build: Release 20.2 (bug fix release)

Signed-off-by: Rob Bradford <robert.bradford@intel.com>

Cargo.lock

@@ -186,7 +186,7 @@ dependencies = [
 
 [[package]]
 name = "cloud-hypervisor"
-version = "20.0.0"
+version = "20.2.0"
 dependencies = [
  "anyhow",
  "api_client",
@@ -464,8 +464,7 @@ dependencies = [
 [[package]]
 name = "kvm-ioctls"
 version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
+source = "git+https://github.com/rust-vmm/kvm-ioctls?branch=main#d22ef1f51852dfb055da38004e1a4fed81246f81"
-checksum = "97422ba48d7ffb66fd4d18130f72ab66f9bbbf791fb7a87b9291cdcfec437593"
 dependencies = [
  "kvm-bindings",
  "libc",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cloud-hypervisor"
-version = "20.0.0"
+version = "20.2.0"
 authors = ["The Cloud Hypervisor Authors"]
 edition = "2018"
 default-run = "cloud-hypervisor"
@@ -36,6 +36,7 @@ clap = { version = "2.34.0", features = ["wrap_help"] }
 # List of patched crates
 [patch.crates-io]
 kvm-bindings = { git = "https://github.com/cloud-hypervisor/kvm-bindings", branch = "ch-v0.5.0", features = ["with-serde", "fam-wrappers"] }
+kvm-ioctls = { git = "https://github.com/rust-vmm/kvm-ioctls", branch = "main" }
 versionize_derive = { git = "https://github.com/cloud-hypervisor/versionize_derive", branch = "ch" }
 
 [dev-dependencies]

arch/src/aarch64/layout.rs

@@ -82,6 +82,8 @@ pub const MEM_32BIT_DEVICES_SIZE: u64 = 0x2000_0000;
 /// PCI MMCONFIG space (start: after the device space at 1 GiB, length: 256MiB)
 pub const PCI_MMCONFIG_START: GuestAddress = GuestAddress(0x3000_0000);
 pub const PCI_MMCONFIG_SIZE: u64 = 256 << 20;
+// One bus with potentially 256 devices (32 slots x 8 functions).
+pub const PCI_MMIO_CONFIG_SIZE_PER_SEGMENT: u64 = 4096 * 256;
 
 /// Start of RAM on 64 bit ARM.
 pub const RAM_64BIT_START: u64 = 0x4000_0000;

arch/src/x86_64/layout.rs

@@ -93,6 +93,16 @@ pub const MEM_32BIT_DEVICES_SIZE: u64 = 640 << 20;
 pub const PCI_MMCONFIG_START: GuestAddress =
     GuestAddress(MEM_32BIT_DEVICES_START.0 + MEM_32BIT_DEVICES_SIZE);
 pub const PCI_MMCONFIG_SIZE: u64 = 256 << 20;
+// One bus with potentially 256 devices (32 slots x 8 functions).
+pub const PCI_MMIO_CONFIG_SIZE_PER_SEGMENT: u64 = 4096 * 256;
+
+// TSS is 3 pages after the PCI MMCONFIG space
+pub const KVM_TSS_START: GuestAddress = GuestAddress(PCI_MMCONFIG_START.0 + PCI_MMCONFIG_SIZE);
+pub const KVM_TSS_SIZE: u64 = (3 * 4) << 10;
+
+// Identity map is a one page region after the TSS
+pub const KVM_IDENTITY_MAP_START: GuestAddress = GuestAddress(KVM_TSS_START.0 + KVM_TSS_SIZE);
+pub const KVM_IDENTITY_MAP_SIZE: u64 = 4 << 10;
 
 // IOAPIC
 pub const IOAPIC_START: GuestAddress = GuestAddress(0xfec0_0000);
@@ -101,9 +111,6 @@ pub const IOAPIC_SIZE: u64 = 0x20;
 // APIC
 pub const APIC_START: GuestAddress = GuestAddress(0xfee0_0000);
 
