Module cpu_profile_admission 

Admission for intercepted CPU profiles: v3 binds qualified host XSTATE facts; host-no-rdrand requires CPUID faulting without the v3 qualification.

Every class the v3 startup qualification cannot cover is refused by name. Neither nondefault profile silently falls back to v2 or native CPUID.

Structs

AdmissionRequest

What the run asks for, as far as admission is concerned.

CpuProfileRefusal

A refused CPU profile, carried as an error so that it crosses the container boundary as a policy refusal (exit 122).

NativeCpuid

The CPUID instruction of the host this process runs on.

Constants

CPUID_FAULTING_VM_SCRIPT

The source-tree script that loads a module turning on CPUID faulting in a KVM guest whose hypervisor offers it but whose pre-6.17 kernel probes it only on Intel vCPU models.

Traits

HostCpuid

A host CPUID reader, so tests can supply a host.

Functions

admit

Admits a v3 run on this host, or names why not. On success the probe report and the host facts to bind are returned, and this process’s ptrace floating-point register writes are refused from then on. The request’s own refusals are checked every time; the host qualification runs once per process.

admit_host_no_rdrand

Select the lowest allowed CPU before the CLI’s container can randomly narrow affinity. Probe that CPU, restore the caller’s mask, and return the source to carry in Config::cpu_profile_source. The launch guard pins the actual tracer thread; this also works with a pre-existing library worker. Repeat runs require the same allowed CPU set and host configuration.

check_host_cpuid

The host checks that need only CPUID, in the order they are checked: every advertised v3 feature bit natively, OSXSAVE, not a hybrid part, and not an AMD part without XSAVEERPTR (where Linux runs fnclex; emms; fildl before every FPU restore, a path no host here can exercise).

check_host_no_rdrand_request

The host profile must intercept CPUID and TSC on ptrace. Unlike v3, it retains host XSAVE behavior and does not claim the XSTATE qualification.

check_kernel

Linux 5.16 is the first with the ARCH_*_XCOMP_* queries the profile answers from the host; before it they return EINVAL.

check_record_or_replay

A recording currently binds only the v3 host facts, not a complete native CPUID snapshot. Refuse host mode before writing metadata or launching a guest rather than accidentally treating it as v3.

check_request

The refusals that need no host probe, in the order they are checked.

cpuid_faulting_vm_pointer

A pointer to CPUID_FAULTING_VM_SCRIPT when host reports a hypervisor (CPUID leaf 1 ECX bit 31) and release is older than Linux 6.17, the only hosts the module can help; None otherwise.

first_difference

The first host fact in which replay differs from recorded, by name, or None when they are equal.

kernel_version

Linux’s version as (major, minor), from a uname -r release string.

missing_cpuid_faulting_note

The note to print after an error whose chain reports missing CPUID faulting, on a host where the script may help, unless a message already carries the pointer.

precheck_replay

Refuses a v3 replay before the qualification probe runs when the recording carries no host facts, when this host differs in one of the facts it bound (the qualification itself aside), or when its CPUID table digest is not the one this replayer computes from them. The probe costs seconds of CPU, and a replay on a different CPU, or of an altered recording, needs none of it to be refused. Returns the recorded facts.

qualify_host

The host half of admit, run once per process: the kernel, the every-bit CPUID check, the dynamic-feature refusal, the probe and the host facts. hermit host-capabilities --cpu-profile x86-64-v3 runs it alone.

qualify_host_no_rdrand

Probe the Linux CPUID-faulting API in a child. Disabling CPUID in the tracer would also fault Rust’s and libc’s own feature detection, so only the forked child changes its state. After fork the child uses only libc syscalls and _exit, without allocation, locks or unwinding.

record_or_replay_request

The admission request of a recording or replay, which always runs on the ptrace backend with virtual CPUID.

refuse_unadmitted_launch

Refuses a nondefault profile launch that this process did not admit. Hermit’s library launch functions call this before any backend starts. Host mode requires its faulting proof and interception options; v3 also requires exactly the host facts admit bound after qualification and its floating-point register write ban.

Type Aliases

AdmissionRefusal

Why a profile is refused, after --cpu-profile <profile> refused: .

Qualification

What a host qualification yields: the XSTATE probe’s report and the host facts a v3 run binds.