Tags: saorisakura/firecracker
Tags
Fixed * Adapt T2 and C3 CPU templates for kernel 5.10. Firecracker was not previously masking some CPU features of the host or emulated by KVM, introduced in more recent kernels: `umip`, `vmx`, `avx512_vnni`. * Fixed incorrect propagation of init parameters in kernel commandline. Related to: [firecracker-microvm#2709](firecracker-microvm#2709).
Added * Added devtool build `--ssh-keys` flag to support fetching from private git repositories. * Added option to configure block device flush. * Added `--new-pid-ns` flag to the Jailer in order to spawn the Firecracker process in a new PID namespace. * Added API metrics for `GET`, `PUT` and `PATCH` requests on `/mmds` endpoint. * Added `--describe-snapshot` flag to Firecracker to fetch the data format version of a snapshot state file provided as argument. * Added `--no-seccomp` parameter for disabling the default seccomp filters. * Added `--seccomp-filter` parameter for supplying user-provided, custom filters. * Added the `seccompiler-bin` binary that is used to compile JSON seccomp filters into serialized BPF for Firecracker consumption. * Snapshotting support for GICv2 enabled guests. * Added `devtool install` to deploy built binaries in `/usr/local/bin` or a given path. * Added code logic to send `VIRTIO_VSOCK_EVENT_TRANSPORT_RESET` on snapshot creation, when the Vsock device is active. The event will close active connections on the guest. * Added `GET` request on `/vm/config` that provides full microVM configuration as a JSON HTTP response. * Added `--resource-limit` flag to jailer to limit resources such as: number of file descriptors allowed at a time (with a default value of 2048) and maximum size of files created by the process. Changed * Changed Docker images repository from DockerHub to Amazon ECR. * Fixed off-by-one error in virtio-block descriptor address validation. * Changed the `PATCH` request on `/balloon/statistics` to schedule the first statistics update immediately after processing the request. * Deprecated the `--seccomp-level parameter`. It will be removed in a future release. Using it logs a runtime warning. * Experimental gnu libc builds use empty default seccomp filters, allowing all system calls. Fixed * Fixed non-compliant check for the RTC device ensuring a fixed 4-sized data buffer. * Unnecessary interrupt assertion was removed from the RTC. However, a dummy interrupt is still allocated for snapshot compatibility reasons. * Fixed the SIGPIPE signal handler so Firecracker no longer exits. The signal is still recorded in metrics and logs. * Fixed ballooning API definitions by renaming all fields which mentioned "MB" to use "MiB" instead. * Snapshot related host files (vm-state, memory, block backing files) are now flushed to their backing mediums as part of the CreateSnapshot operation. * Fixed the SSBD mitigation not being enabled on `aarch64` with the provided `prod-host-setup.md`. * Fixed the balloon statistics not working after a snapshot restore event. * The `utc_timestamp_ms` now reports the timestamp in ms from the UTC UNIX Epoch, as the name suggests. It was previously using a monotonic clock with an undefined starting point.
Changed * Changed Docker images repository from DockerHub to Amazon ECR. Fixed * Snapshot related host files (vm-state, memory, block backing files) are now flushed to their backing mediums as part of the CreateSnapshot operation. * Fixed race between vcpu initialization and emulation thread which could potentially lead to segmentation faults. * Fixed the SSBD mitigation not being enabled on `aarch64` with the provided `prod-host-setup.md`, by force-enabling it.
PreviousNext