vmm: fix kicking vCPU out of KVM_RUN from signal handler

In the common scenario to break the KVM_RUN [0] call to interrupt the vCPU,
KVM enforces for correct behavior that the `immediate_exit` flag [1] is set
by the signal handler on each invocation. As the signal handler runs in the
context of the vCPU thread, we can not use a Mutex for the vCPU structure.

We therefore must write to the structure mutably from the signal handler,
IGNORING ANY USERSPACE LOCKS. Otherwise, we have a deadlock.

This introduces a (very hacky but good enough for a PoC) solution to
this problem.

[0] https://docs.kernel.org/virt/kvm/api.html#kvm-run
[1] https://docs.kernel.org/virt/kvm/api.html#the-kvm-run-structure

Author: phip1611

Cargo.lock

@@ -10,6 +10,8 @@
 //
 //
 
+#[cfg(feature = "kvm")]
+use std::os::fd::RawFd;
 #[cfg(target_arch = "aarch64")]
 use std::sync::Arc;
 
@@ -602,4 +604,6 @@ pub trait Vcpu: Send + Sync {
     /// Trigger NMI interrupt
     ///
     fn nmi(&self) -> Result<()>;
+    #[cfg(feature = "kvm")]
+    unsafe fn get_kvm_vcpu_raw_fd(&self) -> RawFd;
 }

hypervisor/src/cpu.rs

@@ -16,7 +16,7 @@ use std::collections::HashMap;
 use std::fs::File;
 #[cfg(target_arch = "x86_64")]
 use std::os::unix::io::AsRawFd;
-#[cfg(feature = "tdx")]
+#[cfg(any(feature = "tdx", feature = "kvm"))]
 use std::os::unix::io::RawFd;
 use std::result;
 #[cfg(target_arch = "x86_64")]
@@ -1987,7 +1987,8 @@ impl cpu::Vcpu for KvmVcpu {
     /// Triggers the running of the current virtual CPU returning an exit reason.
     ///
     fn run(&self) -> std::result::Result<cpu::VmExit, cpu::HypervisorCpuError> {
-        match self.fd.lock().unwrap().run() {
+        let mut lock = self.fd.lock().unwrap();
+        match lock.run() {
             Ok(run) => match run {
                 #[cfg(target_arch = "x86_64")]
                 VcpuExit::IoIn(addr, data) => {
@@ -2066,7 +2067,11 @@ impl cpu::Vcpu for KvmVcpu {
             },
 
             Err(ref e) => match e.errno() {
-                libc::EAGAIN | libc::EINTR => Ok(cpu::VmExit::Ignore),
+                libc::EINTR => {
+                    lock.set_kvm_immediate_exit(0);
+                    Ok(cpu::VmExit::Ignore)
+                }
+                libc::EAGAIN => Ok(cpu::VmExit::Ignore),
                 _ => Err(cpu::HypervisorCpuError::RunVcpu(anyhow!(
                     "VCPU error {:?}",
                     e
@@ -2769,6 +2774,14 @@ impl cpu::Vcpu for KvmVcpu {
         self.fd.lock().unwrap().set_kvm_immediate_exit(exit.into());
     }
 
+    #[cfg(feature = "kvm")]
+    unsafe fn get_kvm_vcpu_raw_fd(&self) -> RawFd {
+        let kvm_vcpu = self.fd.lock().unwrap();
+        let kvm_vcpu = &*kvm_vcpu;
+        let kvm_vcpu_raw_fd = kvm_vcpu.as_raw_fd();
+        kvm_vcpu_raw_fd
+    }
+
     ///
     /// Returns the details about TDX exit reason
     ///

hypervisor/src/kvm/mod.rs

@@ -52,6 +52,7 @@ linux-loader = { workspace = true, features = ["bzimage", "elf", "pe"] }
 log = "0.4.22"
 # Special fork of micro_http that combines HTTP traffic over a UNIX domain
 # socket with UNIX' SCM_RIGHTS mechanism for transferring file descriptors.
+kvm-bindings = "0.10.0"
 micro_http = { git = "https://github.com/firecracker-microvm/micro-http", branch = "main" }
 mshv-bindings = { workspace = true, features = [
   "fam-wrappers",

vmm/Cargo.toml

@@ -73,6 +73,8 @@ use vm_migration::{
 use vmm_sys_util::eventfd::EventFd;
 use vmm_sys_util::signal::{register_signal_handler, SIGRTMIN};
 use zerocopy::{FromBytes, Immutable, IntoBytes};
+#[cfg(feature = "kvm")]
+use {kvm_bindings::kvm_run, std::os::fd::RawFd, std::sync::RwLock};
 
 #[cfg(all(target_arch = "x86_64", feature = "guest_debug"))]
 use crate::coredump::{
@@ -90,6 +92,18 @@ use crate::vm::physical_bits;
 use crate::vm_config::CpusConfig;
 use crate::{GuestMemoryMmap, CPU_MANAGER_SNAPSHOT_ID};
 
