On Tue, Jun 08, 2021 at 09:56:09AM +0200, Paolo Bonzini wrote:
> > > Alternatively you can add a KVM_DEV_IOASID_{ADD,DEL} pair of ioctls. But it
> > > seems useless complication compared to just using what we have now, at least
> > > while VMs only use IOASIDs via VFIO.
> >
> > The simplest is KVM_ENABLE_WBINVD(<fd security proof>) and be done
> > with it.
>
> The simplest one is KVM_DEV_VFIO_GROUP_ADD/DEL, that already exists and also
> covers hot-unplug. The second simplest one is KVM_DEV_IOASID_ADD/DEL.
This isn't the same thing, this is back to trying to have the kernel
set policy for userspace.
qmeu need to be in direct control of this specific KVM emulation
feature if it is going to support the full range of options.
IMHO obfuscating it with some ADD/DEL doesn't achieve that.
Especially since even today GROUP_ADD/DEL is not just about
controlling wbinvd but also about linking mdevs to the kvm struct - it
is both not optional to call from qemu and triggers behavior that is
against the userspace policy.
This is why I prefer a direct and obvious KVM_ENABLE_WBINVD approach
Jason
