Tags: lastweek/source-firecracker
Tags
Added - Added support for GICv2. Fixed - Fixed CVE-2019-18960 - Fixed a logical error in bounds checking performed on vsock virtio descriptors. - Fixed firecracker-microvm#1283 - Can't start a VM in AARCH64 with vcpus number more than 16. - Fixed firecracker-microvm#1088 - The backtrace are printed on `panic`, no longer causing a seccomp fault. - Fixed firecracker-microvm#1375 - Change logger options type from Value to Vec<LogOption> to prevent potential unwrap on None panics. - Fixed firecracker-microvm#1436 - Raise interrupt for TX queue used descriptors - Fixed firecracker-microvm#1439 - Prevent achieving 100% cpu load when the net device rx is throttled by the ratelimiter - Fixed firecracker-microvm#1437 - Invalid fields in rate limiter related API requests are now failing with a proper error message. - Fixed firecracker-microvm#1316 - correctly determine the size of a virtio device backed by a block device. - Fixed firecracker-microvm#1383 - Log failed api requests. Changed - Decreased release binary size by 10%.
Fixed * Fixed a logical error in bounds checking performed on vsock virtio descriptors (CVE-2019-18960).
Fixed * Fixed a logical error in bounds checking performed on vsock virtio descriptors (CVE-2019-18960).
Added
* New command-line parameter for `firecracker`, named `--no-api`, which
will disable the API server thread. If set, the user won't be able to send
any API requests, neither before, nor after the vm has booted. It must be
paired with `--config-file` parameter. Also, when API server is disabled,
MMDS is no longer available now.
* New command-line parameter for `firecracker`, named `--config-file`, which
represents the path to a file that contains a JSON which can be used for
configuring and starting a microVM without sending any API requests.
* The jailer adheres to the "end of command options" convention, meaning
all parameters specified after `--` are forwarded verbatim to Firecracker.
* Added `KVM_PTP` support to the recommended guest kernel config.
* Added entry in FAQ.md for Firecracker Guest timekeeping.
Changed
* Vsock API call: `PUT /vsocks/{id}` changed to `PUT /vsock` and no longer
appear to support multiple vsock devices. Any subsequent calls to this API
endpoint will override the previous vsock device configuration.
* Removed unused 'Halting' and 'Halted' instance states.
Fixed
* Fixed serial console on aarch64 (GitHub issue firecracker-microvm#1147).
* Upon panic, the terminal is now reset to canonical mode.
* Explicit error upon failure of vsock device creation.
* The failure message returned by an API call is flushed in the log FIFOs.
* Insert virtio devices in the FDT in order of their addresses sorted from
low to high.
* Enforce the maximum length of the network interface name to be 16 chars as
specified in the Linux Kernel.
* Changed the vsock property `id` to `vsock_id` so that the API client can be
successfully generated from the swagger definition.
Added * New device: virtio-vsock, backed by Unix domain sockets (GitHub issue firecracker-microvm#650). See `docs/vsock.md`. Fixed * Updated the documentation for integration tests. * Fixed high CPU usage before guest network interface is brought up (GitHub issue firecracker-microvm#1049). * Fixed an issue that caused the wrong date (month) to appear in the log. * Fixed a bug that caused the seccomp filter to reject legit syscalls in some rare cases (GitHub issue firecracker-microvm#1206). * Docs: updated the production host setup guide. * Docs: updated the rootfs and kernel creation guide. Removed * Removed experimental support for vhost-based vsock devices.
Added * New API call: `PATCH /machine-config/`, used to update VM configuration, before the microVM boots. * Added an experimental swagger definition that includes the specification for the vsock API call. * Added a signal handler for `SIGBUS` and `SIGSEGV` that immediately terminates the process upon intercepting the signal. * Added documentation for signal handling utilities. * Added [alpha] aarch64 support. * Added metrics for successful read and write operations of MMDS, Net and Block devices. Changed * `vcpu_count`, `mem_size_mib` and `ht_enabled` have been changed to be mandatory for `PUT` requests on `/machine-config/`. * Disallow invalid seccomp levels by exiting with error. Fixed * Incorrect handling of bind mounts within the jailed rootfs. * Corrected the guide for `Alpine` guest setup.
Added * Added [alpha] AMD support. * New `devtool` command: `prepare_release`. This updates the Firecracker version, crate dependencies and credits in preparation for a new release. * New `devtool` command: `tag`. This creates a new git tag for the specified release number, based on the changelog contents. * New doc section about building with glibc. Changed * Dropped the JSON-formatted `context` command-line parameter from Firecracker in favor of individual classic command-line parameters. * When running with `jailer` the location of the API socket has changed to `<jail-root-path>/api.socket` (API socket was moved _inside_ the jail). * `PUT` and `PATCH` requests on `/mmds` with data containing any value type other than `String`, `Array`, `Object` will return status code 400. * Improved multiple error messages. * Removed all kernel modules from the recommended kernel config. Fixed * Corrected the seccomp filter when building with glibc. Removed * Removed the `seccomp.bad_syscalls` metric.
Added * New API action: SendCtrlAltDel, used to initiate a graceful shutdown, if the guest has driver support for i8042 and AT Keyboard. See [the docs](docs/api_requests/actions.md#sendctrlaltdel) for details. * New metric counting the number of egress packets with a spoofed MAC: `net.tx_spoofed_mac_count`. * New API call: `PATCH /network-interfaces/`, used to update the rate limiters on a network interface, after the start of a microVM. Changed * Added missing `vmm_version` field to the InstanceInfo API swagger definition, and marked several other mandatory fields as such. * New default command line for guest kernel: `reboot=k panic=1 pci=off nomodules 8250.nr_uarts=0 i8042.noaux i8042.nomux i8042.nopnp i8042.dumbkbd`. Fixed * virtio-blk: VIRTIO_BLK_T_FLUSH now working as expected. * Vsock devices can be attached when starting Firecracker using the jailer. * Vsock devices work properly when seccomp filtering is enabled.
PreviousNext