-/// Address for the TSS setup.
-pub const KVM_TSS_ADDRESS: GuestAddress = GuestAddress(0xfffb_d000);
-
 // == End of "32-bit reserved" range. ==
 
 // ** 64-bit RAM start (start: 4GiB, length: varies) **

fuzz/Cargo.lock

@@ -147,7 +147,7 @@ dependencies = [
 
 [[package]]
 name = "cloud-hypervisor"
-version = "19.0.0"
+version = "20.0.0"
 dependencies = [
  "anyhow",
  "api_client",
@@ -324,8 +324,7 @@ dependencies = [
 [[package]]
 name = "kvm-ioctls"
 version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
+source = "git+https://github.com/rust-vmm/kvm-ioctls?branch=main#d22ef1f51852dfb055da38004e1a4fed81246f81"
-checksum = "97422ba48d7ffb66fd4d18130f72ab66f9bbbf791fb7a87b9291cdcfec437593"
 dependencies = [
  "kvm-bindings",
  "libc",

fuzz/Cargo.toml

@@ -26,6 +26,7 @@ path = ".."
 
 [patch.crates-io]
 kvm-bindings = { git = "https://github.com/cloud-hypervisor/kvm-bindings", branch = "ch-v0.5.0", features = ["with-serde", "fam-wrappers"] }
+kvm-ioctls = { git = "https://github.com/rust-vmm/kvm-ioctls", branch = "main" }
 versionize_derive = { git = "https://github.com/cloud-hypervisor/versionize_derive", branch = "ch" }
 
 # Prevent this from interfering with workspaces

hypervisor/src/kvm/mod.rs

@@ -32,8 +32,6 @@ use std::result;
 #[cfg(target_arch = "x86_64")]
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, RwLock};
-#[cfg(target_arch = "x86_64")]
-use vm_memory::Address;
 use vmm_sys_util::eventfd::EventFd;
 // x86_64 dependencies
 #[cfg(target_arch = "x86_64")]
@@ -47,9 +45,7 @@ use kvm_bindings::{
     kvm_enable_cap, kvm_msr_entry, MsrList, KVM_CAP_HYPERV_SYNIC, KVM_CAP_SPLIT_IRQCHIP,
 };
 #[cfg(target_arch = "x86_64")]
-use x86_64::{
+use x86_64::{check_required_kvm_extensions, FpuState, SpecialRegisters, StandardRegisters};
-    check_required_kvm_extensions, FpuState, SpecialRegisters, StandardRegisters, KVM_TSS_ADDRESS,
-};
 #[cfg(target_arch = "x86_64")]
 pub use x86_64::{
     CpuId, CpuIdEntry, ExtendedControlRegisters, LapicState, MsrEntries, VcpuKvmState as CpuState,
@@ -139,6 +135,15 @@ pub struct KvmVm {
 /// vm.set/get().unwrap()
 ///
 impl vm::Vm for KvmVm {
+    #[cfg(target_arch = "x86_64")]
+    ///
+    /// Sets the address of the one-page region in the VM's address space.
+    ///
+    fn set_identity_map_address(&self, address: u64) -> vm::Result<()> {
+        self.fd
+            .set_identity_map_address(address)
+            .map_err(|e| vm::HypervisorVmError::SetIdentityMapAddress(e.into()))
+    }
     #[cfg(target_arch = "x86_64")]
     ///
     /// Sets the address of the three-page region in the VM's address space.
@@ -353,10 +358,6 @@ impl vm::Vm for KvmVm {
     }
     #[cfg(target_arch = "x86_64")]
     fn enable_split_irq(&self) -> vm::Result<()> {
-        // Set TSS
-        self.fd
-            .set_tss_address(KVM_TSS_ADDRESS.raw_value() as usize)
-            .map_err(|e| vm::HypervisorVmError::EnableSplitIrq(e.into()))?;
         // Create split irqchip
         // Only the local APIC is emulated in kernel, both PICs and IOAPIC
         // are not.

