feat(isolation,vm): Implement support for Hermit images

This is the Hermit image implementation variant which uses
virtual (in-memory) files on the hypervisor level
(in contrast to the kernel level).

Author: fogti

Cargo.lock

@@ -41,6 +41,7 @@ clap = { version = "4.5", features = ["derive", "env"] }
 clean-path = "0.2.1"
 core_affinity = "0.8"
 env_logger = "0.11"
+flate2 = "1.1"
 gdbstub = "0.7"
 gdbstub_arch = "0.3"
 hermit-abi = "0.5"
@@ -67,6 +68,7 @@ virtio-bindings = "~0.2.7"
 vm-fdt = "0.3"
 vm-memory = { version = "0.18", features = ["backend-mmap"] }
 uuid = { version = "1.21.0", features = ["fast-rng", "v4"]}
+tar-no-std = { version = "0.4", features = ["alloc"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 kvm-bindings = "0.14"

Cargo.toml

@@ -400,7 +400,7 @@ impl<'de> serde::de::Deserialize<'de> for Affinity {
 #[derive(Debug, Default, Deserialize, Merge, Parser)]
 #[cfg_attr(test, derive(PartialEq))]
 struct GuestArgs {
-	/// The kernel to execute
+	/// The kernel or Hermit image to execute
 	#[serde(skip)]
 	#[merge(skip)]
 	kernel: PathBuf,

src/bin/uhyve.rs

@@ -1,4 +1,4 @@
-use std::{ffi::CString, os::unix::ffi::OsStrExt, path::PathBuf};
+use std::{ffi::CString, os::unix::ffi::OsStrExt, path::PathBuf, sync::Arc};
 
 #[cfg(target_os = "linux")]
 use libc::{O_DIRECT, O_SYNC};
@@ -50,6 +50,19 @@ impl From<Option<String>> for UhyveIoMode {
 	}
 }
 
+#[derive(Clone, Debug, thiserror::Error)]
+pub enum HermitImageError {
+	#[error("The Hermit image tar file is corrupted: {0}")]
+	CorruptData(#[from] tar_no_std::CorruptDataError),
+
+	#[error("A file in the Hermit image doesn't have an UTF-8 file name: {0:?}")]
+	// NOTE: `Box`ed to avoid too large size differences between enum entries.
+	NonUtf8Filename(Box<tar_no_std::TarFormatString<256>>),
+
+	#[error("Unable to create a file from the Hermit image in the directory tree: {0:?}")]
+	CreateLeaf(String),
+}
+
 /// Wrapper around a `HashMap` to map guest paths to arbitrary host paths and track file descriptors.
 #[derive(Debug)]
 pub struct UhyveFileMap {
@@ -92,6 +105,28 @@ impl UhyveFileMap {
 		fm
 	}
 
+	/// Adds the contents of a decompressed hermit image to the file map.
+	pub fn add_hermit_image(&mut self, tar_bytes: &[u8]) -> Result<(), HermitImageError> {
+		if tar_bytes.is_empty() {
+			return Ok(());
+		}
+
+		for i in tar_no_std::TarArchiveRef::new(tar_bytes)?.entries() {
+			let filename = i.filename();
+			let filename = filename
+				.as_str()
+				.map_err(|_| HermitImageError::NonUtf8Filename(Box::new(filename)))?;
+			let data: Arc<[u8]> = i.data().to_vec().into();
+
+			// UNWRAP: `tar_no_std::ArchiveEntry::filename` already truncates at the first null byte.
+			if !self.create_leaf(filename, UhyveMapLeaf::Virtual(data)) {
+				return Err(HermitImageError::CreateLeaf(filename.to_string()));
+			}
+		}
+
+		Ok(())
+	}
+
 	/// Returns the host_path on the host filesystem given a requested guest_path, if it exists.
 	///
 	/// * `guest_path` - The guest path that is to be looked up in the map.

src/isolation/filemap/mod.rs

@@ -49,6 +49,24 @@ pub enum HypervisorError {
 	#[error("Invalid kernel path ({0})")]
 	InvalidKernelPath(PathBuf),
 
