Squashed preview of feature/pcie rebase on top of main

This is a preview of the rebase that I'm about to do on the feature/pcie
branch to bring it up to main.

Signed-off-by: Riccardo Mancini <[email protected]>

Author: Manciukic

.github/pull_request_template.md

@@ -16,6 +16,8 @@ Certificate of Origin and signing off your commits, please check
 ## PR Checklist
 
 - [ ] I have read and understand [CONTRIBUTING.md][3].
+- [ ] I have run `tools/devtool checkbuild --all` to verify that the PR passes
+  build checks on all supported architectures.
 - [ ] I have run `tools/devtool checkstyle` to verify that the PR passes the
   automated style checks.
 - [ ] I have described what is done in these changes, why they are needed, and

CHANGELOG.md

@@ -16,6 +16,20 @@ and this project adheres to
 - [#5175](https://github.com/firecracker-microvm/firecracker/pull/5175): Allow
   including a custom cpu template directly in the json configuration file passed
   to `--config-file` under the `cpu_config` key.
+- [#5274](https://github.com/firecracker-microvm/firecracker/pull/5274): Allow
+  taking diff snapshots even if dirty page tracking is disabled, by using
+  `mincore(2)` to overapproximate the set of dirty pages. Only works if swap is
+  disabled.
+- [#5290](https://github.com/firecracker-microvm/firecracker/pull/5290):
+  Extended MMDS to support the EC2 IMDS-compatible session token headers (i.e.
+  "X-aws-ec2-metadata-token" and "X-aws-ec2-metadata-token-ttl-seconds")
+  alongside the MMDS-specific ones.
+- [#5290](https://github.com/firecracker-microvm/firecracker/pull/5290): Added
+  `mmds.rx_invalid_token` and `mmds.rx_no_token` metrics to track the number of
+  GET requests that were rejected due to token validation failures in MMDS
+  version 2. These metrics also count requests that would be rejected in MMDS
+  version 2 when MMDS version 1 is configured. They helps users assess readiness
+  for migrating to MMDS version 2.
 
 ### Changed
 
@@ -24,9 +38,21 @@ and this project adheres to
   Incremental snapshots remain in developer preview.
 - [#5282](https://github.com/firecracker-microvm/firecracker/pull/5282): Updated
   jailer to no longer require the executable file name to contain `firecracker`.
+- [#5290](https://github.com/firecracker-microvm/firecracker/pull/5290): Changed
+  MMDS to validate the value of "X-metadata-token-ttl-seconds" header only if it
+  is a PUT request to /latest/api/token, as in EC2 IMDS.
+- [#5290](https://github.com/firecracker-microvm/firecracker/pull/5290): Changed
+  MMDS version 1 to support the session oriented method as in version 2,
+  allowing easier migration to version 2. Note that MMDS version 1 accepts a GET
+  request even with no token or an invalid token so that existing workloads
+  continue to work.
 
 ### Deprecated
 
+- [#5274](https://github.com/firecracker-microvm/firecracker/pull/5274):
+  Deprecated the `enable_diff_snapshots` parameter of the `/snapshot/load` API.
+  Use `track_dirty_pages` instead.
+
 ### Removed
 
 ### Fixed
@@ -43,6 +69,9 @@ and this project adheres to
 - [#4207](https://github.com/firecracker-microvm/firecracker/issues/4207): Fixed
   GSI numbering on aarch64 to correctly allow up to 96 devices being attached
   simultaneously.
+- [#5290](https://github.com/firecracker-microvm/firecracker/pull/5290): Fixed
+  MMDS to reject PUT requests containing `X-Forwarded-For` header regardless of
+  its casing (e.g. `x-forwarded-for`).
 
 ## [1.12.0]
 

CONTRIBUTING.md

@@ -63,13 +63,16 @@ following in the Firecracker root directory:
 ```
 cat >> .git/hooks/pre-commit << EOF
 ./tools/devtool checkstyle || exit 1
+./tools/devtool checkbuild --all || exit 1
 EOF
 ```
 
-This will automatically lint your Rust, markdown and python changes when running
-`git commit`, as well as running any other checks our CI validates as part of
-its 'Style' step. Most reported violations can be automatically fixed using
-`./tools/devtool fmt`.
+The first command will automatically lint your Rust, markdown and python changes
+when running `git commit`, as well as running any other checks our CI validates
+as part of its 'Style' step. Most reported violations can be automatically fixed
+using `./tools/devtool fmt`. The second command will then check that the code
+correctly compiles on all supported architectures, and that it passes Rust
+clippy rules defined for the project.
 
 Your contribution needs to meet the following standards:
 

Cargo.lock

@@ -21,3 +21,5 @@ a future major Firecracker release, in accordance with our
   The functionality is substituted with ACPI.
 - \[[#2628](https://github.com/firecracker-microvm/firecracker/pull/2628)\] The
   `--basic` parameter of `seccompiler-bin`.
+- \[[#5274](https://github.com/firecracker-microvm/firecracker/pull/5274)\]: The
+  `enable_diff_snapshots` body field in `PUT` requests on `/snapshot/load`