Skip to content

Conversation

@olivereanderson
Copy link

@olivereanderson olivereanderson commented Dec 11, 2025

This is the second PR in the CPU profiles series.

In this PR we introduce CPUID definitions describing the values within registers modified by the CPUID instruction. We write out an (almost) complete table of such descriptions of Intel CPUs and also for the KVM hypervisor.

These tables will be utilized by the upcoming CPU profile generation tool, but we also utilize the Intel table already in this PR in order to give more detailed logs when CPUID compatibility checks fail.

This PR depends on #50. A diff view between the two can be found here: olivereanderson/cloud-hypervisor@olivereanderson:cloud-hypervisor:cpu-profiles-cpuid...cpuid-definitions

Outlook

We also want to support generating CPU profiles for AMD CPUs, but we do not have the time to do that right now.
If someone else wants to pick that up (before we do) then we suggest creating separate CPUID definitions for AMD
even though maybe 80% or more of the tables will coincide.

dependabot bot and others added 30 commits July 29, 2025 03:50
Bumps [r-efi](https://github.com/r-efi/r-efi) from 5.2.0 to 5.3.0.
- [Release notes](https://github.com/r-efi/r-efi/releases)
- [Changelog](https://github.com/r-efi/r-efi/blob/main/NEWS.md)
- [Commits](r-efi/r-efi@v5.2.0...v5.3.0)

---
updated-dependencies:
- dependency-name: r-efi
  dependency-version: 5.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [toml_datetime](https://github.com/toml-rs/toml) from 0.6.8 to 0.6.11.
- [Commits](toml-rs/toml@toml_datetime-v0.6.8...toml_datetime-v0.6.11)

---
updated-dependencies:
- dependency-name: toml_datetime
  dependency-version: 0.6.11
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
In case of CVM guest rsdp is set to none. Unwrapping it
make the vmm crashed. Don't call configure system if the
rsdb address is none.

Signed-off-by: Muminul Islam <[email protected]>
Bumps [anstream](https://github.com/rust-cli/anstyle) from 0.6.15 to 0.6.19.
- [Commits](rust-cli/anstyle@anstream-v0.6.15...anstream-v0.6.19)

---
updated-dependencies:
- dependency-name: anstream
  dependency-version: 0.6.19
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Optimize lychee workflow to check only changed
files in pull requests, avoiding excessive API
calls to prevent rate limits.

Fixes cloud-hypervisor#7056

Signed-off-by: Shubham Chakrawar <[email protected]>
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 40 to 46.
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](tj-actions/changed-files@v40...v46)

---
updated-dependencies:
- dependency-name: tj-actions/changed-files
  dependency-version: '46'
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.94 to 1.0.98.
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.94...1.0.98)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.98
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [async-process](https://github.com/smol-rs/async-process) from 2.3.0 to 2.4.0.
- [Release notes](https://github.com/smol-rs/async-process/releases)
- [Changelog](https://github.com/smol-rs/async-process/blob/master/CHANGELOG.md)
- [Commits](smol-rs/async-process@v2.3.0...v2.4.0)

---
updated-dependencies:
- dependency-name: async-process
  dependency-version: 2.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [landlock](https://github.com/landlock-lsm/rust-landlock) from 0.4.0 to 0.4.2.
- [Release notes](https://github.com/landlock-lsm/rust-landlock/releases)
- [Changelog](https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md)
- [Commits](landlock-lsm/rust-landlock@v0.4.0...v0.4.2)

---
updated-dependencies:
- dependency-name: landlock
  dependency-version: 0.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [rustc-demangle](https://github.com/rust-lang/rustc-demangle) from 0.1.24 to 0.1.26.
- [Release notes](https://github.com/rust-lang/rustc-demangle/releases)
- [Changelog](https://github.com/rust-lang/rustc-demangle/blob/main/CHANGELOG.md)
- [Commits](rust-lang/rustc-demangle@0.1.24...rustc-demangle-v0.1.26)

---
updated-dependencies:
- dependency-name: rustc-demangle
  dependency-version: 0.1.26
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.34.0 to 1.35.1.
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@v1.34.0...v1.35.1)

---
updated-dependencies:
- dependency-name: crate-ci/typos
  dependency-version: 1.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [rand](https://github.com/rust-random/rand) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@rand_core-0.9.1...rand_core-0.9.2)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.9.2
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Now 'create_acpi_tables_internal()' can generate ACPI tables with
different dsdt offset, so that it can be reused for generating ACPI
tables for `fw_cfg`.