+	#[error(transparent)]
+	HermitImageError(#[from] crate::isolation::filemap::HermitImageError),
+
+	#[error("Unable to find Hermit image config in archive")]
+	HermitImageConfigNotFound,
+
+	#[error("Unable to parse Hermit image config: {0}")]
+	HermitImageConfigParseError(#[from] toml::de::Error),
+
+	#[error("Insufficient guest memory size: got = {got}, wanted = {wanted}")]
+	InsufficientGuestMemorySize {
+		got: byte_unit::Byte,
+		wanted: byte_unit::Byte,
+	},
+
+	#[error("Insufficient guest CPU count: got = {got}, wanted = {wanted}")]
+	InsufficientGuestCPUs { got: u32, wanted: u32 },
+
 	#[error("Kernel Loading Error: {0}")]
 	LoadedKernelError(#[from] vm::LoadKernelError),
 }

src/lib.rs

@@ -150,7 +150,7 @@ impl FromStr for CpuCount {
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, PartialEq)]
-pub struct GuestMemorySize(Byte);
+pub struct GuestMemorySize(pub(crate) Byte);
 
 impl GuestMemorySize {
 	const fn minimum() -> Byte {
@@ -257,13 +257,13 @@ impl Default for EnvVars {
 		Self::Set(HashMap::new())
 	}
 }
-impl<S: AsRef<str> + std::fmt::Debug + PartialEq<S> + From<&'static str>> TryFrom<&[S]>
+impl<S: AsRef<str> + core::fmt::Debug + PartialEq + PartialEq<&'static str>> TryFrom<&[S]>
 	for EnvVars
 {
 	type Error = &'static str;
 
 	fn try_from(v: &[S]) -> Result<Self, Self::Error> {
-		if v.contains(&S::from("host")) {
+		if v.iter().any(|i| *i == "host") {
 			if v.len() != 1 {
 				warn!(
 					"Specifying -e host discards all other explicitly specified environment vars"

src/params.rs

@@ -1,5 +1,6 @@
 use std::{
 	env, fmt, fs, io,
+	mem::{drop, take},
 	num::NonZero,
 	os::unix::prelude::JoinHandleExt,
 	path::PathBuf,
@@ -10,8 +11,9 @@ use std::{
 
 use core_affinity::CoreId;
 use hermit_entry::{
-	HermitVersion, UhyveIfVersion,
+	Format, HermitVersion, UhyveIfVersion,
 	boot_info::{BootInfo, HardwareInfo, LoadInfo, PlatformInfo, RawBootInfo, SerialPortBase},
+	config, detect_format,
 	elf::{KernelObject, LoadedKernel, ParseKernelError},
 };
 use internal::VirtualizationBackendInternal;
@@ -24,7 +26,7 @@ use crate::{
 	consts::*,
 	fdt::Fdt,
 	generate_address,
-	isolation::filemap::UhyveFileMap,
+	isolation::filemap::{UhyveFileMap, UhyveMapLeaf},
 	mem::MmapMemory,
 	os::KickSignal,
 	params::{EnvVars, Params},
@@ -137,11 +139,126 @@ pub struct UhyveVm<VirtBackend: VirtualizationBackend> {
 	pub(crate) kernel_info: Arc<KernelInfo>,
 }
 impl<VirtBackend: VirtualizationBackend> UhyveVm<VirtBackend> {
-	pub fn new(kernel_path: PathBuf, params: Params) -> HypervisorResult<UhyveVm<VirtBackend>> {
+	pub fn new(kernel_path: PathBuf, mut params: Params) -> HypervisorResult<UhyveVm<VirtBackend>> {
 		let memory_size = params.memory_size.get();
 