hypervisor/src/kvm/x86_64/mod.rs

@@ -11,7 +11,6 @@
 use crate::arch::x86::{msr_index, SegmentRegisterOps, MTRR_ENABLE, MTRR_MEM_TYPE_WB};
 use crate::kvm::{Cap, Kvm, KvmError, KvmResult};
 use serde_derive::{Deserialize, Serialize};
-use vm_memory::GuestAddress;
 
 ///
 /// Export generically-named wrappers of kvm-bindings for Unix-based platforms
@@ -92,8 +91,6 @@ impl SegmentRegisterOps for SegmentRegister {
     }
 }
 
-pub const KVM_TSS_ADDRESS: GuestAddress = GuestAddress(0xfffb_d000);
-
 pub fn boot_msr_entries() -> MsrEntries {
     MsrEntries::from_entries(&[
         msr!(msr_index::MSR_IA32_SYSENTER_CS),
@@ -127,6 +124,12 @@ pub fn check_required_kvm_extensions(kvm: &Kvm) -> KvmResult<()> {
     if !kvm.check_extension(Cap::SplitIrqchip) {
         return Err(KvmError::CapabilityMissing(Cap::SplitIrqchip));
     }
+    if !kvm.check_extension(Cap::SetIdentityMapAddr) {
+        return Err(KvmError::CapabilityMissing(Cap::SetIdentityMapAddr));
+    }
+    if !kvm.check_extension(Cap::SetTssAddr) {
+        return Err(KvmError::CapabilityMissing(Cap::SetTssAddr));
+    }
     Ok(())
 }
 #[derive(Clone, Serialize, Deserialize)]

hypervisor/src/mshv/mod.rs

@@ -764,6 +764,13 @@ fn hv_state_init() -> Arc<RwLock<HvState>> {
 /// vm.set/get().unwrap()
 ///
 impl vm::Vm for MshvVm {
+    #[cfg(target_arch = "x86_64")]
+    ///
+    /// Sets the address of the one-page region in the VM's address space.
+    ///
+    fn set_identity_map_address(&self, _address: u64) -> vm::Result<()> {
+        Ok(())
+    }
     #[cfg(target_arch = "x86_64")]
     ///
     /// Sets the address of the three-page region in the VM's address space.

hypervisor/src/vm.rs

@@ -58,6 +58,11 @@ pub enum HypervisorVmError {
     #[error("Failed to create Vcpu: {0}")]
     CreateVcpu(#[source] anyhow::Error),
     ///
+    /// Identity map address error
+    ///
+    #[error("Failed to set identity map address: {0}")]
+    SetIdentityMapAddress(#[source] anyhow::Error),
+    ///
     /// TSS address error
     ///
     #[error("Failed to set TSS address: {0}")]
@@ -217,6 +222,9 @@ pub type Result<T> = std::result::Result<T, HypervisorVmError>;
 /// This crate provides a hypervisor-agnostic interfaces for Vm
 ///
 pub trait Vm: Send + Sync {
+    #[cfg(target_arch = "x86_64")]
+    /// Sets the address of the one-page region in the VM's address space.
+    fn set_identity_map_address(&self, address: u64) -> Result<()>;
     #[cfg(target_arch = "x86_64")]
     /// Sets the address of the three-page region in the VM's address space.
     fn set_tss_address(&self, offset: usize) -> Result<()>;

pci/src/vfio_user.rs

@@ -326,17 +326,33 @@ impl Vfio for VfioUserClientWrapper {
         );
         let fds: Vec<i32> = event_fds.iter().map(|e| e.as_raw_fd()).collect();
 
