UFFD

.cargo/config

@@ -1,6 +1,6 @@
 [build]
-target = "x86_64-unknown-linux-musl"
-target-dir = "build/cargo_target"
+# target = "x86_64-unknown-linux-musl"
+# target-dir = "build/cargo_target"
 
 [net]
 git-fetch-with-cli = true

docs/mmds/mmds-user-guide.md

@@ -249,7 +249,7 @@ The session must start with an HTTP `PUT` request that generates the session tok
 In order to be successful, the request must respect the following constraints:
 
 - must be directed towards `/latest/api/token` path
-- must contain a `X-ametadata-token-ttl-seconds` header specifying the token lifetime
+- must contain a `X-metadata-token-ttl-seconds` header specifying the token lifetime
   in seconds. The value cannot be lower than 1 or greater than 21600 (6 hours).
 - must not contain a `X-Forwarded-For` header.
 

resources/seccomp/aarch64-unknown-linux-musl.json

@@ -596,6 +596,19 @@
                     }
                 ]
             },
+            {
+                "syscall": "msync",
+                "comment": "Used to sync memory from mmap to disk",
+                "args": [
+                    {
+                        "index": 2,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 4,
+                        "comment": "MS_SYNC"
+                    }
+                ]
+            },
             {
                 "syscall": "rt_sigaction",
                 "comment": "rt_sigaction is used by libc::abort during a panic to install the default handler for SIGABRT",

resources/seccomp/x86_64-unknown-linux-musl.json

@@ -248,6 +248,31 @@
                     }
                 ]
             },
+            {
+                "syscall": "msync",
+                "comment": "Used to sync memory from mmap to disk",
+                "args": [
+                    {
+                        "index": 2,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 4,
+                        "comment": "MS_SYNC"
+                    }
+                ]
+            },
+            {
+                "syscall": "memfd_create",
+                "comment": "Used to create a memory backed file descriptor that can be used to save memory to"
+            },
+            {
+                "syscall": "nanosleep",
+                "comment": "Debugging sleep"
+            },
+            {
+                "syscall": "copy_file_range",
+                "comment": "debugging"
+            },
             {
                 "syscall": "rt_sigaction",
                 "comment": "rt_sigaction is used by libc::abort during a panic to install the default handler for SIGABRT",

src/api_server/src/parsed_request.rs

@@ -17,6 +17,7 @@ use crate::request::logger::parse_put_logger;
 use crate::request::machine_configuration::{
     parse_get_machine_config, parse_patch_machine_config, parse_put_machine_config,
 };
+use crate::request::memory_backend::parse_put_memory_backend;
 use crate::request::metrics::parse_put_metrics;
 use crate::request::mmds::{parse_get_mmds, parse_patch_mmds, parse_put_mmds};
 use crate::request::net::{parse_patch_net, parse_put_net};
@@ -112,6 +113,7 @@ impl ParsedRequest {
             (Method::Put, "network-interfaces", Some(body)) => {
                 parse_put_net(body, path_tokens.get(1))
             }
+            (Method::Put, "memory-backend", Some(body)) => parse_put_memory_backend(body),
             (Method::Put, "shutdown-internal", None) => {
                 Ok(ParsedRequest::new(RequestAction::ShutdownInternal))
             }