-		let elf = fs::read(&kernel_path)
+		let kernel_data = fs::read(&kernel_path)
 			.map_err(|_e| HypervisorError::InvalidKernelPath(kernel_path.clone()))?;
+
+		// TODO: file_mapping not in kernel_info
+		let mut file_mapping = UhyveFileMap::new(
+			&params.file_mapping,
+			params.tempdir.clone(),
+			#[cfg(target_os = "linux")]
+			params.io_mode,
+		);
+
+		// `kernel_data` might be an Hermit image
+		let elf = match detect_format(&kernel_data[..]) {
+			None => return Err(HypervisorError::InvalidKernelPath(kernel_path.clone())),
+			Some(Format::Elf) => kernel_data,
+			Some(Format::Gzip) => {
+				{
+					use io::Read;
+
+					// decompress image
+					let mut buf_decompressed = Vec::new();
+					flate2::bufread::GzDecoder::new(&kernel_data[..])
+						.read_to_end(&mut buf_decompressed)?;
+					drop(kernel_data);
+
+					// insert Hermit image tree into file map
+					file_mapping.add_hermit_image(&buf_decompressed[..])?;
+				}
+
+				// TODO: make `hermit_entry::config::DEFAULT_CONFIG_NAME` public and use that here instead.
+				let config_data = if let Some(UhyveMapLeaf::Virtual(data)) =
+					file_mapping.get_host_path("/hermit.toml")
+				{
+					data
+				} else {
+					return Err(HypervisorError::HermitImageConfigNotFound);
+				};
+
+				let config: config::Config<'_> = toml::from_slice(&config_data[..])?;
+
+				// handle Hermit image configuration
+				match config {
+					config::Config::V1 {
+						mut input,
+						requirements,
+						kernel,
+					} => {
+						// .input
+						if params.kernel_args.is_empty() {
+							params.kernel_args.append(
+								&mut take(&mut input.kernel_args)
+									.into_iter()
+									.map(|i| i.into_owned())
+									.collect(),
+							);
+							if !input.app_args.is_empty() {
+								params.kernel_args.push("--".to_string());
+								params.kernel_args.append(
+									&mut take(&mut input.app_args)
+										.into_iter()
+										.map(|i| i.into_owned())
+										.collect(),
+								)
+							}
+						}
+						debug!("Passing kernel arguments: {:?}", &params.kernel_args);
+
+						// don't pass privileged env-var commands through
+						input.env_vars.retain(|i| i.contains('='));
+
+						if let EnvVars::Set(env) = &mut params.env {
+							if let Ok(EnvVars::Set(prev_env_vars)) =
+								EnvVars::try_from(&input.env_vars[..])
+							{
+								// env vars from params take precedence
+								let new_env_vars = take(env);
+								*env = prev_env_vars.into_iter().chain(new_env_vars).collect();
+							} else {
+								warn!("Unable to parse env vars from Hermit image configuration");
+							}
+						} else if input.env_vars.is_empty() {
+							info!("Ignoring Hermit image env vars due to `-e host`");
+						}
+
+						// .requirements
+
+						// TODO: what about default memory size?
+						if let Some(required_memory_size) = requirements.memory
+							&& params.memory_size.0 < required_memory_size
+						{
+							return Err(HypervisorError::InsufficientGuestMemorySize {
+								got: params.memory_size.0,
+								wanted: required_memory_size,
+							});
+						}
+
+						if params.cpu_count.get() < requirements.cpus {
+							return Err(HypervisorError::InsufficientGuestCPUs {
+								got: params.cpu_count.get(),
+								wanted: requirements.cpus,
+							});
+						}
+
+						// .kernel
+						if let Some(UhyveMapLeaf::Virtual(data)) =
+							file_mapping.get_host_path(&kernel)
+						{
+							data.to_vec()
+						} else {
+							error!("Unable to find kernel in Hermit image");
+							return Err(HypervisorError::InvalidKernelPath(kernel_path.clone()));
+						}
+					}
+				}
+			}
+		};
+
 		let object: KernelObject<'_> =
 			KernelObject::parse(&elf).map_err(LoadKernelError::ParseKernelError)?;
 
@@ -203,13 +320,6 @@ impl<VirtBackend: VirtualizationBackend> UhyveVm<VirtBackend> {
 		#[cfg(not(target_os = "linux"))]
 		let mut mem = MmapMemory::new(memory_size, guest_address, false, false);
 
-		// TODO: file_mapping not in kernel_info
-		let file_mapping = UhyveFileMap::new(
-			&params.file_mapping,
-			params.tempdir.clone(),
-			#[cfg(target_os = "linux")]
-			params.io_mode,
-		);
 		let mounts: Vec<_> = file_mapping.get_all_guest_dirs().collect();
 
 		let serial = UhyveSerial::from_params(&params.output)?;