vmm: simplify seccomp code

Only Thread::Vmm and Thread::Vcpu need to know the hypervisor type.
Make the type optional, and then simplify the users.

Assisted-by: Pi-agent:Claude-Opus-4.7
Signed-off-by: Wei Liu <liuwe@microsoft.com>

cloud-hypervisor/src/main.rs

@@ -679,7 +679,6 @@ fn start_vmm(
             monitor,
             &seccomp_action,
             landlock_enable,
-            hypervisor.hypervisor_type(),
             exit_evt.try_clone().unwrap(),
         )
         .map_err(Error::EventMonitorThread)?;

vmm/src/api/dbus/mod.rs

@@ -9,7 +9,6 @@ use std::thread;
 
 use futures::channel::oneshot;
 use futures::{FutureExt, executor};
-use hypervisor::HypervisorType;
 use log::{error, warn};
 use seccompiler::{SeccompAction, apply_filter};
 use vmm_sys_util::eventfd::EventFd;
@@ -326,7 +325,6 @@ pub fn start_dbus_thread(
     api_sender: Sender<ApiRequest>,
     seccomp_action: &SeccompAction,
     exit_evt: EventFd,
-    hypervisor_type: HypervisorType,
 ) -> VmmResult<(thread::JoinHandle<VmmResult<()>>, DBusApiShutdownChannels)> {
     let dbus_iface = DBusApi::new(api_notifier, api_sender);
     let (connection, iface_ref) = executor::block_on(async move {
@@ -356,7 +354,7 @@ pub fn start_dbus_thread(
     let (send_done, recv_done) = oneshot::channel::<()>();
 
     // Retrieve seccomp filter for API thread
-    let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::DBusApi, hypervisor_type)
+    let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::DBusApi, None)
         .map_err(VmmError::CreateSeccompFilter)?;
 
     let thread_join_handle = thread::Builder::new()

vmm/src/api/http/mod.rs

@@ -14,7 +14,6 @@ use std::sync::LazyLock;
 use std::sync::mpsc::Sender;
 use std::thread;
 
-use hypervisor::HypervisorType;
 use log::{error, info};
 use micro_http::{
     Body, HttpServer, MediaType, Method, Request, Response, ServerError, StatusCode, Version,
@@ -328,11 +327,10 @@ fn start_http_thread(
     api_sender: Sender<ApiRequest>,
     seccomp_action: &SeccompAction,
     exit_evt: EventFd,
-    hypervisor_type: HypervisorType,
     landlock_enable: bool,
 ) -> Result<HttpApiHandle> {
     // Retrieve seccomp filter for API thread
-    let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::HttpApi, hypervisor_type)
+    let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::HttpApi, None)
         .map_err(VmmError::CreateSeccompFilter)?;
 
     let api_shutdown_fd = EventFd::new(libc::EFD_NONBLOCK).map_err(VmmError::EventFdCreate)?;
@@ -410,7 +408,6 @@ pub fn start_http_path_thread(
     api_sender: Sender<ApiRequest>,
     seccomp_action: &SeccompAction,
     exit_evt: EventFd,
-    hypervisor_type: HypervisorType,
     landlock_enable: bool,
 ) -> Result<HttpApiHandle> {
     let socket_path = PathBuf::from(path);
@@ -425,7 +422,6 @@ pub fn start_http_path_thread(
         api_sender,
         seccomp_action,
         exit_evt,
-        hypervisor_type,
         landlock_enable,
     )
 }
@@ -436,7 +432,6 @@ pub fn start_http_fd_thread(
     api_sender: Sender<ApiRequest>,
     seccomp_action: &SeccompAction,
     exit_evt: EventFd,
-    hypervisor_type: HypervisorType,
     landlock_enable: bool,
 ) -> Result<HttpApiHandle> {
     // SAFETY: Valid FD
@@ -447,7 +442,6 @@ pub fn start_http_fd_thread(
         api_sender,
         seccomp_action,
         exit_evt,
-        hypervisor_type,
         landlock_enable,
     )
 }

vmm/src/console_devices.rs

@@ -193,12 +193,8 @@ pub(crate) fn pre_create_console_devices(vmm: &mut Vmm) -> ConsoleDeviceResult<C
                 set_raw_mode(&sub_fd.as_raw_fd(), &mut original_termios_opt)?;
                 vmconfig.console.common.file = Some(path.clone());
                 vmm.console_resize_pipe = Some(Arc::new(
-                    listen_for_sigwinch_on_tty(
-                        sub_fd,
-                        &vmm.seccomp_action,
-                        vmm.hypervisor.hypervisor_type(),
-                    )
-                    .map_err(ConsoleDeviceError::StartSigwinchListener)?,
+                    listen_for_sigwinch_on_tty(sub_fd, &vmm.seccomp_action)
+                        .map_err(ConsoleDeviceError::StartSigwinchListener)?,
                 ));
                 ConsoleTransport::Pty(Arc::new(main_fd))
             }
@@ -214,7 +210,6 @@ pub(crate) fn pre_create_console_devices(vmm: &mut Vmm) -> ConsoleDeviceResult<C
                         listen_for_sigwinch_on_tty(
                             stdout.try_clone().unwrap(),
                             &vmm.seccomp_action,
-                            vmm.hypervisor.hypervisor_type(),
                         )
                         .map_err(ConsoleDeviceError::StartSigwinchListener)?,
                     ));

vmm/src/cpu.rs

@@ -1172,7 +1172,7 @@ impl CpuManager {
         let vcpu_seccomp_filter = get_seccomp_filter(
             &self.seccomp_action,
             Thread::Vcpu,
-            self.hypervisor.hypervisor_type(),
+            Some(self.hypervisor.hypervisor_type()),
         )
         .map_err(Error::CreateSeccompFilter)?;
 

