Try firecracker-microvm/firecracker#1586

Signed-off-by: Kazuyoshi Kato <[email protected]>

Author: kzys

Makefile

@@ -290,6 +290,7 @@ tools/firecracker-builder-stamp: tools/docker/Dockerfile.firecracker-builder
 	touch $@
 
 $(FIRECRACKER_BIN) $(JAILER_BIN): $(FIRECRACKER_DIR)/Cargo.toml tools/firecracker-builder-stamp
+	(cd $(FIRECRACKER_DIR) && patch -p1 < $(CURDIR)/seccomp.patch)
 	docker run --rm -it --user $(UID) \
 		--volume $(CURDIR)/$(FIRECRACKER_DIR):/src \
 		--volume $(CARGO_CACHE_VOLUME_NAME):/usr/local/cargo/registry \

seccomp.patch

@@ -0,0 +1,42 @@
+diff --git a/src/vmm/src/vstate.rs b/src/vmm/src/vstate.rs
+index f49d1e53..7dd8d700 100644
+--- a/src/vmm/src/vstate.rs
++++ b/src/vmm/src/vstate.rs
+@@ -792,8 +792,10 @@ impl Vcpu {
+                 error!("Failed signaling vcpu exit event: {}", e);
+             }
+         }
+-        // State machine reached its end.
+-        StateMachine::finish(Self::exited)
++        // State machine reached its end, but move to 'paused' state
++        // to keep the thread, since thread cleanup on libc may call
++        // syscalls which we don't want to whitelist (#1456)
++        StateMachine::next(Self::paused)
+     }
+ }
+ 
+@@ -1245,13 +1247,17 @@ mod tests {
+         // Stop it by sending exit.
+         assert!(vcpu_handle.send_event(VcpuEvent::Exit).is_ok());
+ 
+-        // Validate vCPU thread ends execution.
+-        vcpu_handle
+-            .join_vcpu_thread()
+-            .expect("failed to join thread");
+-
+-        // Validate that the vCPU signaled its exit.
+-        assert_eq!(vcpu_exit_evt.read().unwrap(), 1);
++        // Sending exit won't stop the thread.
++        // Instead of waiting the completion of the thread, we need to poll the fd.
++        for _i in 0..10 {
++            match vcpu_exit_evt.read() {
++                Ok(x) => assert_eq!(x, 1),
++                Err(e) if e.kind() == io::ErrorKind::WouldBlock => {
++                    thread::sleep(Duration::from_millis(100))
++                }
++                Err(e) => panic!("failed to read the exit event: {}", e),
++            }
++        }
+     }
+ 
+     #[test]