-        self.client
+        // Batch into blocks of 16 fds as sendmsg() has a size limit
-            .lock()
+        let mut sent_fds = 0;
-            .unwrap()
+        let num_fds = event_fds.len() as u32;
-            .set_irqs(
+        while sent_fds < num_fds {
-                irq_index,
+            let remaining_fds = num_fds - sent_fds;
-                VFIO_IRQ_SET_DATA_EVENTFD | VFIO_IRQ_SET_ACTION_TRIGGER,
+            let count = if remaining_fds > 16 {
-                0,
+                16
-                event_fds.len() as u32,
+            } else {
-                &fds,
+                remaining_fds
-            )
+            };
-            .map_err(VfioError::VfioUser)
+
+            self.client
+                .lock()
+                .unwrap()
+                .set_irqs(
+                    irq_index,
+                    VFIO_IRQ_SET_DATA_EVENTFD | VFIO_IRQ_SET_ACTION_TRIGGER,
+                    sent_fds,
+                    count,
+                    &fds[sent_fds as usize..(sent_fds + count) as usize],
+                )
+                .map_err(VfioError::VfioUser)?;
+
+            sent_fds += count;
+        }
+
+        Ok(())
     }
 
     fn disable_irq(&self, irq_index: u32) -> Result<(), VfioError> {

release-notes.md

@@ -1,3 +1,5 @@
+- [v20.2](#v202)
+- [v20.1](#v201)
 - [v20.0](#v200)
     - [Multiple PCI segments support](#multiple-pci-segments-support)
     - [CPU pinning](#cpu-pinning)
@@ -176,6 +178,28 @@
     - [Unit testing](#unit-testing)
     - [Integration tests parallelization](#integration-tests-parallelization)
 
+
+# v20.2
+
+This is a bug fix release. The following issues have been addressed:
+
+* Don't error out when setting up the SIGWINCH handler (for console resize)
+  when this fails due to older kernel (#3456)
+* Seccomp rules were refined to remove syscalls that are now unused
+* Fix reboot on older host kernels when SIGWINCH handler was not initialised
+  (#3496)
+* Fix virtio-vsock blocking issue (#3497)
+
+# v20.1
+
+This is a bug fix release. The following issues have been addressed:
+
+* Networking performance regression with `virtio-net` (#3450)
+* Limit file descriptors sent in `vfio-user` support (#3401)
+* Fully advertise PCI MMIO config regions in ACPI tables (#3432)
+* Set the TSS and KVM identity maps so they don't overlap with firmware RAM
+* Correctly update the `DeviceTree` on restore
+
 # v20.0
 
 This release has been tracked through the [v20.0

rpm/cloud-hypervisor.spec

@@ -9,7 +9,7 @@
 
 Name:           cloud-hypervisor
 Summary:        Cloud Hypervisor is an open source Virtual Machine Monitor (VMM) that runs on top of KVM.
-Version:        20.0
+Version:        20.2
 Release:        0%{?dist}
 License:        ASL 2.0 or BSD-3-clause
 Group:          Applications/System
@@ -112,6 +112,12 @@ rm -rf %{buildroot}
 
 
 %changelog
+*   Tue Jan 04 2022 Rob Bradford <robert.bradford@intel.com> 20.2-0
+-   Update to 20.2
+
+*   Mon Dec 13 2021 Rob Bradford <robert.bradford@intel.com> 20.1-0
+-   Update to 20.1
+
 *   Thu Dec 02 2021 Sebastien Boeuf <sebastien.boeuf@intel.com> 20.0-0
 -   Update to 20.0
 

virtio-devices/src/net.rs

@@ -34,9 +34,7 @@ use std::{collections::HashMap, convert::TryInto};
 use versionize::{VersionMap, Versionize, VersionizeResult};
 use versionize_derive::Versionize;
 use virtio_bindings::bindings::virtio_net::*;
-use virtio_bindings::bindings::virtio_ring::{
+use virtio_bindings::bindings::virtio_ring::VIRTIO_RING_F_EVENT_IDX;
-    VIRTIO_RING_F_EVENT_IDX, VIRTIO_RING_F_INDIRECT_DESC,
-};
 use virtio_queue::Queue;
 use vm_memory::{ByteValued, GuestMemoryAtomic};
 use vm_migration::VersionMapped;
@@ -400,9 +398,7 @@ impl Net {
             | 1 << VIRTIO_NET_F_HOST_TSO4
             | 1 << VIRTIO_NET_F_HOST_TSO6
             | 1 << VIRTIO_NET_F_HOST_UFO
-            | 1 << VIRTIO_NET_F_MRG_RXBUF
             | 1 << VIRTIO_RING_F_EVENT_IDX
-            | 1 << VIRTIO_RING_F_INDIRECT_DESC
             | 1 << VIRTIO_F_VERSION_1;
 
