From 73146be06b57f0fa8d210d0f7c5e29bf35939895 Mon Sep 17 00:00:00 2001 From: Wei Liu Date: Thu, 14 May 2026 22:17:04 +0000 Subject: [PATCH] vmm: simplify seccomp code Only Thread::Vmm and Thread::Vcpu need to know the hypervisor type. Make the type optional, and then simplify the users. Assisted-by: Pi-agent:Claude-Opus-4.7 Signed-off-by: Wei Liu --- cloud-hypervisor/src/main.rs | 1 - vmm/src/api/dbus/mod.rs | 4 +--- vmm/src/api/http/mod.rs | 8 +------- vmm/src/console_devices.rs | 9 ++------- vmm/src/cpu.rs | 2 +- vmm/src/lib.rs | 17 +++++------------ vmm/src/seccomp_filters.rs | 12 ++++++++---- vmm/src/sigwinch_listener.rs | 5 +---- 8 files changed, 19 insertions(+), 39 deletions(-) diff --git a/cloud-hypervisor/src/main.rs b/cloud-hypervisor/src/main.rs index 5de2e4c2d..9637d3f91 100644 --- a/cloud-hypervisor/src/main.rs +++ b/cloud-hypervisor/src/main.rs @@ -679,7 +679,6 @@ fn start_vmm( monitor, &seccomp_action, landlock_enable, - hypervisor.hypervisor_type(), exit_evt.try_clone().unwrap(), ) .map_err(Error::EventMonitorThread)?; diff --git a/vmm/src/api/dbus/mod.rs b/vmm/src/api/dbus/mod.rs index ae39feb7d..5f84b8025 100644 --- a/vmm/src/api/dbus/mod.rs +++ b/vmm/src/api/dbus/mod.rs @@ -9,7 +9,6 @@ use std::thread; use futures::channel::oneshot; use futures::{FutureExt, executor}; -use hypervisor::HypervisorType; use log::{error, warn}; use seccompiler::{SeccompAction, apply_filter}; use vmm_sys_util::eventfd::EventFd; @@ -326,7 +325,6 @@ pub fn start_dbus_thread( api_sender: Sender, seccomp_action: &SeccompAction, exit_evt: EventFd, - hypervisor_type: HypervisorType, ) -> VmmResult<(thread::JoinHandle>, DBusApiShutdownChannels)> { let dbus_iface = DBusApi::new(api_notifier, api_sender); let (connection, iface_ref) = executor::block_on(async move { @@ -356,7 +354,7 @@ pub fn start_dbus_thread( let (send_done, recv_done) = oneshot::channel::<()>(); // Retrieve seccomp filter for API thread - let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::DBusApi, hypervisor_type) + let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::DBusApi, None) .map_err(VmmError::CreateSeccompFilter)?; let thread_join_handle = thread::Builder::new() diff --git a/vmm/src/api/http/mod.rs b/vmm/src/api/http/mod.rs index f7cea4faf..ff6db1e26 100644 --- a/vmm/src/api/http/mod.rs +++ b/vmm/src/api/http/mod.rs @@ -14,7 +14,6 @@ use std::sync::LazyLock; use std::sync::mpsc::Sender; use std::thread; -use hypervisor::HypervisorType; use log::{error, info}; use micro_http::{ Body, HttpServer, MediaType, Method, Request, Response, ServerError, StatusCode, Version, @@ -328,11 +327,10 @@ fn start_http_thread( api_sender: Sender, seccomp_action: &SeccompAction, exit_evt: EventFd, - hypervisor_type: HypervisorType, landlock_enable: bool, ) -> Result { // Retrieve seccomp filter for API thread - let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::HttpApi, hypervisor_type) + let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::HttpApi, None) .map_err(VmmError::CreateSeccompFilter)?; let api_shutdown_fd = EventFd::new(libc::EFD_NONBLOCK).map_err(VmmError::EventFdCreate)?; @@ -410,7 +408,6 @@ pub fn start_http_path_thread( api_sender: Sender, seccomp_action: &SeccompAction, exit_evt: EventFd, - hypervisor_type: HypervisorType, landlock_enable: bool, ) -> Result { let socket_path = PathBuf::from(path); @@ -425,7 +422,6 @@ pub fn start_http_path_thread( api_sender, seccomp_action, exit_evt, - hypervisor_type, landlock_enable, ) } @@ -436,7 +432,6 @@ pub fn start_http_fd_thread( api_sender: Sender, seccomp_action: &SeccompAction, exit_evt: EventFd, - hypervisor_type: HypervisorType, landlock_enable: bool, ) -> Result { // SAFETY: Valid FD @@ -447,7 +442,6 @@ pub fn start_http_fd_thread( api_sender, seccomp_action, exit_evt, - hypervisor_type, landlock_enable, ) } diff --git a/vmm/src/console_devices.rs b/vmm/src/console_devices.rs index a1f3493fd..a7222cefe 100644 --- a/vmm/src/console_devices.rs +++ b/vmm/src/console_devices.rs @@ -193,12 +193,8 @@ pub(crate) fn pre_create_console_devices(vmm: &mut