kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: add VIRTIO_F_ACCESS_PLATFORM to watchdog and iommu

Browse Source 
A confidential guest (e.g. SEV-SNP) requires every virtio device to
advertise VIRTIO_F_ACCESS_PLATFORM so the guest driver routes DMA
through the platform's bounce-buffer path; the driver refuses a device
that does not offer it.

Add VIRTIO_F_ACCESS_PLATFORM support to virtio-{watchdog,iommu} which
are exercised as part of the CVM integration tests.

Assisted-by: Claude:Opus-4.8
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-06-02 17:10:28 -07:00
committed by Rob Bradford
parent 2b71ffd48e
commit 9e6c817192
5 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
virtio-devices/src/iommu.rs
View File

@@ -27,7 +27,8 @@ use vmm_sys_util::eventfd::EventFd;
use super::{
ActivateResult, EPOLL_HELPER_EVENT_LAST, EpollHelper, EpollHelperError, EpollHelperHandler,
Error as DeviceError, VIRTIO_F_VERSION_1, VirtioCommon, VirtioDevice, VirtioDeviceType,
Error as DeviceError, VIRTIO_F_ACCESS_PLATFORM, VIRTIO_F_VERSION_1, VirtioCommon, VirtioDevice,
VirtioDeviceType,
};
use crate::seccomp_filters::Thread;
use crate::{DmaRemapping, GuestMemoryMmap, VirtioInterrupt, VirtioInterruptType};
@@ -1117,6 +1118,7 @@ impl Iommu {
exit_evt: EventFd,
msi_iova_space: (u64, u64),
address_width_bits: u8,
access_platform_enabled: bool,
state: Option<IommuState>,
) -> io::Result<(Self, Arc<IommuMapping>)> {
let (mut avail_features, acked_features, endpoints, domains, paused) =
@@ -1165,6 +1167,10 @@ impl Iommu {
None
};
if access_platform_enabled {
avail_features |= 1u64 << VIRTIO_F_ACCESS_PLATFORM;
}
let mapping = Arc::new(IommuMapping {
endpoints: Arc::new(RwLock::new(endpoints)),
domains: Arc::new(RwLock::new(domains)),

11
virtio-devices/src/watchdog.rs
View File

@@ -27,8 +27,8 @@ use vmm_sys_util::eventfd::EventFd;
use super::{
ActivateError, ActivateResult, EPOLL_HELPER_EVENT_LAST, EpollHelper, EpollHelperError,
EpollHelperHandler, Error as DeviceError, VIRTIO_F_VERSION_1, VirtioCommon, VirtioDevice,
VirtioDeviceType,
EpollHelperHandler, Error as DeviceError, VIRTIO_F_ACCESS_PLATFORM, VIRTIO_F_VERSION_1,
VirtioCommon, VirtioDevice, VirtioDeviceType,
};
use crate::seccomp_filters::Thread;
use crate::{GuestMemoryMmap, VirtioInterrupt, VirtioInterruptType};
@@ -208,6 +208,7 @@ impl Watchdog {
/// Create a new virtio watchdog device that will reboot VM if the guest hangs
pub fn new(
id: String,
access_platform_enabled: bool,
reset_evt: EventFd,
seccomp_action: SeccompAction,
exit_evt: EventFd,
@@ -226,7 +227,11 @@ impl Watchdog {
(state.avail_features, state.acked_features, true)
} else {
(1u64 << VIRTIO_F_VERSION_1, 0, false)
let mut avail_features = 1u64 << VIRTIO_F_VERSION_1;
if access_platform_enabled {
avail_features |= 1u64 << VIRTIO_F_ACCESS_PLATFORM;
}
(avail_features, 0, false)
};
let timer_fd = timerfd_create().map_err(|e| {