Date: Mon, 18 Mar 2024 18:15:36 +0000
From: David Woodhouse <dwmw2@...radead.org>
To: Marc Zyngier <maz@...nel.org>
Cc: linux-arm-kernel@...ts.infradead.org, kvm@...r.kernel.org, Paolo Bonzini
 <pbonzini@...hat.com>, Jonathan Corbet <corbet@....net>, Oliver Upton
 <oliver.upton@...ux.dev>, James Morse <james.morse@....com>, Suzuki K
 Poulose <suzuki.poulose@....com>, Zenghui Yu <yuzenghui@...wei.com>,
 Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>,
 Mark Rutland <mark.rutland@....com>, Lorenzo Pieralisi
 <lpieralisi@...nel.org>, "Rafael J. Wysocki" <rafael@...nel.org>, Len Brown
 <len.brown@...el.com>, Pavel Machek <pavel@....cz>, Mostafa Saleh
 <smostafa@...gle.com>, Jean-Philippe Brucker <jean-philippe@...aro.org>, 
 linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
 kvmarm@...ts.linux.dev,  linux-pm@...r.kernel.org
Subject: Re: [RFC PATCH v2 0/4] arm64: Add PSCI v1.3 SYSTEM_OFF2 support for
 hibernation

On Mon, 2024-03-18 at 17:41 +0000, Marc Zyngier wrote:
> On Mon, 18 Mar 2024 17:26:07 +0000,
> David Woodhouse <dwmw2@...radead.org> wrote:
> > 
> > [1  <text/plain; UTF-8 (quoted-printable)>]
> > On Mon, 2024-03-18 at 16:57 +0000, Marc Zyngier wrote:
> > > 
> > > > 
> > > > There *is* a way for a VMM to opt *out* of newer PSCI versions... by 
> > > > setting a per-vCPU "special" register that actually ends up setting the 
> > > > PSCI version KVM-wide. Quite why this isn't just a simple KVM_CAP, I 
> > > > have no idea.
> > > 
> > > Because the expectations are that the VMM can blindly save/restore the
> > > guest's state, including the PSCI version, and restore that blindly.
> > > KVM CAPs are just a really bad design pattern for this sort of things.
> > 
> > Hm, am I missing something here? Does the *guest* get to set the PSCI
> > version somehow, and opt into the latest version that it understands
> > regardless of what the firmware/host can support?
> 
> No. The *VMM* sets the PSCI version by writing to a pseudo register.
> It means that when the guest migrates, the VMM saves and restores that
> version, and the guest doesn't see any change.

And when you boot a guest image which has been working for years under
a new kernel+KVM, your guest suddenly experiences a new PSCI version.
As I said that's not just new optional functions; it's potentially even
returning new error codes to the functions that said guest was already
using.

And when you *hibernate* a guest and then launch it again under a newer
kernel+KVM, it experiences the same incompatibility.

Unless the VMM realises this problem and opts *out* of the newer KVM
behaviour, of course. This is very much unlike how we *normally* expose
new KVM capabilities.

> > I don't think we ever aspired to be able to hand an arbitrary KVM fd to
> > a userspace VMM and have the VMM be able to drive that VM without
> > having any a priori context, did we?
> 
> Arbitrary? No. This is actually very specific and pretty well
> documented.
> 
> Also, to answer your question about why we treat 0.1 differently from
> 0.2+: 0.1 didn't specify the PSCI SMC/HCR encoding, meaning that KVM
> implemented something that was never fully specified. The VMM has to
> provide firmware tables that describe that. With 0.2+, there is a
> standard encoding for all functions, and the VMM doesn't have to
> provide the encoding to the guest.

Gotcha. So for that case we were *forced* to do things correctly and
allow userspace to opt-in to the capability. While for 0.2 onwards we
got away with this awfulness of silently upgrading the version without
VMM consent.

I was hoping to just follow the existing model of SYSTEM_RESET2 and not
have to touch this awfulness with a barge-pole, but sure, whatever you
want.


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5965 bytes)

Powered by blists - more mailing lists