+struct SafeWrapper<T>(T);
+unsafe impl<T> Send for SafeWrapper<T> {}
+unsafe impl<T> Sync for SafeWrapper<T> {}
+
+#[cfg(feature = "kvm")]
+static STATIC_VCPUS: RwLock<Vec<(u8 /* ID*/, SafeWrapper<*mut kvm_run>)>> = RwLock::new(vec![]);
+#[cfg(feature = "kvm")]
+/// Tell signal handler to not access certain stuff anymore during shutdown.
+/// Otherwise => panics.
+/// Better alternative would be to prevent signals.
+pub static IS_IN_SHUTDOWN: AtomicBool = AtomicBool::new(false);
+
 #[cfg(all(target_arch = "aarch64", feature = "guest_debug"))]
 /// Extract the specified bits of a 64-bit integer.
 /// For example, to extrace 2 bits from offset 1 (zero based) of `6u64`,
@@ -487,6 +501,11 @@ impl Vcpu {
             .map_err(Error::VcpuSetGicrBaseAddr)?;
         Ok(())
     }
+
+    #[cfg(feature = "kvm")]
+    pub fn get_kvm_vcpu_raw_fd(&self) -> RawFd {
+        unsafe { self.vcpu.get_kvm_vcpu_raw_fd() }
+    }
 }
 
 impl Pausable for Vcpu {}
@@ -983,6 +1002,31 @@ impl CpuManager {
         vcpu_thread_barrier: Arc<Barrier>,
         inserting: bool,
     ) -> Result<()> {
+        {
+            #[cfg(feature = "kvm")]
+            {
+                let raw_kvm_fd = vcpu.lock().unwrap().get_kvm_vcpu_raw_fd();
+
+                let buffer = unsafe {
+                    libc::mmap(
+                        core::ptr::null_mut(),
+                        4096,
+                        libc::PROT_WRITE | libc::PROT_READ,
+                        libc::MAP_SHARED,
+                        raw_kvm_fd,
+                        0,
+                    )
+                };
+                assert_ne!(buffer, libc::MAP_FAILED);
+
+                let mut vcpus = STATIC_VCPUS.write().unwrap();
+                vcpus.push((
+                    vcpu.lock().unwrap().id,
+                    SafeWrapper(buffer.cast::<kvm_run>()),
+                ));
+            }
+        }
+
         let reset_evt = self.reset_evt.try_clone().unwrap();
         let exit_evt = self.exit_evt.try_clone().unwrap();
         #[cfg(feature = "kvm")]
@@ -1061,7 +1105,44 @@ impl CpuManager {
                             return;
                         }
                     }
+
+                    #[cfg(not(feature = "kvm"))]
                     extern "C" fn handle_signal(_: i32, _: *mut siginfo_t, _: *mut c_void) {}
+                    #[cfg(feature = "kvm")]
+                    extern "C" fn handle_signal(_: i32, _: *mut siginfo_t, _: *mut c_void) {
+                        if IS_IN_SHUTDOWN.load(Ordering::SeqCst) {
+                            let mut lock = STATIC_VCPUS.write().unwrap();
+                            // TODO We should also revert the mmap()
+                            lock.drain(..);
+
+                            // thread::current() panics in shutdown phase, when threadlocal data was
+                            // already destroyed. We should instead prevent delivering signals in
+                            // that step.
+                            return;
+                        }
+
+                        let thread = self::thread::current();
+                        let name = thread.name().unwrap();
+                        let prefix = "vcpu";
+                        let id = &name[prefix.len()..];
+                        let vcpu_id = id.parse::<u8>().unwrap();
+                        let vcpus = STATIC_VCPUS.read().unwrap();
+                        for (vcpu_id_, kvm_run) in &*vcpus {
+                            let kvm_run = kvm_run.0;
+                            if  *vcpu_id_ == vcpu_id {
+                                /*let kvm_run = unsafe {  kvm_run.as_mut() }.unwrap();
+                                kvm_run.immediate_exit = std::hint::black_box(1);*/
+
+                                // Write the second field: immediate exit
+                                let ptr_kvm_run_immediate_exit = unsafe { kvm_run.cast::<u8>().add(1) };
+                                unsafe {
+                                    core::ptr::write_volatile(ptr_kvm_run_immediate_exit, 1);
+                                }
+                            }
+                        }
+                        // TODO ::Release?
+                        std::sync::atomic::fence(Ordering::SeqCst);
+                    }
                     // This uses an async signal safe handler to kill the vcpu handles.
                     register_signal_handler(SIGRTMIN(), handle_signal)
                         .expect("Failed to register vcpu signal handler");

vmm/src/cpu.rs

@@ -46,6 +46,8 @@ use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottabl
 use vmm_sys_util::eventfd::EventFd;
 use vmm_sys_util::signal::unblock_signal;
 use vmm_sys_util::sock_ctrl_msg::ScmSocket;
+#[cfg(feature = "kvm")]
+use {crate::cpu::IS_IN_SHUTDOWN, std::sync::atomic::Ordering};
 
 use crate::api::{
     ApiRequest, ApiResponse, RequestHandler, VmInfoResponse, VmReceiveMigrationData,
@@ -1373,6 +1375,11 @@ impl Vmm {
         vm.release_disk_locks()
             .map_err(|e| MigratableError::UnlockError(anyhow!("{e}")))?;
 
+        #[cfg(feature = "kvm")]
+        // Prevent signal handler to access thread local storage when signals are received
+        // close to the end when thread-local storage is already destroyed.
+        IS_IN_SHUTDOWN.store(true, Ordering::SeqCst);
+
         // Capture snapshot and send it
         let vm_snapshot = vm.snapshot()?;
         let snapshot_data = serde_json::to_vec(&vm_snapshot).unwrap();