vmm/src/lib.rs

@@ -391,11 +391,10 @@ pub fn start_event_monitor_thread(
     mut monitor: event_monitor::Monitor,
     seccomp_action: &SeccompAction,
     landlock_enable: bool,
-    hypervisor_type: hypervisor::HypervisorType,
     exit_event: EventFd,
 ) -> Result<thread::JoinHandle<Result<()>>> {
     // Retrieve seccomp filter
-    let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::EventMonitor, hypervisor_type)
+    let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::EventMonitor, None)
         .map_err(Error::CreateSeccompFilter)?;
 
     thread::Builder::new()
@@ -478,7 +477,7 @@ pub fn start_vmm_thread(
     let hypervisor_type = hypervisor.hypervisor_type();
 
     // Retrieve seccomp filter
-    let vmm_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::Vmm, hypervisor_type)
+    let vmm_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::Vmm, Some(hypervisor_type))
         .map_err(Error::CreateSeccompFilter)?;
 
     let vmm_seccomp_action = seccomp_action.clone();
@@ -527,7 +526,6 @@ pub fn start_vmm_thread(
                 api_sender.clone(),
                 seccomp_action,
                 exit_event.try_clone().map_err(Error::EventFdClone)?,
-                hypervisor_type,
             )?;
             Some(chs)
         }
@@ -541,7 +539,6 @@ pub fn start_vmm_thread(
             api_sender,
             seccomp_action,
             exit_event,
-            hypervisor_type,
             landlock_enable,
         )?)
     } else if let Some(http_fd) = http_fd {
@@ -551,7 +548,6 @@ pub fn start_vmm_thread(
             api_sender,
             seccomp_action,
             exit_event,
-            hypervisor_type,
             landlock_enable,
         )?)
     } else {
@@ -750,12 +746,9 @@ impl Vmm {
                 let exit_evt = self.exit_evt.try_clone().map_err(Error::EventFdClone)?;
                 let original_termios_opt = Arc::clone(&self.original_termios_opt);
 
-                let signal_handler_seccomp_filter = get_seccomp_filter(
-                    &self.seccomp_action,
-                    Thread::SignalHandler,
-                    self.hypervisor.hypervisor_type(),
-                )
-                .map_err(Error::CreateSeccompFilter)?;
+                let signal_handler_seccomp_filter =
+                    get_seccomp_filter(&self.seccomp_action, Thread::SignalHandler, None)
+                        .map_err(Error::CreateSeccompFilter)?;
                 self.threads.push(
                     thread::Builder::new()
                         .name("vmm_signal_handler".to_string())

vmm/src/seccomp_filters.rs

@@ -1033,7 +1033,7 @@ fn event_monitor_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendE
 
 fn get_seccomp_rules(
     thread_type: Thread,
-    hypervisor_type: HypervisorType,
+    hypervisor_type: Option<HypervisorType>,
 ) -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError> {
     match thread_type {
         Thread::HttpApi => Ok(http_api_thread_rules()?),
@@ -1041,8 +1041,12 @@ fn get_seccomp_rules(
         Thread::DBusApi => Ok(dbus_api_thread_rules()?),
         Thread::EventMonitor => Ok(event_monitor_thread_rules()?),
         Thread::SignalHandler => Ok(signal_handler_thread_rules()?),
-        Thread::Vcpu => Ok(vcpu_thread_rules(hypervisor_type)?),
-        Thread::Vmm => Ok(vmm_thread_rules(hypervisor_type)?),
+        Thread::Vcpu => Ok(vcpu_thread_rules(
+            hypervisor_type.expect("hypervisor_type is required for Vcpu threads"),
+        )?),
+        Thread::Vmm => Ok(vmm_thread_rules(
+            hypervisor_type.expect("hypervisor_type is required for Vmm threads"),
+        )?),
         Thread::PtyForeground => Ok(pty_foreground_thread_rules()?),
     }
 }
@@ -1051,7 +1055,7 @@ fn get_seccomp_rules(
 pub fn get_seccomp_filter(
     seccomp_action: &SeccompAction,
     thread_type: Thread,
-    hypervisor_type: HypervisorType,
+    hypervisor_type: Option<HypervisorType>,
 ) -> Result<BpfProgram, Error> {
     match seccomp_action {
         SeccompAction::Allow => Ok(vec![]),

vmm/src/sigwinch_listener.rs

@@ -12,7 +12,6 @@ use std::process::exit;
 use std::ptr::null_mut;
 
 use arch::_NSIG;
-use hypervisor::HypervisorType;
 use libc::{
     EINVAL, ENOSYS, ENOTTY, O_CLOEXEC, POLLERR, SIG_DFL, SIG_SETMASK, SIGCHLD, SIGWINCH,
     STDERR_FILENO, SYS_close_range, TIOCSCTTY, c_int, c_void, close, fork, getpgrp, ioctl, pipe2,
@@ -270,10 +269,8 @@ pub fn start_sigwinch_listener(seccomp_filter: BpfProgramRef, tty_sub: File) ->
 pub fn listen_for_sigwinch_on_tty(
     pty_sub: File,
     seccomp_action: &SeccompAction,
-    hypervisor_type: HypervisorType,
 ) -> std::io::Result<File> {
-    let seccomp_filter =
-        get_seccomp_filter(seccomp_action, Thread::PtyForeground, hypervisor_type).unwrap();
+    let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::PtyForeground, None).unwrap();
 
     let console_resize_pipe = start_sigwinch_listener(&seccomp_filter, pty_sub)?;