Added #5891: Added support for virtio device reset. #5983: Add two optional metrics fields, set via PUT /metrics or a config file: emit_id emits the microVM instance id under a top-level id field, and properties emits operator-defined key-value pairs under a top-level properties field. Each is opt-in and independent. See metrics documentation. #6003: Added a new option Transparent for the huge_pag…
Changed #6172: Gate CLIRD_EL1 override to only happen on host kernels equal or newer than 6.10 release. This aliviates the guest performance regression seen on host kernels in range [6.3..6.10) correlated to incorrect cpu cache topology presented to the guest. #6100: Bumped the snapshot format version. Snapshots created by this version cannot be loaded by 1.16.0 or 1.16.1, and snapshots created by…
Fixed #5959: Reverted the use of O_NOFOLLOW for the jailer's cgroup and network namespace file operations, so symlinks are again allowed in these paths. #5958: Fixed a bug that caused vsock guest-to-host connections to time out after snapshot restore, triggered by taking a snapshot with a TX descriptor in-flight. On restore the device now replays the TX queue notification so in-flight TX descripto…
Added #5786: Added developer preview support for hotplugging and hot-unplugging PCI virtio devices (block, pmem, net) on a running microVM. The guest must manually rescan the PCI bus after hotplug and remove the device before unplug since no automatic notification mechanism is implemented yet. More information can be found in the Device Hotplugging documentation page. #5323: Add support for Vsock…
Fixed #5762: Cap virtio-rng per-request entropy to 64 KiB. Previously, a guest could construct a descriptor chain that caused Firecracker to allocate more host memory than the guest actually provided, potentially leading to excessive host memory consumption. #5818: Enforce the virtio device initialization sequence in the PCI transport, matching the existing MMIO transport behavior. The PCI transpo…
Fixed #5762: Cap virtio-rng per-request entropy to 64 KiB. Previously, a guest could construct a descriptor chain that caused Firecracker to allocate more host memory than the guest actually provided, potentially leading to excessive host memory consumption. #5818: Enforce the virtio device initialization sequence in the PCI transport, matching the existing MMIO transport behavior. The PCI transpo…
Fixed #5739: Fixed validation of TCP SYN options length when MMDS is enabled.
Added #5510, #5593, #5564: Add support for the VMClock device. The implementation supports the snapshot safety features proposed here, but doesn't provide currently any clock-specific information for helping the guest synchronize its clocks. More information can be found in docs. #5574, #5671, #5674 #5690 Added Intel Granite Rapids as a supported and tested platform for Firecracker on 6.1 host ker…
Fixed #5698: Fixed the possible ENXIO error which could occur during file open operation if the underlying file is FIFO without active readers already attached. #5705: Fixed a bug that caused Firecracker to corrupt the memory files of differential snapshots for VMs with multiple memory slots. This affected VMs using memory hot-plugging or any x86 VMs with a memory size larger than 3GiB.
Started development of v1.16
Changed #5631: Update binary copy process inside Jailer to disallow symlinks and hardlinks at the destination path and change ownership of the copied binary to the specified uid/gid.
Changed #5631: Update binary copy process inside Jailer to disallow symlinks and hardlinks at the destination path and change ownership of the copied binary to the specified uid/gid.