kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: seccomp: Allow IOMMU_DESTORY ioctl

Browse Source 
Update the seccomp filter for vmm and vcpu thread, because `Drop for
VfioIommufd` since vfio-ioctls v0.6.1 now issues IOMMU_DESTROY
to release the IOAS allocated for each VM boot.

Signed-off-by: Bo Chen <bchen@crusoe.ai>
This commit is contained in:
Bo Chen
2026-06-17 00:30:49 +00:00
committed by Rob Bradford
parent 75e4a46969
commit 96ea24339d
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
vmm/src/seccomp_filters.rs
View File

@@ -123,6 +123,7 @@ mod kvm {
mod iommufd {
// See include/uapi/linux/iommufd.h in the kernel code.
pub const IOMMU_DESTROY: u64 = 0x3b80;
pub const IOMMU_IOAS_ALLOC: u64 = 0x3b81;
pub const IOMMU_IOAS_MAP: u64 = 0x3b85;
pub const IOMMU_IOAS_UNMAP: u64 = 0x3b86;
@@ -284,6 +285,7 @@ fn create_vmm_ioctl_seccomp_rule_common_kvm() -> Result<Vec<SeccompRule>, Backen
fn create_vmm_ioctl_seccomp_rule_iommufd() -> Result<Vec<SeccompRule>, BackendError> {
use iommufd::*;
Ok(or![
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_DESTROY)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_ALLOC)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP)?],
@@ -838,6 +840,7 @@ fn create_vcpu_ioctl_seccomp_rule_hypervisor(
fn create_vcpu_ioctl_seccomp_rule_iommufd() -> Result<Vec<SeccompRule>, BackendError> {
use iommufd::*;
Ok(or![
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_DESTROY)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP)?],
and![Cond::new(