CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/19 11:21:52
Modified files:
regress/sys/arch/amd64/vmm: vcpu.c
share/man/man4/man4.amd64: vmm.4
sys/arch/amd64/amd64: vmm_machdep.c
sys/arch/amd64/include: vmmvar.h
sys/arch/arm64/include: vmmvar.h
sys/dev/ic : psp.c pspvar.h
sys/dev/vmm : vmm.c vmm.h
sys/kern : kern_pledge.c uipc_usrreq.c
sys/sys : file.h pledge.h
usr.bin/fstat : fstat.c
usr.sbin/vmd : arm64_vm.c dhcp.c i8253.c i8253.h lapic.c
mc146818.c mc146818.h ns8250.c ns8250.h pci.c
psp.c sev.c vioblk.c vionet.c vioscsi.c
virtio.c virtio.h vm.c vmd.c vmd.h vmm.c
x86_vm.c
Log message:
Redesign vmm(4) to use files to manage vm ownership.
Now when VMM_IOC_CREATE creates a new virtual machine, it provides
the calling process a file descriptor to a file associated with the
vm. Access to the vm via various ioctl(2) calls, like VMM_IOC_RUN
and VMM_IOC_READREGS, now go through a file descriptor for that
file. A process can fork/exec and keep the file descriptor open to
allow inheritable access. (For now, we do not permit passing via
sockets to disparate processes.)
This solves a lot of lifecycle headaches, ties the lifetime of the
vm to the userland processes using it, and removes the hacky use
of pids and magic ids for controlling what a process with access
to /dev/vmm can do to a vm.
In vmd(8), the vmm process now takes sole responsibility for tracking
vm's it has created and the kernel is no longer expected to provide
this list back to vmd via the (now removed) VMM_IOC_INFO command.
pledge(2)'d processes like vmd still use the "vmm" pledge to filter
ioctl(2) commands to those needed for virtual machine operation,
but the filtering can now rely on the file type (a vm vs. /dev/vmm)
so remove reliance on checking things like caller pid and if the
caller also has the "proc" pledge.
Tested with help over the past few months by phessler@, bluhm@,
hshoexer@, mlarkin@, and Mischa Peters.
ok mlarkin@
