Messages in this thread | | | Date | Wed, 19 Jan 2022 14:42:15 +0800 | Subject | Re: [RFC PATCH v3 04/11] KVM: arm64: Setup a framework for hypercall bitmap firmware registers | From | Jason Wang <> |
| |
在 2022/1/5 上午3:49, Raghavendra Rao Ananta 写道: > KVM regularly introduces new hypercall services to the guests without > any consent from the Virtual Machine Manager (VMM). This means, the > guests can observe hypercall services in and out as they migrate > across various host kernel versions. This could be a major problem > if the guest discovered a hypercall, started using it, and after > getting migrated to an older kernel realizes that it's no longer > available. Depending on how the guest handles the change, there's > a potential chance that the guest would just panic. > > As a result, there's a need for the VMM to elect the services that > it wishes the guest to discover. VMM can elect these services based > on the kernels spread across its (migration) fleet. To remedy this, > extend the existing firmware psuedo-registers, such as > KVM_REG_ARM_PSCI_VERSION, for all the hypercall services available.
Haven't gone through the series but I wonder whether it's better to have a (e)BPF filter for this like seccomp.
Thanks
> > These firmware registers are categorized based on the service call > owners, and unlike the existing firmware psuedo-registers, they hold > the features supported in the form of a bitmap. > > The capability, KVM_CAP_ARM_HVC_FW_REG_BMAP, is used to announce > this extension, which returns the number of psuedo-firmware > registers supported. During the VM initialization, the registers > holds an upper-limit of the features supported by the corresponding > registers. It's expected that the VMMs discover the features > provided by each register via GET_ONE_REG, and writeback the > desired values using SET_ONE_REG. KVM allows this modification > only until the VM has started. > > Older VMMs can simply ignore the capability and the hypercall services > will be exposed unconditionally to the guests, thus ensuring backward > compatibility. > > In this patch, the framework adds the register only for ARM's standard > secure services (owner value 4). Currently, this includes support only > for ARM True Random Number Generator (TRNG) service, with bit-0 of the > register representing mandatory features of v1.0. Other services are > momentarily added in the upcoming patches. > > Signed-off-by: Raghavendra Rao Ananta<rananta@google.com>
| |