         if iommu {

virtio-devices/src/vsock/unix/muxer.rs

@@ -362,25 +362,24 @@ impl VsockMuxer {
 
     /// Handle/dispatch an epoll event to its listener.
     ///
-    fn handle_event(&mut self, fd: RawFd, evset: epoll::Events) {
+    fn handle_event(&mut self, fd: RawFd, event_set: epoll::Events) {
         debug!(
-            "vsock: muxer processing event: fd={}, evset={:?}",
+            "vsock: muxer processing event: fd={}, event_set={:?}",
-            fd, evset
+            fd, event_set
         );
 
         match self.listener_map.get_mut(&fd) {
             // This event needs to be forwarded to a `MuxerConnection` that is listening for
             // it.
             //
-            Some(EpollListener::Connection { key, evset }) => {
+            Some(EpollListener::Connection { key, evset: _ }) => {
                 let key_copy = *key;
-                let evset_copy = *evset;
                 // The handling of this event will most probably mutate the state of the
                 // receiving connection. We'll need to check for new pending RX, event set
                 // mutation, and all that, so we're wrapping the event delivery inside those
                 // checks.
                 self.apply_conn_mutation(key_copy, |conn| {
-                    conn.notify(evset_copy);
+                    conn.notify(event_set);
                 });
             }
 
@@ -443,7 +442,10 @@ impl VsockMuxer {
             }
 
             _ => {
-                info!("vsock: unexpected event: fd={:?}, evset={:?}", fd, evset);
+                info!(
+                    "vsock: unexpected event: fd={:?}, event_set={:?}",
+                    fd, event_set
+                );
             }
         }
     }

vmm/src/device_manager.rs

@@ -1167,7 +1167,7 @@ impl DeviceManager {
     }
 
     fn set_state(&mut self, state: &DeviceManagerState) {
-        self.device_tree = Arc::new(Mutex::new(state.device_tree.clone()));
+        *self.device_tree.lock().unwrap() = state.device_tree.clone();
         self.device_id_cnt = state.device_id_cnt;
     }
 
@@ -1712,9 +1712,14 @@ impl DeviceManager {
         let seccomp_filter =
             get_seccomp_filter(&self.seccomp_action, Thread::PtyForeground).unwrap();
 
-        let pipe = start_sigwinch_listener(seccomp_filter, pty)?;
+        match start_sigwinch_listener(seccomp_filter, pty) {
-
+            Ok(pipe) => {
-        self.console_resize_pipe = Some(Arc::new(pipe));
+                self.console_resize_pipe = Some(Arc::new(pipe));
+            }
+            Err(e) => {
+                warn!("Ignoring error from setting up SIGWINCH listener: {}", e)
+            }
+        }
 
         Ok(())
     }
@@ -1737,7 +1742,7 @@ impl DeviceManager {
                     self.config.lock().unwrap().console.file = Some(pty.path.clone());
                     let file = pty.main.try_clone().unwrap();
                     self.console_pty = Some(Arc::new(Mutex::new(pty)));
-                    self.console_resize_pipe = Some(Arc::new(resize_pipe.unwrap()));
+                    self.console_resize_pipe = resize_pipe.map(Arc::new);
                     Endpoint::FilePair(file.try_clone().unwrap(), file)
                 } else {
                     let (main, mut sub, path) =
@@ -4008,19 +4013,27 @@ impl Aml for DeviceManager {
             segment.append_aml_bytes(bytes);
         }
 