src/api_server/src/request/memory_backend.rs

@@ -0,0 +1,46 @@
+// Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use super::super::VmmAction;
+use crate::parsed_request::{Error, ParsedRequest};
+use crate::request::Body;
+use logger::{IncMetric, METRICS};
+use vmm::vmm_config::snapshot::MemBackendConfig;
+
+pub(crate) fn parse_put_memory_backend(body: &Body) -> Result<ParsedRequest, Error> {
+    METRICS.put_api_requests.memory_backend_cfg_count.inc();
+    Ok(ParsedRequest::new_sync(VmmAction::SetMemoryBackend(
+        serde_json::from_slice::<MemBackendConfig>(body.raw()).map_err(|e| {
+            METRICS.put_api_requests.memory_backend_cfg_fails.inc();
+            Error::SerdeJson(e)
+        })?,
+    )))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+
+    use vmm::vmm_config::snapshot::MemBackendType;
+
+    use super::*;
+
+    #[test]
+    fn test_parse_memory_backing_file() {
+        assert!(parse_put_memory_backend(&Body::new("invalid_payload")).is_err());
+
+        let body = r#"{
+                "backend_type": "File",
+                "backend_path": "./memory.snap"
+              }"#;
+        let same_body = MemBackendConfig {
+            backend_type: MemBackendType::File,
+            backend_path: PathBuf::from("./memory.snap"),
+        };
+        let result = parse_put_memory_backend(&Body::new(body));
+        assert!(result.is_ok());
+        let parsed_req = result.unwrap_or_else(|_e| panic!("Failed test."));
+
+        assert!(parsed_req == ParsedRequest::new_sync(VmmAction::SetMemoryBackend(same_body)));
+    }
+}

src/api_server/src/request/mod.rs

@@ -8,6 +8,7 @@ pub mod drive;
 pub mod instance_info;
 pub mod logger;
 pub mod machine_configuration;
+pub mod memory_backend;
 pub mod metrics;
 pub mod mmds;
 pub mod net;

src/api_server/swagger/firecracker.yaml

@@ -350,6 +350,29 @@ paths:
           description: Internal server error
           schema:
             $ref: "#/definitions/Error"
+
+  /memory-backend:
+    put:
+      summary: Configures a memory backend to sync the memory changes from during the runtime of the vm
+      operationId: putMemoryBackend
+      parameters:
+        - name: body
+          in: body
+          description: The memory backend to use
+          required: true
+          schema:
+            $ref: "#/definitions/MemoryBackend"
+      responses:
+        204:
+          description: Memory backend configured
+        400:
+          description: Memory backend failed
+          schema:
+            $ref: "#/definitions/Error"
+        default:
+          description: Internal server error.
+          schema:
+            $ref: "#/definitions/Error"
 
   /metrics:
     put:

src/cpuid/src/transformer/amd.rs

@@ -147,6 +147,8 @@ impl CpuidTransformer for AmdCpuidTransformer {
             leaf_0x8000001d::LEAF_NUM => Some(amd::update_extended_cache_topology_entry),
             leaf_0x8000001e::LEAF_NUM => Some(amd::update_extended_apic_id_entry),
             0x8000_0002..=0x8000_0004 => Some(common::update_brand_string_entry),
+            // Disable async PF, as it hangs the VM for some reason when loading from snapshot/uffd.
+            0x4000_0001 => Some(common::disable_kvm_feature_async_pf),
             _ => None,
         }
     }

src/cpuid/src/transformer/common.rs

@@ -69,6 +69,19 @@ pub fn update_brand_string_entry(
     Ok(())
 }
 
+// KVM feature bits
+#[cfg(target_arch = "x86_64")]
+const KVM_FEATURE_ASYNC_PF_INT_BIT: u32 = 14;
+
+pub fn disable_kvm_feature_async_pf(
+    entry: &mut kvm_cpuid_entry2,
+    _vm_spec: &VmSpec,
+) -> Result<(), Error> {
+    entry.eax.write_bit(KVM_FEATURE_ASYNC_PF_INT_BIT, false);
+
+    Ok(())
+}
+
 pub fn update_cache_parameters_entry(
     entry: &mut kvm_cpuid_entry2,
     vm_spec: &VmSpec,

src/cpuid/src/transformer/intel.rs

@@ -126,6 +126,8 @@ impl CpuidTransformer for IntelCpuidTransformer {
             leaf_0xa::LEAF_NUM => Some(intel::update_perf_mon_entry),
             leaf_0xb::LEAF_NUM => Some(intel::update_extended_topology_entry),
             0x8000_0002..=0x8000_0004 => Some(common::update_brand_string_entry),
+            // Disable async PF, as it hangs the VM for some reason when loading from snapshot/uffd.
+            0x4000_0001 => Some(common::disable_kvm_feature_async_pf),
             _ => None,
         }
     }