Signed-off-by: Bo Chen <[email protected]>
Signed-off-by: Alex Orozco <[email protected]>
When generating ACPI tables, we are not using "offset", instead we
are using (guest physical) addresses.

Signed-off-by: Bo Chen <[email protected]>
Fix clippy error: "error: manual implementation of `.is_multiple_of()
`" from rustc 1.90.0-beta.1 (788da80fc 2025-08-04).

Signed-off-by: Songqian Li <[email protected]>
rustc 1.90.0-beta.1 (788da80fc 2025-08-04) suggests using library
feature `unsigned_is_multiple_of`. It is stabled in Rust 1.87.0.

Update image to 20250807-0 since MSRV in Dockerfile is updated.

Signed-off-by: Songqian Li <[email protected]>
Signed-off-by: Bo Chen <[email protected]>
Replacing pdf link with new available link to fix the failed CI.

Signed-off-by: Songqian Li <[email protected]>
Bumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.35.1 to 1.35.2.
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@v1.35.1...v1.35.2)

---
updated-dependencies:
- dependency-name: crate-ci/typos
  dependency-version: 1.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps redox_users from 0.5.0 to 0.5.2.

---
updated-dependencies:
- dependency-name: redox_users
  dependency-version: 0.5.2
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.35.2 to 1.35.3.
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@v1.35.2...v1.35.3)

---
updated-dependencies:
- dependency-name: crate-ci/typos
  dependency-version: 1.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [async-trait](https://github.com/dtolnay/async-trait) from 0.1.86 to 0.1.88.
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.86...0.1.88)

---
updated-dependencies:
- dependency-name: async-trait
  dependency-version: 0.1.88
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Link checker excludes checks on local links and links with variables.

Signed-off-by: Songqian Li <[email protected]>
### Errors in src/main.rs

* [404] <https://github.com/cloud-hypervisor/cloud-hypervisor/issues/new
/n> | Rejected status code (this depends on your "accept" configuration)
: Not Found

Signed-off-by: Songqian Li <[email protected]>
The option parser did not allow quoting any special characters, which
means that some strings could not be passed via command-line options.
Fix this by allowing double quotes to quote all the special characters,
such as '@', ',', '[', and ']'.  '"' can be escaped by doubling it.  The
implementation uses some tricks to stay modular.

Signed-off-by: Demi Marie Obenour <[email protected]>
Set UEFI_START and UEFI_SIZE for riscv64 layout.

Signed-off-by: Ruoqing He <[email protected]>
Provide Error definitions and load_uefi to be referenced while loading
firmware.

Signed-off-by: Ruoqing He <[email protected]>
uefi_flash field in memory_manager is required for uefi loading and
booting, enable it for riscv64 architecture.

Signed-off-by: Ruoqing He <[email protected]>
Error::UefiLoad is required for load_firmware to propagate errors
encountered, define it for riscv64.

Signed-off-by: Ruoqing He <[email protected]>
Implement firmware boot (UEFI boot) for riscv64 architecture.

Signed-off-by: Ruoqing He <[email protected]>
olivereanderson and others added 29 commits December 3, 2025 11:45
As we have replaced all KVM_GET_XSAVE calls with KVM_GET_XSAVE2
we need to update the seccomp filters accordingly.

Signed-Off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
Virtio PCI devices are created in a set of nested functions. In each
of this function a vector is created to add created devices to, only
to be appended to the vector of the higher nesting level. Those nested
vectors are unnecessary as we can directly write to the member of.

Signed-off-by: Pascal Scholz <[email protected]>
On-behalf-of: SAP [email protected]
Allocating a device ID is crucial for assigning a specific ID to a
device. We need this to implement configurable PCI BDF.

Signed-off-by: Pascal Scholz <[email protected]>
On-behalf-of: SAP [email protected]
Next to tests for `allocate_device_bdf`, we introduce a new constructor
`new_without_address_manager`, only available in the test build. As
there is no way to instantiate an `AddressManager` in the tests, we use
this constructor to work around this.

Signed-off-by: Pascal Scholz <[email protected]>
On-behalf-of: SAP [email protected]
Updates all config structs in order to make the new config option
available to all PCI device. Additionally update the parser so the new
option becomes available on the CLI.