Vmm) -> ConsoleDeviceResult ConsoleDeviceResult Result>> { // Retrieve seccomp filter - let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::EventMonitor, hypervisor_type) + let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::EventMonitor, None) .map_err(Error::CreateSeccompFilter)?; thread::Builder::new() @@ -478,7 +477,7 @@ pub fn start_vmm_thread( let hypervisor_type = hypervisor.hypervisor_type(); // Retrieve seccomp filter - let vmm_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::Vmm, hypervisor_type) + let vmm_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::Vmm, Some(hypervisor_type)) .map_err(Error::CreateSeccompFilter)?; let vmm_seccomp_action = seccomp_action.clone(); @@ -527,7 +526,6 @@ pub fn start_vmm_thread( api_sender.clone(), seccomp_action, exit_event.try_clone().map_err(Error::EventFdClone)?, - hypervisor_type, )?; Some(chs) } @@ -541,7 +539,6 @@ pub fn start_vmm_thread( api_sender, seccomp_action, exit_event, - hypervisor_type, landlock_enable, )?) } else if let Some(http_fd) = http_fd { @@ -551,7 +548,6 @@ pub fn start_vmm_thread( api_sender, seccomp_action, exit_event, - hypervisor_type, landlock_enable, )?) } else { @@ -750,12 +746,9 @@ impl Vmm { let exit_evt = self.exit_evt.try_clone().map_err(Error::EventFdClone)?; let original_termios_opt = Arc::clone(&self.original_termios_opt); - let signal_handler_seccomp_filter = get_seccomp_filter( - &self.seccomp_action, - Thread::SignalHandler, - self.hypervisor.hypervisor_type(), - ) - .map_err(Error::CreateSeccompFilter)?; + let signal_handler_seccomp_filter = + get_seccomp_filter(&self.seccomp_action, Thread::SignalHandler, None) + .map_err(Error::CreateSeccompFilter)?; self.threads.push( thread::Builder::new() .name("vmm_signal_handler".to_string()) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index fb5aaedf9..b08e8303b 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -1033,7 +1033,7 @@ fn event_monitor_thread_rules() -> Result)>, BackendE fn get_seccomp_rules( thread_type: Thread, - hypervisor_type: HypervisorType, + hypervisor_type: Option, ) -> Result)>, BackendError> { match thread_type { Thread::HttpApi => Ok(http_api_thread_rules()?), @@ -1041,8 +1041,12 @@ fn get_seccomp_rules( Thread::DBusApi => Ok(dbus_api_thread_rules()?), Thread::EventMonitor => Ok(event_monitor_thread_rules()?), Thread::SignalHandler => Ok(signal_handler_thread_rules()?), - Thread::Vcpu => Ok(vcpu_thread_rules(hypervisor_type)?), - Thread::Vmm => Ok(vmm_thread_rules(hypervisor_type)?), + Thread::Vcpu => Ok(vcpu_thread_rules( + hypervisor_type.expect("hypervisor_type is required for Vcpu threads"), + )?), + Thread::Vmm => Ok(vmm_thread_rules( + hypervisor_type.expect("hypervisor_type is required for Vmm threads"), + )?), Thread::PtyForeground => Ok(pty_foreground_thread_rules()?), } } @@ -1051,7 +1055,7 @@ fn get_seccomp_rules( pub fn get_seccomp_filter( seccomp_action: &SeccompAction, thread_type: Thread, - hypervisor_type: HypervisorType, + hypervisor_type: Option, ) -> Result { match seccomp_action { SeccompAction::Allow => Ok(vec![]), diff --git a/vmm/src/sigwinch_listener.rs b/vmm/src/sigwinch_listener.rs index 4cbfeddf5..9e3ebcfb1 100644 --- a/vmm/src/sigwinch_listener.rs +++ b/vmm/src/sigwinch_listener.rs @@ -12,7 +12,6 @@ use std::process::exit; use std::ptr::null_mut; use arch::_NSIG; -use hypervisor::HypervisorType; use libc::{ EINVAL, ENOSYS, ENOTTY, O_CLOEXEC, POLLERR, SIG_DFL, SIG_SETMASK, SIGCHLD, SIGWINCH, STDERR_FILENO, SYS_close_range, TIOCSCTTY, c_int, c_void, close, fork, getpgrp, ioctl, pipe2, @@ -270,10 +269,8 @@ pub fn start_sigwinch_listener(seccomp_filter: BpfProgramRef, tty_sub: File) -> pub fn listen_for_sigwinch_on_tty( pty_sub: File, seccomp_action: &SeccompAction, - hypervisor_type: HypervisorType, ) -> std::io::Result { - let seccomp_filter = - get_seccomp_filter(seccomp_action, Thread::PtyForeground, hypervisor_type).unwrap(); + let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::PtyForeground, None).unwrap(); let console_resize_pipe = start_sigwinch_listener(&seccomp_filter, pty_sub)?;