Route vCPU preemption signals via sigwait thread

[jserv]

elfuse preempted a running vCPU by sending a host signal whose handler called hv_vcpus_exit(): SIGUSR2 for the cross-process guest-signal doorbell and SIGALRM for the per-iteration safety timeout. Because the signal landed on the vCPU thread inside hv_vcpu_run, Apple HVF aborted the run with HV_EXIT_REASON_UNKNOWN instead of the clean CANCELED that hv_vcpus_exit() produces for a vCPU caught between runs, leaving the run loop unable to tell a self-directed preemption from a genuine fault.

Block SIGUSR2 and SIGALRM on the main thread before any vCPU thread is created (proc_preempt_init), so every CLONE_THREAD worker and posix_spawn fork-child inherits the block. A dedicated thread sigwaits both and kicks every live vCPU via thread_interrupt_all() from a thread that never runs one, so hv_vcpu_run always returns CANCELED and the run loop treats any HV_EXIT_REASON_UNKNOWN as a hard hypervisor fault. The g_timed_out and g_external_guest_signal handoff flags become _Atomic with release/acquire ordering now that they cross the preempt-thread to vCPU-thread boundary.

Make a guest thread parked in a blocking host syscall reachable by a signal, which hv_vcpus_exit() alone cannot interrupt:

• attention_raise() pokes the wakeup pipe on every deliverable signal.
• ppoll/pselect/epoll_pwait break out on signal_pending_interruption.
• a blocking pipe/stdio read waits in wait_readable_or_interrupted, which returns EINTR only for a guest-visible delivery, skips O_WRONLY and O_NONBLOCK fds, and uses a bounded 200ms recheck; the non-verbose fast-path read diverts a would-block pipe/stdio read to this slow path.
• fork_child_main creates the wakeup pipe, which it skips via syscall_init.

Make the signal transport race-free: the sender holds flock around its append and the drain holds it across a full read plus ftruncate and no longer unlinks, so a concurrent append is never routed to an orphaned inode. Each process unlinks its own empty file at exit.

signal_pending_interruption() reports whether a guest-visible delivery is pending and excludes ignored and default-ignore signals, so read, poll, select, and epoll no longer wake spuriously on an ignored signal.

Close #77

---

Summary by cubic

Route vCPU preemption (SIGUSR2/SIGALRM) through a dedicated sigwait thread so hv_vcpu_run reliably returns CANCELED on HVF, and expand interruptible blocking I/O so reads, writes, and socket ops wake only for guest-visible signals. Also harden cross-process signal transport and clean up wakeup-pipe handling.

• Bug Fixes
  • Preemption: block SIGUSR2/SIGALRM before any vCPU threads; a sigwait thread sets _Atomic handoff flags and kicks vCPUs; HV_EXIT_REASON_UNKNOWN now indicates a hypervisor fault.
  • Blocking I/O: add per-fd can_block and a shared io_wait_fd_or_interrupted; used by read/write/readv/writev and socket recv/accept/connect/send; the fast-path read/write diverts on would-block or probe error; sends probe with MSG_DONTWAIT and retry on EAGAIN; connect flips nonblocking, waits for POLLOUT, checks SO_ERROR; zero-length iovecs still enforce EBADF; zero-length recvmsg returns immediately.
  • Signals and waits: attention_raise pokes the wakeup pipe; ppoll/pselect/epoll_pwait break only on guest-visible deliveries; ignored/default-ignore signals no longer interrupt; wakeup-pipe init is idempotent with read/drain helpers.
  • Signal transport: sender append and receiver drain are serialized with flock; drain reads fully and ftruncate’s; each process unlinks its empty file at exit.
  • Tests: test-poll covers ignored SIGCHLD and that SA_RESTART read handlers run and unblock recv; test-socket adds zero-length/invalid recvmsg cases; test-readv-writev adds an all-empty-iovec access-check.

^{Written for commit c3de5dc. Summary will update on new commits.}

[Max042004]

below paths not covered

Sockets

• read on a socket fd — excluded by the FD_PIPE || FD_STDIO check
• recv / recvfrom / recvmsg — direct blocking call, src/syscall/net.c:783
• accept / accept4 — src/syscall/net.c:348
• connect — src/syscall/net.c:546
• blocking write / send* on a full buffer (no write-side wait helper exists)

FIFO and pty/character devices (both verified): opened_fd_type()
only tests S_ISDIR (src/syscall/fs.c:50), so these fall into FD_REGULAR
and inherit the regular-file exclusion — but Linux makes reads on them
interruptible. open(O_RDONLY) on a FIFO also blocks in the host open()
itself.

Consequences:

• A guest-level kill cannot reach a process stuck in blocking recv/accept;
  only killing the host process works.
• The classic alarm(n) + blocking read(sock) timeout pattern never fires.
• Ctrl-C is ignored by programs using default-blocking sockets (CPython signal
  handling relies on EINTR per PEP 475; same for nc, blocking DB clients).
• Runtimes using non-blocking fds + epoll/poll (node, Go, nginx) are unaffected,
  and SO_RCVTIMEO passes through (src/syscall/net-abi.c:291), which limits
  the blast radius to default-blocking usage.