+        let mut mbrd_memory = Vec::new();
+
+        for segment in &self.pci_segments {
+            mbrd_memory.push(aml::Memory32Fixed::new(
+                true,
+                segment.mmio_config_address as u32,
+                layout::PCI_MMIO_CONFIG_SIZE_PER_SEGMENT as u32,
+            ))
+        }
+
+        let mut mbrd_memory_refs = Vec::new();
+        for mbrd_memory_ref in &mbrd_memory {
+            mbrd_memory_refs.push(mbrd_memory_ref as &dyn Aml);
+        }
+
         aml::Device::new(
             "_SB_.MBRD".into(),
             vec![
                 &aml::Name::new("_HID".into(), &aml::EisaName::new("PNP0C02")),
                 &aml::Name::new("_UID".into(), &aml::ZERO),
-                &aml::Name::new(
+                &aml::Name::new("_CRS".into(), &aml::ResourceTemplate::new(mbrd_memory_refs)),
-                    "_CRS".into(),
-                    &aml::ResourceTemplate::new(vec![&aml::Memory32Fixed::new(
-                        true,
-                        layout::PCI_MMCONFIG_START.0 as u32,
-                        layout::PCI_MMCONFIG_SIZE as u32,
-                    )]),
-                ),
             ],
         )
         .append_aml_bytes(bytes);

vmm/src/pci_segment.rs

@@ -22,9 +22,6 @@ use uuid::Uuid;
 use vm_allocator::AddressAllocator;
 use vm_device::BusDevice;
 
-// One bus with potentially 256 devices (32 slots x 8 functions).
-const PCI_MMIO_CONFIG_SIZE: u64 = 4096 * 256;
-
 pub(crate) struct PciSegment {
     pub(crate) id: u16,
     pub(crate) pci_bus: Arc<Mutex<PciBus>>,
@@ -62,14 +59,15 @@ impl PciSegment {
         )));
 
         let pci_config_mmio = Arc::new(Mutex::new(PciConfigMmio::new(Arc::clone(&pci_bus))));
-        let mmio_config_address = layout::PCI_MMCONFIG_START.0 + PCI_MMIO_CONFIG_SIZE * id as u64;
+        let mmio_config_address =
+            layout::PCI_MMCONFIG_START.0 + layout::PCI_MMIO_CONFIG_SIZE_PER_SEGMENT * id as u64;
 
         address_manager
             .mmio_bus
             .insert(
                 Arc::clone(&pci_config_mmio) as Arc<Mutex<dyn BusDevice>>,
                 mmio_config_address,
-                PCI_MMIO_CONFIG_SIZE,
+                layout::PCI_MMIO_CONFIG_SIZE_PER_SEGMENT,
             )
             .map_err(DeviceManagerError::BusError)?;
 
@@ -363,7 +361,7 @@ impl Aml for PciSegment {
                     &aml::Memory32Fixed::new(
                         true,
                         self.mmio_config_address as u32,
-                        PCI_MMIO_CONFIG_SIZE as u32,
+                        layout::PCI_MMIO_CONFIG_SIZE_PER_SEGMENT as u32,
                     ),
                     &aml::AddressSpace::new_memory(
                         aml::AddressSpaceCachable::NotCacheable,
@@ -392,7 +390,7 @@ impl Aml for PciSegment {
                     &aml::Memory32Fixed::new(
                         true,
                         self.mmio_config_address as u32,
-                        PCI_MMIO_CONFIG_SIZE as u32,
+                        layout::PCI_MMIO_CONFIG_SIZE_PER_SEGMENT as u32,
                     ),
                     &aml::AddressSpace::new_memory(
                         aml::AddressSpaceCachable::NotCacheable,

