hypervisor, vmm: Add support for KVM_SEV_SNP_LAUNCH_FINISH

Add the KVM_SEV_SNP_LAUNCH_FINISH ioctl, which finalizes the SNP
launch sequence and transitions the VM into a runnable encrypted
state.

Additionally, add KVM_SEV_SNP_LAUNCH_FINISH to the seccomp allowlist.

Co-authored-by: Keith Adler <kadler@cloudflare.com>
Signed-off-by: Keith Adler <kadler@cloudflare.com>
Co-authored-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Ruben Hakobyan <hruben@meta.com>

hypervisor/src/kvm/mod.rs

@@ -675,6 +675,25 @@ impl vm::Vm for KvmVm {
         Ok(())
     }
 
+    #[cfg(all(feature = "sev_snp", target_arch = "x86_64"))]
+    fn complete_isolated_import(
+        &self,
+        snp_id_block: igvm_defs::IGVM_VHS_SNP_ID_BLOCK,
+        host_data: [u8; 32],
+        id_block_enabled: u8,
+    ) -> vm::Result<()> {
+        self.sev_fd
+            .as_ref()
+            .unwrap()
+            .launch_finish(
+                &self.fd,
+                host_data,
+                id_block_enabled,
+                snp_id_block.author_key_enabled,
+            )
+            .map_err(|e| vm::HypervisorVmError::CompleteIsolatedImport(e.into()))
+    }
+
     #[cfg(target_arch = "x86_64")]
     ///
     /// Sets the address of the one-page region in the VM's address space.