Validate NVX CLI on Windows
       if: runner.os == 'Windows'
@@ -28,7 +29,7 @@ runs:
         $ErrorActionPreference = "Stop"
         python -m compileall -q scripts
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-        python -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_egress_policy.py scripts/test_control_session.py scripts/test_managed_agent.py -v
+        python -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_egress_policy.py scripts/test_control_session.py scripts/test_managed_agent.py scripts/test_guest_time.py scripts/test_time_abi.py -v
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
         python scripts\test_adversarial.py -v
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
@@ -48,3 +49,5 @@ runs:
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
         python scripts\nvx.py benchmark --help
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        python scripts\nvx.py doctor --help
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }