kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

hypervisor, vmm: Add support for KVM_SEV_SNP_LAUNCH_FINISH

Browse Source 
Add the KVM_SEV_SNP_LAUNCH_FINISH ioctl, which finalizes the SNP
launch sequence and transitions the VM into a runnable encrypted
state.

Additionally, add KVM_SEV_SNP_LAUNCH_FINISH to the seccomp allowlist.

Co-authored-by: Keith Adler <kadler@cloudflare.com>
Signed-off-by: Keith Adler <kadler@cloudflare.com>
Co-authored-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Alex Orozco <aorozco@google.com>
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-04-07 16:57:42 -07:00
committed by Rob Bradford
parent 24db5e1efd
commit 4b2538f522
3 changed files with 62 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
vmm/src/seccomp_filters.rs
View File

@@ -113,6 +113,7 @@ mod kvm {
pub const KVM_SET_NESTED_STATE: u64 = 1082175167;
pub const KVM_SEV_SNP_LAUNCH_START: u64 = 0x4018_aeb4;
pub const KVM_SEV_SNP_LAUNCH_UPDATE: u64 = 0x8018_aeb5;
pub const KVM_SEV_SNP_LAUNCH_FINISH: u64 = 0x4008_aeb7;
}
mod iommufd {
@@ -271,6 +272,7 @@ fn create_vmm_ioctl_seccomp_rule_common_kvm() -> Result<Vec<SeccompRule>, Backen
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SET_NESTED_STATE)?],
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SEV_SNP_LAUNCH_START)?],
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SEV_SNP_LAUNCH_UPDATE)?],
and![Cond::new(1, ArgLen::Dword, Eq, KVM_SEV_SNP_LAUNCH_FINISH)?],
])
}