From 96ea24339d2af28591ea57ff2636fd23f58a8cee Mon Sep 17 00:00:00 2001 From: Bo Chen Date: Wed, 17 Jun 2026 00:30:49 +0000 Subject: [PATCH] vmm: seccomp: Allow IOMMU_DESTORY ioctl Update the seccomp filter for vmm and vcpu thread, because `Drop for VfioIommufd` since vfio-ioctls v0.6.1 now issues IOMMU_DESTROY to release the IOAS allocated for each VM boot. Signed-off-by: Bo Chen --- vmm/src/seccomp_filters.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index aba02305a..2f30d1b83 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -123,6 +123,7 @@ mod kvm { mod iommufd { // See include/uapi/linux/iommufd.h in the kernel code. + pub const IOMMU_DESTROY: u64 = 0x3b80; pub const IOMMU_IOAS_ALLOC: u64 = 0x3b81; pub const IOMMU_IOAS_MAP: u64 = 0x3b85; pub const IOMMU_IOAS_UNMAP: u64 = 0x3b86; @@ -284,6 +285,7 @@ fn create_vmm_ioctl_seccomp_rule_common_kvm() -> Result, Backen fn create_vmm_ioctl_seccomp_rule_iommufd() -> Result, BackendError> { use iommufd::*; Ok(or![ + and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_DESTROY)?], and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_ALLOC)?], and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP)?], and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP)?], @@ -838,6 +840,7 @@ fn create_vcpu_ioctl_seccomp_rule_hypervisor( fn create_vcpu_ioctl_seccomp_rule_iommufd() -> Result, BackendError> { use iommufd::*; Ok(or![ + and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_DESTROY)?], and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP)?], and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP)?], and![Cond::new(