On Thu, Jan 13, 2022, Raghavendra Rao Ananta wrote: > On Thu, Jan 13, 2022 at 9:21 AM Sean Christopherson <seanjc@xxxxxxxxxx> wrote: > > If restricting updates in the arm64 is necessary to ensure KVM provides sane > > behavior, then it could be justified. But if it's purely a sanity check on > > behalf of the guest, then it's not justified. > Agreed that KVM doesn't really safeguard the guests, but just curious, > is there really a downside in adding this thin layer of safety check? It's more stuff that KVM has to maintain, creates an ABI that KVM must adhere to, potentially creates inconsistencies in KVM, and prevents using KVM to intentionally do stupid things to test scenarios that are "impossible". And we also try to avoid defining arbitrary CPU behavior in KVM (that may not be the case here). > On the bright side, the guests would be safe, and it could save the > developers some time in hunting down the bugs in this path, no? Yes, but that can be said for lots and lots of things. This is both a slippery slope argument and the inconsistency argument above, e.g. if KVM actively prevents userspace from doing X, why doesn't KVM prevent userspace from doing Y? Having a decently defined rule for these types of things, e.g. protect KVM/kernel and adhere to the architecture but otherwise let userspace do whatever, avoids spending too much time arguing over what KVM should/shouldn't allow, or wondering why on earth KVM does XYZ, at least in theory :-) There are certainly times where KVM could have saved userspace some pain, but overall I do think KVM is better off staying out of the way when possible.