Signed-off-by: Pascal Scholz <[email protected]>
On-behalf-of: SAP [email protected]
We use `VecDeque` to sort devices implicitly. Devices whose config
contains a fixed BDF are added to the front, while those without a BDF
given are added to the back. Processing the `VecDeque` sequentially
from first to last then ensures that no clashes occur when assigning
BDFs to devices. Otherwise, we could end up in the case that we assigned
a BDF required by one device's config to one without a BDF.

Signed-off-by: Pascal Scholz <[email protected]>
On-behalf-of: SAP [email protected]
TLS connections have a TLS server (the endpoint that listens for a
connection) and a TLS client (the endpoint that initiates the
connection). This commit adds the code for the client side, which will
be the source host.

On-behalf-of: SAP [email protected]
Signed-off-by: Sebastian Eydam <[email protected]>
This is the TLS server side, which will be the live migration target.

On-behalf-of: SAP [email protected]
Signed-off-by: Sebastian Eydam <[email protected]>
This allows (more or less) transparent usage of TLS encrypted TCP
connections.

On-behalf-of: SAP [email protected]
Signed-off-by: Sebastian Eydam <[email protected]>
For TLS we need certificates (and a key for the TLS server). This
commits adds parameters for that and encrypts the connection with TLS if
the necessary parameters are provided.

On-behalf-of: SAP [email protected]
Signed-off-by: Sebastian Eydam <[email protected]>
The ReadVolatile and WriteVolatile implementations of TlsStream were
very slow, mainly because they allocated a large buffer on each
invocation. The TlsStreamWrapper carries a buffer that it uses for
ReadVolatile and WriteVolatile and that is allocated once on creation.

On-behalf-of: SAP [email protected]
Signed-off-by: Sebastian Eydam <[email protected]>
When using multiple tcp connections during live migration, the main
thread spawns multiple worker threads to send data. When one of those
workers encountered an error, the VMM would panic. With these changes
worker threads will report errors to the main thread which can then stop
the live migration without panicking.

On-behalf-of: SAP [email protected]
Signed-off-by: Sebastian Eydam <[email protected]>
This was missing. We tried to access the option from the parsed args but
it is not yet known to clap that clap should parse these options.

Follow-up of d5e345b.

Signed-off-by: Philipp Schuster <[email protected]>
On-behalf-of: SAP [email protected]
Rename to the same name that the argument parser uses. This is also
consistent with the rest of the CLI, where underscores are unusual.

Signed-off-by: Philipp Schuster <[email protected]>
On-behalf-of: SAP [email protected]
Since enabling AMX tile state components affect the result returned by
`Hypervisor::get_supported_cpuid` we want this enabled prior to checking
CPUID compatibility between the source and destination VMs.

Although this is not required today, it is necessary in order for the
upcoming CPU profiles correctly, and it will also be necessary once the
check_cpuid_compatibility checks are extended to take state components
into account.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
Temporary workaround until we switch over to the WIP fix upstream

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
These data structures are required to define CPU profiles.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We want CPU profiles to keep a record of the hypervisor type and
cpu vendor that they are intended to work with. This is made more
convenient if all of these types implement common traits (used for
serialization).

Signed-Off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We introduce essential data structures together with basic
functionality that is necessary to apply a CPU profile to a host.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We integrate the CPU profile into the various configs that
ultimately get set by the user.

This quickly ends up involving multiple files, luckily Rust
helps us find which ones via compilation errors.

Signed-Off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
If a CPU profile is configured it should result in guests seeing
a restricted subset of CPUID. This is what we finally achieve in
this commit.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We include CPU profiles corresponding to Intel Skylake and Sapphire
rapids server that we generated using our WIP CPU profile generation
tool.

Signed-of-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We introduce data structures to describe values within the registers
modified by the CPUID instruction. These data structures will later be
used by the upcoming CPU profile generation tool.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We introduce CPUID definitions for Intel CPUs that will be utilized by
the upcoming CPU Profile generation tool.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We introduce CPUID definitions defined for the KVM hypervisor. These
definitions will later be utilized by the upcoming CPU profile
generation tool.

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
We use the Intel CPUID definitions to provide more information when
CPUID compatibility checks fail (when both the source and destination
VM run on Intel CPUs).

Signed-off-by: Oliver Anderson <[email protected]>
On-behalf-of: SAP [email protected]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.