add support to control CPU features exposed to user apps #11498
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
75df46d to
0d79d24
Compare
Currently, runsc compares the host feature set between the machine used for checkpointing and the machine used for restoring. If the former feature set is not a subset of the latter, the restore will fail, as user apps might mistakenly use unsupported instructions. Thanks to cpuid faulting support, it is possible to intercept the cpuid instruction from user apps and generate results referring to the host feature set recorded during sandbox boot. This patch adds support to expose only specified CPU features by removing features from the list when storing the host feature set. This makes it possible to checkpoint and restore on machines with different CPU features. The list of enabled features is passed via annotation. It should be noted that currently, CPUID faulting is not supported on the arm64 architecture, and therefore, control over the CPU features exposed to user apps is also not supported. Updates google#11486 Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
0d79d24 to
c482f50
Compare
ayushr2
reviewed
Mar 3, 2025
This patch adds the subcommand cpu-feature, used for retrieving the features supported by the current physical machine's CPU. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
c482f50 to
0b1a0b2
Compare
|
Depends on this patch(#11492) to ensure CPUID faulting on the KVM platform. |
|
Is there anything I can do to help move this pull request forward? |
|
Sorry for the delay @tianyuzhou95. We are a little pre-empted right now but we will eventually get to this. Appreciate the patch! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updates #11486