kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

hypervisor, vmm: Add support for KVM_SEV_SNP_LAUNCH_UPDATE

Browse Source 
Implement the KVM_SEV_SNP_LAUNCH_UPDATE ioctl.

Extend Vm::import_isolated_pages() with a uaddrs parameter carrying
host virtual addresses, which KVM needs, unlike MSHV. Compute uaddrs
from guest memory mappings in the IGVM loader.

Add KVM_SEV_SNP_LAUNCH_UPDATE to the seccomp allowlist.

Co-authored-by: Keith Adler <kadler@cloudflare.com>
Signed-off-by: Keith Adler <kadler@cloudflare.com>
Co-authored-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-04-07 16:43:32 -07:00
committed by Rob Bradford
parent 2e004521e0
commit 24db5e1efd
6 changed files with 104 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
vmm/src/igvm/igvm_loader.rs
View File

@@ -19,6 +19,8 @@ use log::debug;
use log::info;
use mshv_bindings::*;
use thiserror::Error;
#[cfg(feature = "sev_snp")]
use vm_memory::{GuestAddress, GuestAddressSpace, GuestMemory};
use zerocopy::IntoBytes;
#[cfg(feature = "sev_snp")]
@@ -471,6 +473,16 @@ pub fn load_igvm(
.iter()
.map(|gpa| gpa.gpa >> HV_HYP_PAGE_SHIFT)
.collect();
let guest_memory = memory_manager.lock().unwrap().guest_memory().memory();
let uaddrs: Vec<_> = group
.iter()
.map(|gpa| {
let guest_region_mmap = guest_memory.to_region_addr(GuestAddress(gpa.gpa));
let uaddr_base = guest_region_mmap.unwrap().0.as_ptr() as u64;
let uaddr_offset: u64 = guest_region_mmap.unwrap().1.0;
uaddr_base + uaddr_offset
})
.collect();
memory_manager
.lock()
.unwrap()
@@ -479,6 +491,7 @@ pub fn load_igvm(
group[0].page_type,
hv_isolated_page_size_HV_ISOLATED_PAGE_SIZE_4KB,
&pfns,
&uaddrs,
)
.map_err(Error::ImportIsolatedPages)?;
}

2
vmm/src/seccomp_filters.rs
View File

@@ -112,6 +112,7 @@ mod kvm {
pub const KVM_GET_NESTED_STATE: u64 = 3229658814;
pub const KVM_SET_NESTED_STATE: u64 = 1082175167;
pub const KVM_SEV_SNP_LAUNCH_START: u64 = 0x4018_aeb4;
pub const KVM_SEV_SNP_LAUNCH_UPDATE: u64 = 0x8018_aeb5;
}
mod iommufd {
@@ -269,6 +270,7 @@ fn create_vmm_ioctl_seccomp_rule_common_kvm() -> Result<Vec<SeccompRule>, Backen
and![Cond::new(1, ArgLen::Dword, Eq, KVM_GET_NESTED_STATE)?],
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_NESTED_STATE)?],
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SEV_SNP_LAUNCH_START)?],
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SEV_SNP_LAUNCH_UPDATE)?],
])
}