vmm/src/seccomp_filters.rs

@@ -275,6 +275,7 @@ fn create_vmm_ioctl_seccomp_rule_kvm() -> Result<Vec<SeccompRule>, BackendError>
     const KVM_SET_CLOCK: u64 = 0x4030_ae7b;
     const KVM_SET_CPUID2: u64 = 0x4008_ae90;
     const KVM_SET_FPU: u64 = 0x41a0_ae8d;
+    const KVM_SET_IDENTITY_MAP_ADDR: u64 = 0x4008_ae48;
     const KVM_SET_LAPIC: u64 = 0x4400_ae8f;
     const KVM_SET_MSRS: u64 = 0x4008_ae89;
     const KVM_SET_SREGS: u64 = 0x4138_ae84;
@@ -298,6 +299,7 @@ fn create_vmm_ioctl_seccomp_rule_kvm() -> Result<Vec<SeccompRule>, BackendError>
         and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_CLOCK)?],
         and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_CPUID2)?],
         and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_FPU)?],
+        and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_IDENTITY_MAP_ADDR)?],
         and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_LAPIC)?],
         and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_SREGS)?],
         and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_TSS_ADDR,)?],
@@ -425,14 +427,11 @@ fn vmm_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError> {
         #[cfg(target_arch = "x86_64")]
         (libc::SYS_epoll_wait, vec![]),
         (libc::SYS_eventfd2, vec![]),
-        (libc::SYS_execve, vec![]),
         (libc::SYS_exit, vec![]),
         (libc::SYS_exit_group, vec![]),
         (libc::SYS_fallocate, vec![]),
         (libc::SYS_fcntl, vec![]),
         (libc::SYS_fdatasync, vec![]),
-        #[cfg(target_arch = "x86_64")]
-        (libc::SYS_fork, vec![]),
         (libc::SYS_fstat, vec![]),
         (libc::SYS_fsync, vec![]),
         (libc::SYS_ftruncate, vec![]),

vmm/src/vm.rs

@@ -31,6 +31,8 @@ use crate::{
 };
 use anyhow::anyhow;
 use arch::get_host_cpu_phys_bits;
+#[cfg(target_arch = "x86_64")]
+use arch::layout::{KVM_IDENTITY_MAP_START, KVM_TSS_START};
 #[cfg(all(feature = "tdx", feature = "acpi"))]
 use arch::x86_64::tdx::TdVmmDataRegionType;
 #[cfg(feature = "tdx")]
@@ -753,7 +755,13 @@ impl Vm {
         let vm = hypervisor.create_vm().unwrap();
 
         #[cfg(target_arch = "x86_64")]
-        vm.enable_split_irq().unwrap();
+        {
+            vm.set_identity_map_address(KVM_IDENTITY_MAP_START.0)
+                .unwrap();
+            vm.set_tss_address(KVM_TSS_START.0 as usize).unwrap();
+            vm.enable_split_irq().unwrap();
+        }
+
         let phys_bits = physical_bits(config.lock().unwrap().cpus.max_phys_bits);
 
         #[cfg(target_arch = "x86_64")]
@@ -810,8 +818,15 @@ impl Vm {
     ) -> Result<Self> {
         hypervisor.check_required_extensions().unwrap();
         let vm = hypervisor.create_vm().unwrap();
+
         #[cfg(target_arch = "x86_64")]
-        vm.enable_split_irq().unwrap();
+        {
+            vm.set_identity_map_address(KVM_IDENTITY_MAP_START.0)
+                .unwrap();
+            vm.set_tss_address(KVM_TSS_START.0 as usize).unwrap();
+            vm.enable_split_irq().unwrap();
+        }
+
         let vm_snapshot = get_vm_snapshot(snapshot).map_err(Error::Restore)?;
         let config = vm_snapshot.config;
         if let Some(state) = vm_snapshot.state {
@@ -864,8 +879,15 @@ impl Vm {
     ) -> Result<Self> {
         hypervisor.check_required_extensions().unwrap();
         let vm = hypervisor.create_vm().unwrap();
+
         #[cfg(target_arch = "x86_64")]
-        vm.enable_split_irq().unwrap();
+        {
+            vm.set_identity_map_address(KVM_IDENTITY_MAP_START.0)
+                .unwrap();
+            vm.set_tss_address(KVM_TSS_START.0 as usize).unwrap();
+            vm.enable_split_irq().unwrap();
+        }
+
         let phys_bits = physical_bits(config.lock().unwrap().cpus.max_phys_bits);
 
         let memory_manager = MemoryManager::new(