From b77f779c902f8c24e7b9c6c17520d4e2edf41c03 Mon Sep 17 00:00:00 2001 From: Muminul Islam Date: Thu, 22 Feb 2024 16:30:31 -0800 Subject: [PATCH] vmm: Add seccomp rules for MSHV SevSnp guest There are new IOCTLs added for SevSnp guest support. This patch adds necessary seccomp ruled. Signed-off-by: Muminul Islam --- vmm/src/seccomp_filters.rs | 47 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index b0c9a6bbd..6201f5ea7 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -173,6 +173,14 @@ mod mshv { pub const MSHV_CREATE_DEVICE: u64 = 0xc00c_b813; pub const MSHV_SET_DEVICE_ATTR: u64 = 0x4018_b814; pub const MSHV_VP_REGISTER_INTERCEPT_RESULT: u64 = 0x4030_b817; + pub const MSHV_GET_VP_CPUID_VALUES: u64 = 0xc028_b81b; + pub const MSHV_MODIFY_GPA_HOST_ACCESS: u64 = 0x4018_b828; + pub const MSHV_IMPORT_ISOLATED_PAGES: u64 = 0x4010_b829; + pub const MSHV_COMPLETE_ISOLATED_IMPORT: u64 = 0x4d06_b830; + pub const MSHV_READ_GPA: u64 = 0xc020_b832; + pub const MSHV_WRITE_GPA: u64 = 0x4020_b833; + pub const MSHV_SEV_SNP_AP_CREATE: u64 = 0x4010_b834; + pub const MSHV_ISSUE_PSP_GUEST_REQUEST: u64 = 0x4010_b831; } #[cfg(feature = "mshv")] use mshv::*; @@ -210,6 +218,29 @@ fn create_vmm_ioctl_seccomp_rule_common_mshv() -> Result, Backe )?], and![Cond::new(1, ArgLen::Dword, Eq, MSHV_CREATE_DEVICE)?], and![Cond::new(1, ArgLen::Dword, Eq, MSHV_SET_DEVICE_ATTR)?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_GET_VP_CPUID_VALUES)?], + and![Cond::new( + 1, + ArgLen::Dword, + Eq, + MSHV_MODIFY_GPA_HOST_ACCESS + )?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_IMPORT_ISOLATED_PAGES)?], + and![Cond::new( + 1, + ArgLen::Dword, + Eq, + MSHV_COMPLETE_ISOLATED_IMPORT + )?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_READ_GPA)?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_WRITE_GPA)?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_SEV_SNP_AP_CREATE)?], + and![Cond::new( + 1, + ArgLen::Dword, + Eq, + MSHV_ISSUE_PSP_GUEST_REQUEST + )?], ]) } @@ -672,6 +703,22 @@ fn create_vcpu_ioctl_seccomp_rule_mshv() -> Result, BackendErro and![Cond::new(1, ArgLen::Dword, Eq, MSHV_MAP_GUEST_MEMORY)?], and![Cond::new(1, ArgLen::Dword, Eq, MSHV_UNMAP_GUEST_MEMORY)?], and![Cond::new(1, ArgLen::Dword, Eq, MSHV_VP_TRANSLATE_GVA)?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_GET_VP_CPUID_VALUES)?], + and![Cond::new( + 1, + ArgLen::Dword, + Eq, + MSHV_MODIFY_GPA_HOST_ACCESS + )?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_READ_GPA)?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_WRITE_GPA)?], + and![Cond::new(1, ArgLen::Dword, Eq, MSHV_SEV_SNP_AP_CREATE)?], + and![Cond::new( + 1, + ArgLen::Dword, + Eq, + MSHV_ISSUE_PSP_GUEST_REQUEST + )?], ]) }